Privacy Policy

Information you give us

• Account details — your email address, and your name if you choose to add one.
• Business details — the businesses you ask us to measure: their names and any other names you add, websites, cities and industries.
• Free checks — if you run a free check: your email address, and the name, city, state and industry of the business you ask us to check.
• Correspondence — messages you send to support.

Information we generate

• Collected answers — the responses third-party AI systems return to your questions, and the citations within them.
• Derived measurements — which businesses were named, which sources were cited, and how those counts change over time.

Information collected automatically

• Usage and technical data — pages viewed, timestamps, IP address, browser and device type, referring page, kept in server logs.

We do not knowingly collect information from anyone under 18, and we do not collect special categories of personal data.

• To provide the Service — running collection and displaying your results.
• To operate your account, including signing you in and tracking subscription status.
• To send account messages: email verification, password resets, confirming a change of email address, telling you when your first measurement is ready, and notices about your trial or subscription.
• To run a free check: emailing you its report, and limiting each business to one free check every 60 days.
• To provide support when you contact us.
• To secure the Service, prevent abuse, and enforce plan limits.
• To improve the Service, including analyzing aggregate usage.
• To publish aggregated findings from free checks — for example, how often businesses in one industry are named by AI assistants. A published figure never identifies you or any business you asked us to check.

Where the GDPR applies, our legal bases are performance of a contract, legitimate interests (security, service improvement, and communicating with existing customers), consent where we ask for it, and legal obligation.

We do not sell your personal information and we do not share it with third parties for their own marketing. We use these categories of processor:

• Payments — Stripe, as merchant of record, for billing, tax and invoicing.
• Hosting and database — our cloud infrastructure and managed database provider.
• AI and search providers — the AI platforms and search APIs we query on your behalf. We send them the questions, the answers we ask a model to read, and any industry you describe in your own words. We do not send them your name, your email address or any billing detail.
• Email delivery — our transactional email provider, for the account messages listed above.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger or acquisition — in which case we will tell you before your information becomes subject to a different policy.

A current list of subprocessors is available on request from hello@spruce-aeo.com.

We are based in the United States and our providers may process data in the United States and elsewhere. Where we transfer personal data out of the UK, EEA or Switzerland we rely on appropriate safeguards such as Standard Contractual Clauses.

Canceling and deleting are different events. Canceling stops collection and removes nothing at the time, so your history is still here if you come back. Deleting your account removes your businesses, your questions and every answer collected for them, immediately.

Collected answers are kept while your plan runs, and for twelve months after it ends. After that we remove them. Your businesses and their questions stay, so coming back picks up where you left off rather than starting again. Your account is kept until you delete it.

Deleting your account removes your businesses, your questions, and every answer we collected for them. Two things are kept. We keep a global list of which websites get cited in AI answers; it contains no personal data and no link to your account. If you ran a free check before signing up, we keep the email address and company name you entered, so the limit of one free check every 60 days still holds.

Deleting takes effect immediately and cannot be undone.

How long each kind of information is kept:

• Collected answers and measurements — kept while a plan runs and for twelve months after it ends. You may remove a single business and its history at any time.
• Billing records — kept by Stripe and by us for as long as tax and accounting law requires, typically seven years.
• Support correspondence — up to two years.
• Server logs — a short operational window, then discarded.

Free checks — kept for twelve months after the business was last checked, then deleted.

Aggregated, de-identified statistics that cannot reasonably be linked back to you may be kept indefinitely.

Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal data; to object to or restrict certain processing; and to withdraw consent. California residents have the right to know what is collected, to delete it, to correct it, and not to be treated differently for exercising those rights — and we confirm we do not sell or share personal information as the CCPA and CPRA define those terms.

To exercise any right, email hello@spruce-aeo.com and we will respond within 30 days. If you are in the UK or the EEA, you can also submit a complaint or concern to the data protection authority where you live; in the UK, that is the Information Commissioner’s Office.

We use encryption in transit, encryption at rest for stored data, access controls, and least-privilege access to production systems. Sessions are stored server-side, so signing out or resetting your password revokes access rather than merely expiring a cookie. No system is perfectly secure; if a breach affects your personal data we will notify you and any required regulator without undue delay.

We set only the cookies needed to run the Service — keeping you signed in and maintaining your session. We do not use analytics, advertising or cross-site tracking cookies, we run no third-party ad pixels, and the site loads no fonts or scripts from a third-party CDN.

We may update this policy. If a change is material we will tell you by email or in the Service before it takes effect. The “last updated” date above always reflects the current version.

Terms of Service · Refund Policy · Contact