Legal
Last updated September 2026.
Your brand profile, the prompts you track, and the full raw response from every AI check — including which engine and model answered, the timestamp, and any citations it returned. We store the full response deliberately, so you can open the exact answer behind any number in the dashboard rather than trust a summary.
Every check calls the AI provider's official API directly (OpenAI, Google, Anthropic, Perplexity, xAI) with your prompt text. We do not scrape any chat application. Each provider processes that request under its own terms and privacy practices, in addition to ours — see their respective policies for how they handle API requests.
Data belongs to your organisation and is isolated from every other organisation by row-level security enforced in the database itself — not application code filtering alone, so a bug in the app can't leak one customer's data to another. Within an organisation, owner, admin and member roles control access. A report you share via a link is viewable only by someone holding that exact link, and you can revoke it at any time.
The application and database run on Supabase infrastructure (Postgres, Auth), hosted in the Asia-Pacific (Singapore) region. The five AI providers we call on your behalf — OpenAI, Google, Anthropic, Perplexity and xAI — receive your prompt text as part of each check and act as subprocessors for that purpose. Resend delivers our transactional email (such as billing reminders), and Google Analytics and Microsoft Clarity process visit data only if you accept analytics cookies. We don't share your data with any other third party.
We retain your data for as long as your account is active, so your full check history stays available to you. Deleting a brand from the dashboard permanently removes its competitors, prompts and check history. You can download a copy of a workspace's data (Workspace settings → Your data) and delete your account there yourself; this permanently removes your login and every workspace you're the only member of. For anything else, contact us.
The site sets the cookies it needs to keep you signed in. If you accept analytics cookies, we also load Google Analytics to see which pages are used and where sign-ups come from (IP anonymisation on), and Microsoft Clarity to record anonymous session replays and heatmaps — on our public marketing pages only, never inside the signed-in app, report links or staff tools. Nothing from Google loads until you accept, and you can change your choice at any time from “Cookie settings” in the footer.
If you are in India, you have the right to access the personal data we hold about you, to have it corrected or erased, to nominate someone to exercise these rights on your behalf, and to have grievances redressed. We process personal data with your consent or for the purposes you would reasonably expect from using the product (such as running your account), and we keep it only as long as needed for those purposes or as the law requires. We acknowledge grievances within 48 hours and aim to resolve them within 30 days. Our Grievance Officer is Ruby Rawat, ruby@garagecollective.agency. If you are not satisfied you may complain to the Data Protection Board of India. Read more on our DPDP Act page, and our Terms, DPA and AI transparency pages.
Questions about this policy, or a data deletion request: contact us.
This page describes what the product actually does today, in plain terms. It has not been drafted or reviewed by legal counsel and isn't a substitute for that review before relying on it for compliance purposes.