Privacy Policy

1. Introduction

AEO Growth Kit ("we," "us," or "our") operates the AEO Growth Kit website and platform. This page explains what personal data we collect, how we use it, and the rights you have over it.

This policy is written primarily around the UK GDPR and the EU GDPR, which we treat as our governing data-protection framework. If you are in California, additional rights are summarised in section 10.

Who we are (data controller)

The data controller responsible for your personal data is [Insert registered legal entity name], registered at [Insert registered address] (company number [Insert company / registration number], if applicable). You can reach us about any privacy matter via our contact page or at [Insert privacy contact email, e.g. privacy@aeogrowthkit.com].

2. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected:

• Personal Data: While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include, but is not limited to:
  • Email address
  • First name and last name
  • Phone number
  • Address, State, Province, ZIP/Postal code, City
  • Cookies and Usage Data
• Usage Data: We may also collect information how the Service is accessed and used ("Usage Data"). This may include information such as:
  • Your computer's Internet Protocol address (IP address)
  • Browser type and version
  • Pages of our Service that you visit
  • Time and date of your visit
  • Time spent on those pages
  • Device identifiers and other diagnostic data
• Business Data: If you're using our Service for business purposes, we may collect information about your company, including:
  • Company name and industry
  • Company size and business type
  • Website and social media profiles
  • Historical performance and analytics data

3. Cookies and Tracking

Our Service uses cookies to enhance user experience. Cookies are files with small amount of data, which may include an anonymous unique identifier.

We use the following types of cookies:

• Session Cookies: These are temporary cookies that expire when you close your browser
• Persistent Cookies: These remain on your device for longer periods
• Analytics Cookies: These help us understand how users interact with our Service
• Functional Cookies: These allow us to remember your preferences and settings

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

4. Use of Data

AEO Growth Kit uses the collected data for various purposes:

• To provide and maintain our Service
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of our Service
• To detect, prevent and address technical and security issues
• To send you marketing and promotional materials (with your consent)

5. Security of Data

The security of your data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

We implement the following security measures:

• Enterprise-grade encryption for data in transit (SSL/TLS)
• Encryption of sensitive data at rest
• Regular security audits and penetration testing
• Access controls and authentication mechanisms
• Employee confidentiality agreements
• Incident response procedures

6. Your Rights and Choices

Access

You have the right to access the personal data we hold about you and to obtain a copy of your data.

Correction

You have the right to request that we correct inaccurate or incomplete data.

Deletion

You have the right to request deletion of your personal data, subject to certain exceptions (e.g., data needed to comply with legal obligations).

Portability

You have the right to request a copy of your data in a portable format that can be transmitted to another service provider.

Opt-Out

You can opt out of receiving promotional emails from us at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly.

7. Third-Party Services

Our Service may contain links to other websites that are not operated by us. This Privacy Policy applies only to our Service, and we are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party services before providing your personal information.

We use third-party service providers to perform services on our behalf, including:

• Auth0 (to manage account login and identity)
• Stripe (to process subscription payments)
• Resend (to send transactional and marketing emails)
• Railway (cloud hosting for our application)
• Netlify (to process contact form submissions on our public website)
• AI / large language model providers (to run audits and generate recommendations — see below)

AI processing

Our core service works by analysing how AI answer engines describe and recommend businesses. To do this, content and questions relating to your business — for example your website content, brand name, and audit queries — may be sent to third-party AI providers such as OpenAI (ChatGPT), Anthropic (Claude), Perplexity and Google (Gemini). We send only what is needed to perform the audit and produce your results.

We do not control how these providers operate their own models, and their use of data is governed by their respective terms and privacy policies. We choose providers that offer business or API terms which, to our knowledge, do not use submitted content to train their public models, and we keep this list under review. [Confirm exact providers, contractual terms and any data-processing agreements in Code.]

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

8. Data Retention

We will retain your Personal Data for as long as necessary to provide our Service and to comply with our legal obligations. If you request deletion of your data, we will remove it from our systems, except where we are required to retain it for legal compliance or legitimate business purposes.

9. Your Rights Under UK & EU GDPR

If you are located in the United Kingdom or the European Union, you have the following rights under the UK GDPR and EU GDPR. These include:

• The right to know what personal data is being collected
• The right to access, correct, and delete your personal data
• The right to restrict processing of your data
• The right to object to processing
• The right to data portability
• The right to lodge a complaint with a supervisory authority — for UK residents the Information Commissioner's Office (ICO), or your local EU supervisory authority [e.g. the CNIL in France — confirm in Code]

Our legal basis for processing your data includes your consent, performance of a contract with you, compliance with legal obligations, and our legitimate business interests.

10. CCPA Compliance (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

• The right to know what personal information is collected
• The right to know whether personal information is sold or disclosed
• The right to say no to the sale of personal information
• The right to access your personal information
• The right to request deletion of personal information
• The right to non-discrimination for exercising your rights

To exercise any of these rights, please contact us.

11. Children's Privacy

Our Service is a business-to-business product and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete that information.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us.