Privacy Policy

1. Who we are

AEO Growth Kit is a trading name of Steve Gillson, an auto-entrepreneur registered in France. Steve Gillson is the data controller for the personal data described here.

• Controller / publisher: Steve Gillson, auto-entrepreneur (sole trader)
• Address: 4 rue Toulouse Lautrec, 17138 Saint-Xandre, France
• SIRET: 91149164500022
• Email: steve@aeogrowthkit.com

AEO Growth Kit and edtech growthkit are trading names of the same sole trader, so this policy covers both.

Because we are established in France, this policy is built around the EU General Data Protection Regulation (GDPR) and the French loi Informatique et Libertés. Our supervisory authority is the CNIL. We have not appointed a Data Protection Officer and are not required to; privacy questions go to the email above.

2. What we collect

• Your name, email address and business name — when you use the contact form, book a call, subscribe to updates, or create an account.
• The content of your message — whatever you choose to write to us.
• Booking details — if you schedule a call, the date, time and any notes you add.
• Account and login information — handled by our identity provider. We never see or store your password.
• Subscription and billing records — handled by our payment processor. We never see or store your full card number.
• The website you ask us to audit — its address and its publicly available content.
• Technical logs — IP address, browser type and timestamps, generated by our hosting providers.

We do not ask for your phone number or postal address, and we do not ask for special category data such as health, beliefs or biometrics. Please do not send that kind of information to us in a message.

3. Why we use it, and our legal basis

• Answering enquiries and holding calls — name, email, business name, message. Basis: our legitimate interest in responding to people who contact us.
• Providing the service — account data, the site you ask us to audit. Basis: performance of our contract with you.
• Taking payment and keeping accounts — billing records. Basis: performance of our contract, and our legal obligation to keep accounting records.
• Sending service emails (receipts, account notices) — email address. Basis: performance of our contract.
• Sending updates about AEO Growth Kit — email address. Basis: your consent, which you can withdraw at any time.
• Keeping the service working and secure — technical logs. Basis: our legitimate interest in preventing abuse and diagnosing faults.

4. What we do not do

We do not sell or rent your personal data. We do not use advertising trackers, and we do not build profiles about you. This website currently runs no analytics at all — see our Cookie Policy.

We do not make automated decisions that produce legal or similarly significant effects about you. Your audit results are information for you to act on, not a decision taken about you.

5. How AI processing works

Our service tests how AI answer engines describe and recommend businesses. To do that, we send publicly available website content and brand details — your public pages, your business name, and the test questions themselves — to third-party AI providers through their APIs: OpenAI, Anthropic, Perplexity and Google.

We do not send your account details, contact details, or any other personal data to these providers as part of an audit. What we send is material that is already public on the web.

Once submitted, that content is handled under each provider's own API terms, which we do not control. We are confirming with each provider that content submitted through their API is excluded from model training, and moving to plan tiers that guarantee this where a lower tier does not.

6. Who else handles your data

We use the following providers to run the service. They process personal data on our instructions and for no other purpose.

• Netlify — hosting for this website, and processing of contact form submissions.
• Railway — hosting for our application.
• Auth0 — account login and identity.
• Stripe — subscription payments.
• Resend — service and update emails.
• Calendly — scheduling intro calls.
• OpenAI, Anthropic, Perplexity and Google — the AI models used to run audits, as described in section 5.

We may add a customer relationship tool in future; if we do, we will update this list before moving any data into it.

7. Sending data outside the EU

Several of the providers above are based in the United States, so some personal data is transferred outside the European Economic Area. Where that happens, the transfer relies either on the European Commission's adequacy decision for the EU–US Data Privacy Framework, where the provider is certified under it, or on Standard Contractual Clauses.

We are completing a review of the exact mechanism in place with each provider and will update this section as that concludes. If you would like to know the position for a specific provider, email us and we will tell you what we have.

8. How long we keep it

• Enquiries, bookings and update subscribers — 24 months after your last contact with us.
• Account data — for as long as your subscription is active, then 24 months.
• Invoices and accounting records — 10 years, as required by the French Commercial Code.
• Technical logs — up to 12 months.

If you ask us to delete your data we will do so, except where we are legally required to keep it — accounting records being the main example.

9. Security, described honestly

Here is what is actually true, rather than a list of things that sound reassuring:

• This website and our application are served over HTTPS (TLS), so traffic between you and us is encrypted in transit.
• Your data lives in the systems of the established providers listed in section 6 rather than on servers we run ourselves, and inherits their platform security.
• Access is limited to Steve Gillson. There are no employees or contractors with access to your data.
• Source code is kept in version control, and application data is backed up to separate storage.

Equally, what we do not do: we are a one-person business, and we do not carry out penetration testing or formal third-party security audits, and we hold no security certification such as ISO 27001 or SOC 2. We would rather say so plainly than imply otherwise.

No method of transmission or storage is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the CNIL within 72 hours and tell you directly where the law requires it.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data deleted, subject to the exceptions in section 8;
• restrict how we process your data;
• object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis — withdrawing it does not affect processing carried out beforehand;
• give directives about what happens to your data after your death, under French law.

To exercise any of these, email steve@aeogrowthkit.com. We will respond within one month. You can unsubscribe from update emails using the link in any of them.

If you are not satisfied with how we have handled your data, you can complain to the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr. If you live in another EU country, you may complain to your own supervisory authority instead.

11. Cookies

This website sets no cookies. Our Cookie Policy explains that in full, and what would change if we ever add analytics.

12. Children

AEO Growth Kit is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 15, the age of digital consent in France. If you believe a child has given us personal data, email us and we will delete it.

13. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date above. If a change materially affects how we use your data, we will tell subscribers and account holders directly.

14. Contact

Questions about this policy or your data: steve@aeogrowthkit.com, or via our contact page.