Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

If you have any questions about how we handle your personal data, or wish to exercise any of your rights under the GDPR, please contact us at the email above. We will respond within 30 days.

2. What Data We Collect and Why

2.1 Account Data

When you create an account we collect your name, email address and a hashed password (we never store your plaintext password). In Settings you can add more: a company name and logo for white-label PDFs, Slack, Microsoft Teams or webhook addresses for alerts, and API keys (we store only a one-way hash of each key). If you schedule a brand's PDFs to be emailed, we keep the up to three addresses you give until you stop the schedule or delete your account; those emails name you and let the recipients reply to you. This data is necessary to provide you with access to the service.

• Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Retention: for the lifetime of your account. Deleting your account in Settings erases it immediately; if you ask us by email, we delete it within 30 days

2.2 Payment Data

We use Stripe to process payments, through Stripe Managed Payments. Under it Stripe's affiliate Sold through Link, LLC (Link) acts as our merchant of record: it handles the transaction, collects and remits any VAT or sales tax, and sends the receipt. Your card statement shows the purchase as sold through Link. We do not store your credit card numbers or full payment details - these are handled entirely by Stripe and its PCI-DSS compliant payment partners. We keep a record of each purchase in your account (what you bought, the amount, the date and Stripe's reference) so we can deliver it and handle refunds.

For the payment itself, Stripe and Link decide how they use your payment details (for example to prevent fraud, meet anti-money-laundering and tax rules, and run your Link account), so for that data they are independent controllers under their own policies: the Link Privacy Policy and the Stripe Privacy Policy. You can ask Link directly to delete the data it holds about your purchases; Link tells us when it does.

• Legal basis: performance of a contract; legal obligation (Art. 6(1)(b) and (c) GDPR)
• Retention: our purchase records are deleted with your account. Stripe and Link, as merchant of record, keep the payment and tax records the law requires them to keep, under their own privacy policies

2.3 Report and Check Input Data

When you create a report or an AI Visibility check you provide information such as a subject's name, industry or category, market, website and competitor names, the question you want answered, the questions you edit for a check, and, if you choose, a CSV file of your own customer feedback. On a check you can also mark the facts AI states about you as correct, wrong or outdated, and add data about your own website: a Google Analytics export, which we read once and keep only as the visits each AI assistant sent, and a server log, which your browser reads on your own computer so that only the number of visits per AI crawler and page reaches us, never your visitors' IP addresses. Instead of a log, you can let us read the same counts once from your own Cloudflare account with a read-only token you create: we use the token for that one read and do not store it. You can remove any of this data at any time from the check. This data is used solely to produce the report or check you asked for, and is sent to the services in section 3 that do that work. A CSV you upload may contain personal data about your own customers: please remove names and contact details before uploading.

• Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Retention: stored as part of your report or check; erased with it (see 2.4), with your account, or on request. If you pay by card, the form you filled in is also held for up to 30 days to fulfil the payment

2.4 Generated Reports and Checks

Reports are generated using Claude, an AI model by Anthropic, which performs both the analysis and live web search, and are stored in your account so you can access them at any time. Your report inputs are sent to Anthropic to produce the report. Reports contain the AI-generated analysis and source references, which may include links to and short excerpts of publicly posted third-party content (see 2.7). AI Visibility checks put their questions to the AI assistants listed in section 3 and store the answers they gave and the pages they cited. If you share a report, a check or a brand dashboard, anyone with its link can read it until you stop sharing.

• Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
• Retention: while your account is active, until you delete the report. A deleted report is kept for 30 days in Recently deleted so you can restore it, then erased; Delete forever erases it at once. Everything is erased immediately when you delete your account, or within 30 days of an emailed request

2.5 Messages You Send Us

Support requests, contact-form messages and feedback are stored so we can answer them and keep track of the conversation. Messages you type to Polly, the assistant inside your reports, are sent to Anthropic to write the reply; we do not store those chat conversations. If you leave your email to hear when PollyX opens, we keep it for that purpose.

