1. Scope
This policy explains how GVGEO handles personal information and service data when you use our public website, create an account, run website audits or AI Visibility checks, use Content AI, connect WordPress, contact support or purchase a paid plan. It does not govern the independent privacy practices of third-party AI, search, payment, email, OAuth or hosting providers.
2. Data we collect
Account data may include your email address, password hash, account role and status, selected language, email-verification status, plan, subscription state, login timestamps and account settings. Service data may include submitted website URLs, project names and domains, brand and competitor information, saved monitoring questions, audit results, reports, alerts, generated drafts, deployment history, order records and messages you send to support.
We do not store your account password in plain text. Authentication sessions are stored as token hashes. Short-lived abuse-prevention records use hashed lookup values rather than storing the original rate-limit key in the event table.
3. Website audits, AI Visibility and Content AI
When you submit a website, GVGEO may fetch publicly accessible pages and resources such as robots.txt and XML sitemaps. We do not intentionally bypass login walls or access controls. For live AI Visibility, the minimum information needed for a run may be sent to configured external services, such as the question text, brand name, domain, competitor context, language or country setting. Returned answers, mentions, citations, provider status and timestamps may be stored so you can review history and trends.
If you request AI-assisted question generation or content optimization, relevant project context, instructions and selected public-page content may be sent to the configured model provider. The resulting question set or draft may be stored in your account. We do not promise that independent model providers will use or retain submitted data in the same way GVGEO does; their own terms and privacy policies apply.
4. WordPress connector
The WordPress connector uses project pairing and a connector token; GVGEO does not ask for or store your WordPress administrator password. Pairing and synchronization may include the project identifier, site URL, connector version and deployment-job status. When you approve a supported deployment, GVGEO sends the approved technical files or content draft needed for that job to the paired site. The connector keeps supported AI-crawler request logs locally in WordPress and does not upload those raw crawler-log rows to GVGEO.
Content deployment can create a local rollback snapshot and, where supported, a WordPress revision. Page-builder-controlled pages may be blocked from direct whole-page replacement when the connector cannot safely preserve the builder layout.
5. Payments
Paid checkout and subscription management may be handled by PayPal. GVGEO stores the information needed to reconcile an order—such as order number, plan, billing cycle, amount, currency, payment/subscription references, status and timestamps—but does not receive or store your full card number or PayPal account password. PayPal processes payment credentials under its own terms and privacy policy.
6. Cookies, sessions and security records
We use necessary cookies for login sessions and language preference. Security controls may record hashed event keys, timestamps and operational logs to detect abuse, enforce rate limits, investigate failures and protect accounts. Authentication rate-limit events are automatically cleaned after a short period; the current application removes these event records after approximately two days. Expired sessions and one-time authentication challenges are also cleaned automatically.
7. Retention and deletion
Project, audit, report, monitoring and deployment data may remain available while the related account or project exists so the product can provide history and comparisons. Deleting a project removes its primary project data according to the application’s deletion rules. You may request account-level deletion through support where no self-service control is available.
Billing, refund, security and administrative audit records may be retained longer where reasonably needed for accounting, fraud prevention, dispute handling, security, legal obligations or enforcement of our terms. Operational database backups are rotated; deleted records may remain in a backup for a limited period until that backup expires or is replaced.
8. Service providers and international processing
Depending on the feature and current deployment configuration, GVGEO may use providers for AI/search retrieval, model inference, email delivery, OAuth login, payment processing, hosting or infrastructure. Current product integrations can include services such as Bright Data, Cloro, Google/Gemini, OpenAI, Anthropic, Brevo, Google OAuth, GitHub OAuth and PayPal. A provider is contacted only when the corresponding feature is configured and used. Provider availability can change.
These providers may process data in countries different from yours. See our Third-Party Services & Data Processing page for the practical data flows used by each product area.
9. Your choices
You can delete individual projects, disconnect a WordPress connection and cancel future automatic subscription renewal through available product controls. For account deletion, access questions or correction requests not available in-product, contact us. Some records may be retained after a request when necessary for payment, security, legal or dispute obligations.
10. Contact
For privacy questions or data requests, use the contact page. Please do not send passwords, API keys or other secrets through support messages.