Privacy Policy

GEOquoted (ABN 76 885 136 938) (“GEOquoted”, “we”, “us”) operates the website geoquoted.com and the GEOquoted platform for AI visibility monitoring. GEOquoted is operated from New South Wales, Australia.

For any privacy question, request or complaint, contact us at hello@geoquoted.com.

We only collect what we need to run the service:

• Account identity — when you sign in with Google, Apple or Microsoft, we receive your name, email address and profile picture from the identity provider. We do not store passwords. Sign-in is passwordless and provider-verified.
• Organisation and billing details — organisation name, seats, plan, billing currency and status.
• Payment data — processed entirely by Stripe. We never see or store your card number, CVC or expiry. We store only the Stripe customer / subscription references needed to reconcile your subscription.
• Product usage events — timestamps of scans, feature use and connector actions, used to enforce plan limits, debug issues and measure product health.
• Configurations you create — brand names, competitors, prompts, and other settings you enter into your dashboard.

If you choose to connect a Google account, we request two Google API scopes:

• https://www.googleapis.com/auth/analytics.readonly — read-only access to your Google Analytics 4 properties.
• https://www.googleapis.com/auth/webmasters.readonly — read-only access to your Google Search Console sites.

We access this Google user data solely to display your own traffic and search-performance insights inside your GEOquoted dashboard (channel breakdown by AI engines, clicks / impressions / keywords over time, and a technical health score derived from URL inspection samples).

Specifically:

• Tokens are encrypted at rest. Both the OAuth access token and the refresh token are encrypted with AES-256-GCM before being written to our database, and are never exposed to the browser. Only our server-side sync jobs and dashboard read functions can decrypt them.
• We do not sell your Google data. We never use it for advertising or ad targeting, and we do not share it with third parties other than the infrastructure providers strictly required to render your dashboard (see “Third-party processors” below).
• You can disconnect at any time from your dashboard. Disconnecting immediately revokes the token with Google and deletes the stored encrypted credentials. Historical aggregate stats already displayed in your dashboard remain unless you also delete your account.
• Human access is minimal. Engineers only access Google-derived data when investigating a specific support ticket or incident, under written internal controls.

GEOquoted’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of trusted processors to run GEOquoted. Each receives only the data needed to perform its function:

• Stripe — payment processing and subscription management.
• Google — identity (Sign-in with Google) and, if you connect them, Google Analytics 4 and Google Search Console.
• Supabase / Lovable Cloud — application hosting, database, authentication and file storage. Customer data for this project is currently stored in the United States (AWS US-East-1 region). We may migrate to an Australian region in future; any change will be reflected in this policy.
• Resend — outbound transactional and product email.
• LLM API providers (OpenAI, Anthropic, Google, Perplexity and equivalents) — GEOquoted sends the prompts you configure to these engines to observe whether your brand is cited. Those prompts do not include personal data about your customers or end users; they describe products, categories and questions you want to monitor.

We send three categories of email, each independently controllable:

• Transactional — sign-in links, receipts, security notifications, invitations. Required for the service.
• Monthly digest — a summary of your AI visibility for the previous month. Unsubscribe link in every message.
• Product news — occasional product updates and feature announcements. Off by default for existing accounts; opt-in during signup. Unsubscribe link in every message.

We comply with the Australian Spam Act 2003: every commercial message identifies the sender, includes a functional unsubscribe, and is sent only where we have your consent or an existing business relationship.

• Google OAuth tokens are deleted immediately when you disconnect the connector or delete your account.
• Account and organisation data (profile, brands, prompts, scan history, aggregate stats) is deleted within 30 days of an account or organisation deletion request. Billing records may be retained for the period required by Australian tax and accounting law (typically 7 years).
• Anonymous product analytics may be retained indefinitely in an aggregated form that cannot be linked back to you.
• To request deletion, email hello@geoquoted.com from the account’s registered email. We will confirm receipt and completion in writing.

GEOquoted handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate or out of date;
• request deletion, subject to legal retention obligations;
• complain to us in the first instance, and, if unresolved, to the Office of the Australian Information Commissioner (oaic.gov.au).

Users outside Australia: we honour equivalent rights under GDPR (EU/UK), CCPA (California) and comparable regimes. Contact us at the address above and identify the framework you’re acting under so we can respond appropriately.

GEOquoted uses cookies and local storage strictly for session and authentication purposes — keeping you signed in and remembering the organisation you are currently viewing. We do not use advertising cookies, third-party tracking pixels or cross-site tracking.

We may update this policy as the product evolves. Material changes will be announced by email to account owners and reflected in the “Last updated” date at the top.