• Legal basis: performance of a contract, and legitimate interests in answering people who contact us (Art. 6(1)(b) and (f) GDPR)
• Retention: support conversations are kept as a record of what was asked and agreed; when you delete your account, your name and email are removed from them. A launch-notice email address is kept until you ask us to remove it

2.6 Usage and Technical Data

Our hosting provider records basic request logs (IP address, browser type, pages visited, timestamps) to keep the service secure and working. To limit how often one visitor can use the contact form, we record the IP address behind a contact-form message for up to two days. Vercel Web Analytics counts page visits and a few product events (such as a sign-up or a started checkout) without cookies and without identifying you; choosing "Essential only" in the cookie banner switches it off on that browser. We do not use this data for advertising or profiling.

• Legal basis: legitimate interests - ensuring system security and stability, and understanding how the service is used (Art. 6(1)(f) GDPR)
• Retention: request logs up to 90 days; rate-limit records as stated above

2.7 Public Content Analysed in Reports

To produce a report we read publicly available content about the report subject: news articles; public YouTube videos and comments; public posts, and the comments and replies under them, on social platforms (such as X, Reddit, Bluesky, Mastodon, TikTok, Instagram, Facebook, Threads, Telegram, Pinterest, Twitch and Kick, and regional platforms for reports on those markets); forums, communities and newsletters (such as Hacker News, boards.ie, Substack, Medium and Tumblr); developer communities for software brands (such as GitHub, Stack Overflow and Product Hunt); review, app-store, marketplace, travel, food-delivery and employer-review platforms; investor discussion boards for listed companies; podcast episodes that name the subject, including their transcripts; public attention data (Google Trends, Wikipedia page views and edit activity); and public web pages, including results found through search engines. Some of this content is personal data - a username attached to a publicly posted opinion, or a voice in a podcast.

How each kind of content is used. Names, handles, profile details, contact details and similar identifiers are discarded when the content is collected, before any analysis. Content from social platforms and comment sections is analysed in aggregate and paraphrased - never quoted, never attributed to a named account. Reviews from the review platforms listed above are read for recurring themes only: a report stores the platform's overall rating summary, never the review text or the reviewer. Public forum and community posts may be quoted briefly, without the poster's name, with a link to the original. To tell a subject's own voice apart from public opinion, we look up its official accounts in public sources (Wikidata and its own website).

Facebook, Instagram and Threads are read only through Meta's official APIs: Instagram through the hashtag endpoints, using PollyX's own business account or, if you connected it, your own (2.8); Threads through keyword search; Facebook Pages through Meta's Page Public Content Access. The Instagram hashtag endpoints return no usernames, so we never receive the identity of Instagram posters. For Instagram and TikTok, stored reports keep only the post link, date and engagement counts - no captions and no account names, and our analysis aggregates this content rather than reproducing it. For YouTube, stored API data is deleted after 30 days (see section 4). Verbatim quotes from other platforms appear only where the platform's terms permit display, and always link to the original post.

Writers of the articles AI reads. When you ask for it on an AI Visibility check ("Find the writers"), we read the byline of the news articles the AI assistants read, from each article's own page, and keep the writer's name as published with that check, so you know whom to contact about the story. Nothing else about the writer is collected, and the names are shown only to you.

• Legal basis: legitimate interests - market and opinion research on publicly available statements (Art. 6(1)(f) GDPR)
• Retention: a report keeps a list of the sources it used (link, date, platform, engagement counts and, for some public posts, a short excerpt) so its findings can be checked; the list lives as long as the report and is deleted with it or with the account. The brand pages PollyX publishes keep a similar list with their saved preview. Everything else collected is used during generation only and not stored.
• Your rights: if a report references your public post and you object, contact us (section 11) and we will remove it.

