Privacy Policy

Who is responsible for your data

See What AI Says is run by an independent individual operator resident in mainland China. Not a company, not a registered entity, no office — so there is no business address to print here, and we're not going to invent one. That individual is the data controller for everything described on this page.

For anything to do with your data — access, correction, deletion, a complaint, or any other request under GDPR, UK GDPR or comparable law — write to [email protected]. That is the only route, and it reaches a person. We aim to answer within a few days and are bound to answer within one month.

Payment is a separate matter. Creem (creem.io) is our merchant of record and the seller of record for your purchase, and is the controller of your billing and card data. We never receive it. Their privacy policy governs that data; for it, write to them.

What we collect

• The domain you enter. We fetch and analyse its publicly accessible pages, the same way any search engine crawler does.
• Your email address. Used to deliver your report and to handle support and refunds. Not sold, not rented, not used for unrelated marketing.
• Your answers to the four profile questions and any correction notes you write.
• If you choose to sign in: your name, email address and profile picture as supplied by Google. Nothing else. We do not request access to your Google account beyond identity.
• Basic request logs (IP address, timestamp) for rate limiting and abuse prevention, retained 30 days.

We do not use payment card data at any point. We never see it.

What we never do

Your report is yours. It is never indexed by search engines, never linked from any public page, and your individual results never appear in any public ranking, league table, leaderboard or marketing material — not with your name on it, and not in a form anyone could reverse.

We do publish aggregate industry benchmarks. Those are computed from a separate set of businesses we measure ourselves for benchmarking purposes, not from customer reports.

The sample report at /sample is a real run on a real business, published with its name, domain, street address, phone number and staff names removed. That business is not a customer and never paid us; we ran it to test the method. If we ever publish a paying customer's report it will be with their explicit written permission and labelled as such, and that has not happened.

Third parties involved

• The AI providers whose models we query (your domain and the generated questions are sent; your email is not)
• A search data provider, for Google AI Overview and map pack results
• Creem, our merchant of record, who takes the payment and holds your billing details
• Our email delivery provider
• Google Analytics, on the public pages of this site — see below

Cookies

Four, and only one of them is optional.

• swais_consent — remembers whether you said yes or no to analytics, so you are not asked again. Set only once you have answered.
• utm — remembers which link or ad you arrived from, so that if you buy, the order record carries that attribution. Set only when you arrive from a tagged link, and dropped after 90 days.
• geo_session — set only if you sign in at /account, and only after you click the link we email you. It holds your email address and a signature, nothing else, and it is what keeps you signed in for 30 days. Signing out deletes it.
• Google Analytics cookies — the optional ones. See below.

There is no password anywhere in this system. Signing in means clicking a link we send to the address you paid with, which expires in fifteen minutes; that is the whole mechanism, and it exists because the account page shows you nothing that address does not already have in its inbox.

Google Analytics

The public pages of this site load Google Analytics 4. It receives the page you viewed, a truncated IP address, your approximate location, referrer, and browser and device details, and it sets cookies to recognise a returning browser. Google processes this on our behalf.

We use it for one thing: how many people run the free pre-flight and how many then buy. That number is how this product is steered. Our merchant of record can also require analytics access to verify traffic before allowing live payments.

It is not loaded on report pages. Your report's URL is also its password — there's no login, the secret is the link — so sending that path to Google would be handing out the report. Report pages, /status, /recover and checkout are all marked noindex, and the analytics tag is switched off for anything marked that way. The same rule catches any private page we add later.

If you are in the EEA, the UK or Switzerland, it does not load until you say so. You get a prompt the first time you arrive, and nothing is sent to Google before you answer it. Declining is one click, the same click as accepting, and it is remembered — you will not be asked again on the next page. If we cannot tell where you are, you are treated as covered and asked anyway. Outside those countries the tag loads without a prompt.

To change your mind, use the button below — the same one click the prompt asked of you, from any page's footer. A browser-level tracking blocker or Google's own opt-out add-on will also stop it, and nothing on this site needs analytics to work.

Turn Google Analytics off for me

How long we keep your report

Your report link stays live for 12 months from delivery. After that we delete the report, and the link stops working. The PDF is yours to keep and is not affected — that's the copy we intend you to keep, precisely because a link depends on this site still being here.

The deletion job deliberately runs a little later than 12 months rather than a little earlier, so the promise is a floor and not a deadline. Request logs are kept 30 days. Transaction records are kept as long as tax law requires.

Deletion

Email [email protected] and we delete your report, your account and your email address, before the 12 months are up if you want. We keep the transaction record where tax law requires it, and nothing else.

Contact

Questions about this policy, or any request about your data: [email protected].