Privacy Policy

1. Information We Collect

• Account Data: Name, email address, billing address, and payment details (processed via Stripe). Our database stores only your email address and subscription ID.
• Usage Data: Login and authentication data (via Clerk), which we collect whenever you sign in to an account. Only where the tools described in Section 2 are active, we also collect: session recordings of your interactions with our pages (Microsoft Clarity); analytics such as device type, browser, IP address, geolocation, and interactions with the Service (Google Analytics); your IP address sent to Apollo, which may return the company associated with it; and an affiliate referral token stored in your browser by Affonso, so a partner who referred you can be credited. If those tools are not active for you, none of these four are collected.
• Third-Party Data: Information obtained from OpenAI (ChatGPT), Google Gemini, Perplexity, and SimilarWeb, as well as data submitted by customers about their websites or brands.
• Customer Input Data: Any information you choose to submit. We do not intentionally collect personal data of your end-users; if you provide such data, you are responsible for ensuring appropriate rights and consents.

2. Cookies & Tracking

We use necessary cookies to operate the Service and enable authentication. We also use four non-essential third-party tools: Google Analytics (product and traffic analytics), Microsoft Clarity (session recording, which captures your interactions with our pages), Apollo (website-visitor identification), and Affonso (affiliate referral attribution).

In the EEA, the United Kingdom, Switzerland, California, Quebec and certain other regions, these four tools load only after you choose "Allow tracking". Elsewhere they run by default, and you can turn them off at any time using the control below, or by enabling Global Privacy Control in your browser. If you are signed in when you turn tracking off, we also stop reporting purchase and subscription events to Google from our servers for the workspaces you administer; if you are not signed in, nothing is linked to you server-side.

Global Privacy Control. If your browser sends a Global Privacy Control signal and you have not yet made a choice here, we will not run these tools by default anywhere and will ask you first. If your browser sends that signal and you previously declined these tools on this site — including on the earlier banner that read "Not now" — that refusal is kept and we do not ask you again. If you previously chose "Allow tracking", that explicit choice stays in force: a Global Privacy Control signal does not withdraw it, so use the control below to do that. A Global Privacy Control signal stops these tools from loading; it does not delete cookies they have already set, whereas the control below does.

We also set one strictly necessary cookie, peekaboo_consent_region, so the site knows which of the two regimes above applies to you. It lasts 30 days, stores only the value "required" or "optional", and contains no identifier.

3. How We Use Data

We use personal data to:

• Provide and operate the Service.
• Generate reports and analytics.
• Process payments and manage subscriptions.
• Improve and secure the Service.
• Communicate with you.
• Comply with legal obligations.
• Send marketing communications if you have opted in (you may withdraw consent at any time).

4. Legal Basis (GDPR)

For users in the EEA/UK, we process personal data based on:

• Performance of a contract (providing the Service).
• Legitimate interests (improving and securing the Service).
• Compliance with legal obligations.
• Consent, where required (e.g., for marketing).

5. Third-Party Service Providers

We use trusted third-party providers to operate the Service, including:

• Stripe – Payments
• Clerk – Authentication
• KalTalk – Support chat. The chat widget loads on most pages of the site (not on shared report links, white-label dashboards or the in-app chat page) and is necessary to operate our support channel, so it is not covered by the analytics choice in Section 2. When you are signed in it receives your account ID, email address and name so a conversation can be matched to your account.
• Vercel – Hosting
• Planetscale – Database
• Microsoft Clarity – Session recording and heatmaps
• Google Analytics – Web analytics
• Apollo – Website-visitor identification
• Affonso – Affiliate referral attribution
• OpenAI (ChatGPT) – AI data processing
• Google Gemini – AI data processing
• Perplexity – AI data processing
• SimilarWeb – Data enrichment

6. International Transfers

If you are located in the EEA, UK, or Switzerland, your data may be transferred to the U.S. We rely on Standard Contractual Clauses (SCCs) and implement safeguards to protect your data.

7. Data Retention

We retain personal data as long as your account is active or as needed to provide the Service, and as required by law thereafter.

8. Your Rights

• GDPR: Right to access, correct, delete, restrict, port, and object.
• CCPA/CPRA: We do not sell personal information for money. Some of the tools described in Section 2 — Google Analytics, Microsoft Clarity and Apollo — may nonetheless count as "sharing" under the CPRA. California residents can opt out using the control in Section 2 or by enabling Global Privacy Control, which we honor, and can contact us to exercise their rights to know, delete, correct, and limit.
• Requests: 📩 team@aipeekaboo.com
• We will respond within the required timeframe (generally 30 days).

9. Lawful Disclosure

We may disclose your information if required by law, legal process, or government request.

10. Security

We implement appropriate safeguards to protect your data. No system is completely secure.

11. Breach Notification

If a data breach occurs that affects your personal data, we will notify you and relevant authorities as required by law.

12. Children's Data

The Service is not directed to individuals under 18.

13. Aggregated & Anonymized Data

We may use anonymized or aggregated data for analytics, benchmarking, and product improvement. Such data does not identify individuals.

14. Data Processing Addendum (DPA)

Enterprise customers requiring a GDPR Data Processing Addendum (DPA) may request one by contacting us at team@aipeekaboo.com.

15. Changes

We may update this Privacy Policy from time to time.

16. Contact

📩 team@aipeekaboo.com