2.8 Connected Instagram Accounts (optional)

You can connect your own Instagram Business or Creator account in Settings, so that reports on your hashtags use your account's Meta quota instead of PollyX's. When you do, we store your Instagram account's id and username, the id and name of the Facebook Page linked to it, the app-scoped Facebook id Meta gives us for you, and the access token Meta issues. We use them only to search public hashtag posts for your own reports - never for anyone else's, never to read your private data, messages or followers, and never to post anything.

• Legal basis: performance of a contract - the optional feature you turned on (Art. 6(1)(b) GDPR)
• Retention: until you disconnect in Settings, delete your account, or remove PollyX in your Facebook settings (Meta then notifies us and we delete it). Meta stops sharing data through the connection 90 days after you connect.

3. Who We Share Data With

Service providers that handle your personal data. These companies run parts of PollyX for us and act as our processors under data processing terms that form part of our contract with each of them. The company named is the one we contract with; the location is where your data is processed and stored:

Companies that make their own decisions about the data. These are not our processors: each is an independent controller of the data it handles, under its own privacy policy:

• Stripe and Link (Sold through Link, LLC) for the payment itself, as merchant of record (see 2.2).
• Meta Platforms Ireland Limited, if you connect your Instagram account (2.8): Meta runs the connection and the hashtag searches made through it.

Services that receive the subject of a report or check, but not your account details. To build a report or a check we send these services the subject's name and market, search queries built from them, or the check's questions. They do not receive your name, email or payment details. The services that collect or transcribe public content (Apify, OpenAI) handle the personal data inside that content for us as processors:

Some of these services keep the queries and questions they receive under their own terms, and some may use them to improve their services (Tavily, Perplexity's search service and Moonshot AI's Kimi among them); Brave keeps search queries for 90 days. This is one reason we send them only the subject of a report or check, never anything about you.

Alerts you set up go where you point them: report-ready and crisis alerts are sent to the Slack, Microsoft Teams or webhook address you enter in Settings.

SCCs = Standard Contractual Clauses approved by the European Commission for international data transfers. Data Privacy Framework = the EU-US Data Privacy Framework, under which the European Commission treats certified US companies as giving adequate protection.

4. YouTube API Services

PollyX uses YouTube API Services to build the YouTube portion of a sentiment report. By using PollyX you also agree to be bound by the YouTube Terms of Service. Google's handling of any data it receives is governed by the Google Privacy Policy.

What we access. Publicly available data only, through three read-only endpoints: search.list, to find public videos discussing the brand being analysed; playlistItems.list, to find the subject's own recent uploads; and commentThreads.list, to read the public top-level comments on those videos. PollyX never asks you to sign in to YouTube or Google, requests no OAuth permissions, and has no access to any private account, channel, watch history or subscriber data.

What we store, and for how long. A new report lists the title, channel name, publish date and link of each video used, together with short quoted extracts from public comments, shown as cited evidence for its findings. We keep that material for no more than 30 days (it is removed after 29). YouTube's API developer policies set a 30-day limit on storing data of this kind, so an automated job removes it from every report once it passes that age. What remains after 30 days is our own analysis: the sentiment score, the written themes and the number of videos the report was built on. The report page says plainly when the video list has been removed and when that happened. You can also delete your account at any time from Settings, which erases your reports and everything inside them immediately.

How to have YouTube data removed. You can delete your account at any time from Settings, which erases your reports and every YouTube record inside them immediately. If you are not a PollyX customer and believe a report contains YouTube data relating to you, email contact@pollyx.org and we will remove it within seven calendar days, as required by YouTube API Developer Policy III.E.4.g. You do not need an account to make that request.

Whose numbers are whose. Video titles, channel names, publish dates and links come from the YouTube Data API and are shown as the API supplies them. Every score, theme, percentage and ranking in a PollyX report is PollyX's own calculation - independently derived, and never a metric published, supplied or endorsed by YouTube. PollyX does not publish a YouTube-specific sentiment verdict, a YouTube volume rating or a YouTube audience profile, and never infers age, race, religion, political leaning, sexual orientation or health status from YouTube data.

What we do not do. We do not re-host, re-upload, download or embed YouTube videos for playback. We do not place advertising against YouTube content, do not present it as our own, and do not sell or redistribute YouTube data to third parties. Every video a report relies on is credited with a link back to YouTube so you can watch the original and check our reading of it.

PollyX does not request access to your Google account, so there is no PollyX permission to withdraw. You can review or revoke any third-party access to your Google account at any time via the Google security settings page.

5. International Data Transfers

Your account data and reports are stored in Ireland (Supabase, AWS eu-west-1). Several of our providers process data outside the European Economic Area (EEA), and each transfer is covered by one of these safeguards:

• EU-US Data Privacy Framework (an adequacy decision of the European Commission) for certified US companies: Vercel, Stripe, Resend, Google and Meta. Each also signs the SCCs with us as a fallback.
• EU Standard Contractual Clauses (SCCs), approved by the European Commission in Decision 2021/914, built into each provider's data processing terms: Anthropic, OpenAI, Trigger.dev, Apify, Perplexity, xAI, and Supabase for support access from outside the EU.
• The EU adequacy decision for the United Kingdom for Trigger.dev's UK company (its job data is stored in the USA under the SCCs).

Anthropic: our contract is with Anthropic Ireland, Limited, but Anthropic processes and stores data in the United States and offers no EU storage. When you generate a report, the inputs you provide (such as the company name, industry, location and analysis focus) are sent to Anthropic to produce it. If you would prefer something not to be processed outside the EEA, do not put it in your report inputs.

AI assistants outside the EEA: the questions of an AI Visibility check are put to assistants run by companies in the United States and in two countries without an EU adequacy decision: China (DeepSeek) and Singapore (Moonshot AI, which runs Kimi). Neither company offers data processing terms or Standard Contractual Clauses, and Moonshot AI may use the questions it receives to improve its service. That is why those two receive only the check's questions, which name the brands, category and market you are checking - never your name, email or anything else about you. If you edit the questions, do not add personal information to them.

You can ask us for a copy of the safeguards that apply to a transfer by writing to the address in section 11.

6. Your Rights Under the GDPR

As a data subject under the GDPR you have the following rights. To exercise any of them, email us at contact@pollyx.org.

We will respond to all requests within 30 calendar days. In complex cases we may extend this by a further 60 days, in which case we will notify you.

7. Cookies

PollyX sets only strictly necessary cookies: to keep you signed in, to remember your language, and briefly while you connect an Instagram or Threads account. We do not use advertising cookies or tracking pixels. Our analytics, Vercel Web Analytics, set no cookies and store nothing on your device; you can still switch them off by choosing "Essential only" in the cookie banner.

Some pages show small brand logos loaded from Google's public favicon service, so your browser contacts Google to fetch them, as it would for any image hosted elsewhere.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or disclosure. These include:

• All data in transit is encrypted using TLS 1.2+
• All data at rest is encrypted (AES-256) by Supabase/AWS
• Passwords are stored as bcrypt hashes - never in plaintext
• Access to production systems is restricted to authorised personnel
• Payment data never touches our servers - handled entirely by Stripe

Authorised PollyX administrators may access account information - including your email address and the subjects of the reports you generate - strictly for the purposes of operating, supporting and securing the service. Administrators cannot view your password, which is stored only as a one-way bcrypt hash and is never accessible to anyone, including us.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by Articles 33 and 34 GDPR.

9. Children's Privacy

PollyX is not directed at anyone under the age of 18, and our Terms of Service require users to be 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at contact@pollyx.org and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email (to the address on your account) and update the "Last updated" date at the top of this page at least 14 days before the changes take effect. Continued use of PollyX after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, requests, or complaints: