Privacy policy

1. Controller

The controller for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Marcel Neidig, sole trader, trading as MarcelN, Wiesbadener Str. 9, 68305 Mannheim, Germany.

Email: ai-optimizr@perfomodo.com · Website: https://ai-optimizr.com

Referred to below as “we”, “us” or “AI Optimizr”.

2. General information

AI Optimizr is a software-as-a-service platform for analysing and optimising websites, in particular with regard to generative engine optimisation (GEO) and the visibility of companies, brands and websites in AI-based systems.

We process personal data only where this is necessary to provide our website and services, to perform a contract, for billing, for the security of our systems, or because of a legal obligation.

Depending on the processing, the following legal bases apply in particular: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (legitimate interests) and Art. 6(1)(a) GDPR (consent, where required).

AI Optimizr is offered exclusively to entrepreneurs within the meaning of § 14 of the German Civil Code. Personal data therefore arises mainly as the contact details of people acting for a business.

3. Registration and account

Using AI Optimizr requires an account. For it we process in particular: email address, password in encrypted form, optionally name and company, user ID, time of registration, account settings, and plan and usage information.

Your email address is verified by a confirmation link. Without a confirmed address the account receives no starting credits and therefore does not function.

When registering, you state whether you act as a consumer or as a business, and before a purchase your billing country. We store both with your account to apply the contract terms that apply to you and to limit purchases to the countries they are currently possible from (EU member states). Stripe collects the full billing address and, where applicable, your VAT number at checkout.

The processing serves to set up and manage the account and to provide the contractually agreed services.

Legal basis: Art. 6(1)(b) GDPR.

The starting credits are granted only once per email address. To ensure this, we store a check value of your email address when they are granted: a hash produced with a secret key (HMAC), from which the address cannot be derived without that key. Before it is computed, letter case, address suffixes after a “+” and, for Gmail addresses, dots are normalised. The check value is kept even after the account is deleted, so that the starting credits cannot be claimed repeatedly by registering again; it is deleted 24 months after the starting credits were granted.

In addition, the starting credits can be used only once per website. When an account without any previous purchase first spends credits on a website, we store a check value of its domain, likewise an HMAC with its own secret key, together with the user ID of that account. Subdomains are counted towards the main domain. If the account is deleted, the user ID is removed; the check value remains and is deleted 24 months after it was stored.

Addresses from throwaway-mail services cannot be used to register and receive no starting credits. To check this, we compare the domain of your email address against a list of such services; nothing additional is stored in the process.

The legal basis for this is our legitimate interest in preventing repeated misuse of the starting credits (Art. 6(1)(f) GDPR).

4. Authentication and database — Supabase

We use Supabase for database, authentication and backend functions.

Supabase processes in particular: account data, email addresses, website and project data, analysis results, visibility measurements, settings, usage data, billing references and technical metadata.

The Supabase project we use is operated in the Ireland region (eu-west-1) and therefore inside the European Union.

Supabase offers a data processing addendum for its services and describes itself, with regard to data entered by the customer, as a processor or sub-processor.

Legal basis: Art. 6(1)(b) GDPR and, where security and operational data are concerned, Art. 6(1)(f) GDPR.

5. Hosting on Vercel

Our web application is provided via Vercel. When it is accessed, technically necessary data is processed, for example IP address, date and time of access, the URL requested, browser and device information, and technical request and error data.

This processing is necessary to deliver the website and to ensure the stability and security of the service. Our legitimate interest lies in the secure and reliable operation of our platform.

The application's server-side functions run in the Dublin, Ireland region (dub1) and therefore inside the European Union — the same region as our database. Vercel Inc. is based in the United States; for transfers to third countries see section 16.

Vercel provides a data processing addendum for the relevant services.

Legal basis: Art. 6(1)(f) GDPR.

6. Websites submitted by users

Users can submit websites or domains for analysis. We process in particular: URL and domain, publicly accessible website content, page titles and metadata, text content, technical page information, canonical addresses and other content relevant to the analysis.

The retrieved page content is stored in your account so that analyses remain verifiable and changes over time can be shown.

Websites may also contain personal information, for example names of contacts, authors or employees. Users are responsible for ensuring that they are entitled to have the content they submit analysed.

Where AI Optimizr processes personal data on behalf of a customer, we may act as a processor. In such cases a data processing agreement under Art. 28 GDPR may be required.

Legal basis in relation to our customer: Art. 6(1)(b) GDPR.

7. Website crawling — Firecrawl

For automated retrieval and technical preparation of publicly accessible website content we use Firecrawl, offered by SideGuide Technologies, Inc.

The address selected by the user is transmitted; the publicly accessible website data required for retrieval is processed.

For the technical check of an analysis, our own server also fetches the website's homepage, robots.txt and sitemap directly, without Firecrawl and without AI. Only the result of the check is stored (for example whether there is a redirect to HTTPS or certain crawlers are blocked), not the content of these pages.

For the structured data check, our own server fetches up to 25 of the website's pages that the latest analysis found, likewise without Firecrawl and without AI. It reads the pages' machine-readable information (schema.org), the dates and the author details they state and, together with robots.txt and the sitemap, whether search engines may index the pages. Only the result of the check is stored, not the content of the pages.

Users should not submit sensitive personal data that is not required for the analysis.

Legal basis: Art. 6(1)(b) GDPR.

7.1 Wikidata — Wikimedia Foundation

To check whether the public knowledge base Wikidata has an item for the company behind a submitted website, our server queries Wikidata's public interface. Wikidata is operated by the Wikimedia Foundation, Inc., based in the United States.

Only spellings of the website's address are transmitted (for example https://www.example.com/), followed by the identifiers of the items found — never the company's name. The query runs with every analysis and when the user starts it. The Wikimedia Foundation receives our server's connection data, not the user's.

The Wikimedia Foundation processes the request as an independent controller under its own privacy policy. We store only the result: items found, with label, description, links and which details are filled in.

Legal basis: Art. 6(1)(b) GDPR.

8. AI-supported analysis

AI Optimizr uses external AI services to analyse website content, produce optimisation recommendations, identify competitors and measure visibility. What leaves the system, and where it goes, depends on the function, and the cases differ considerably.

When a website is analysed, the retrieved page content and the instructions needed to evaluate it are transmitted to Eden AI and processed there by an AI model operated inside the European Union (section 8.1). If the analysed website contains personal data, that data is transmitted as well. The texts of your active test questions for this website are sent along too, so that it can be checked whether the website answers them. The same applies to producing optimisation recommendations from the analysis results. For the recommendations, counts from your visibility measurements are added for each test question as well, such as in how many answers your brand was named; the answer texts themselves and the names of competitors are not transmitted.

When competitors are identified, the question and answer of a visibility measurement, the sources cited in it, your own brand and the competitors you have already recorded are transmitted to Eden AI. Your brand and recorded competitors are sent so that they are not identified again as new competitors.

For a visibility measurement, only the text of your question is transmitted, and it goes through Eden AI’s EU endpoint to models operated inside the European Union by Microsoft (for ChatGPT) and Google Cloud (for Claude and Gemini) (sections 8.1 to 8.4). Your name, your brand, your domain, your account and your analysis results are not sent with it — the measurement would otherwise be worthless, because it would anticipate the very result it is meant to observe.

We limit the data transmitted to AI providers to what the respective task requires.

8.1 Eden AI — analysis and visibility measurement on models operated in the EU

To analyse website content, produce optimisation recommendations, identify competitors and measure visibility in ChatGPT, Claude and Gemini we use Eden AI, a service of Eden AI SAS, 19 Rue Louis Guérin, 69100 Villeurbanne, France (registered with the Lyon trade and companies register under R.C.S. Lyon 829 046 473), which offers access to AI models from various model providers through a single interface.

We use Eden AI’s EU endpoint exclusively. In the data processing agreement, Eden AI has undertaken not to route requests and responses sent through this endpoint to AI infrastructure outside the European Union, unless required by law; if a model is not available there, the request is not carried out outside the European Union. The address of this endpoint is fixed in our application. There is no other route by which the analysis or a visibility measurement reaches an AI model.

The AI model itself is operated by a model provider to which Eden AI forwards the request. For the analysis and for ChatGPT measurements these are currently OpenAI models operated by Microsoft in the EU Data Zone of Microsoft Azure; for Claude measurements, a Claude model from Anthropic, and for Gemini measurements, a Gemini model from Google, both operated by Google Cloud through Vertex AI in the EU. For every result we store which model provider, which model and which region answered the request, as reported to us by Eden AI.

In visibility measurements the model searches the web — always for ChatGPT, at its own discretion for Claude and Gemini. To do so it forms search terms from your question, which are transmitted to a search service — Google Search in Gemini’s case; the model reads the pages it finds in order to support its answer.

Eden AI does not store inputs or outputs beyond handling the respective request and does not use them to train AI models; this is laid down in the data processing agreement. Metadata such as time, token count and cost is stored for billing. In addition, we have enabled Eden AI’s zero data retention restriction: Eden AI then routes our requests only to model providers that do not retain inputs or outputs beyond handling the request, and rejects a request if no such model is available. The “Log Retention” feature, with which Eden AI would store content for analysis, is switched off.

We have concluded a data processing agreement with Eden AI under Art. 28 GDPR. Eden AI engages the model providers as sub-processors and informs us at least 30 days in advance before adding a further sub-processor. Microsoft and Google are based in the United States. Where data is transferred to a third country in the process, Eden AI relies on an adequacy decision or the standard contractual clauses of the European Commission; see also section 16.

Purpose: AI analysis of website content, production of optimisation recommendations, identification of competitors and measurement of visibility in ChatGPT, Claude and Gemini.

Legal basis: Art. 6(1)(b) GDPR.

8.2 ChatGPT (OpenAI) through Eden AI

To measure visibility in ChatGPT we use a model from OpenAI. We call it through Eden AI’s EU endpoint; it is operated by Microsoft in the EU Data Zone of Microsoft Azure (section 8.1). The text of the respective question is transmitted; the generated answers and the sources used for them are processed in addition.

The data goes to Eden AI and not directly to OpenAI. No website content is transmitted for ChatGPT measurements.

Purpose: measurement of visibility in ChatGPT.

Legal basis: Art. 6(1)(b) GDPR.

8.3 Claude (Anthropic) through Eden AI

To measure visibility in Claude we use a Claude model from Anthropic. We call it through Eden AI’s EU endpoint; it is operated by Google Cloud through Vertex AI inside the European Union (section 8.1). The text of the respective question is transmitted; the generated answers and the sources used for them are processed in addition.

The data goes to Eden AI and not directly to Anthropic. No website content is transmitted for Claude measurements.

Purpose: measurement of visibility in Claude.

Legal basis: Art. 6(1)(b) GDPR.

8.4 Gemini (Google) through Eden AI

To measure visibility in Gemini we use a Gemini model from Google. We call it through Eden AI’s EU endpoint; it is operated by Google Cloud through Vertex AI inside the European Union (section 8.1). The text of the respective question is transmitted; the generated answers and the sources used for them are processed in addition.

Gemini may use Google Search for its answer (grounding with Google Search). Google applies its own retention rules to this search.

The data goes to Eden AI and not directly to Google’s Gemini API. No website content is transmitted for Gemini measurements.

Purpose: measurement of visibility in Gemini.

Legal basis: Art. 6(1)(b) GDPR.

9. Visibility measurements

To measure the visibility of a company or website, automated requests are sent at the user's instruction through Eden AI to the models named above (sections 8.1 to 8.4).

We process in particular: the questions defined by the user, the provider and model used, the AI system's full answer, sources and citations, the time of the measurement, mentions of brands and domains, and the metrics derived from them.

The results are stored in AI Optimizr so that changes over time and differences between AI providers can be shown.

Please word your questions so that they contain no personal data. Whatever is in the question leaves our system.

Legal basis: Art. 6(1)(b) GDPR.

10. Competitors

Users can record competitors or have potential competitors identified automatically from AI answers. Automatic identification runs through Eden AI on an AI model operated inside the European Union (sections 8 and 8.1).

We process in particular: company name, domain, publicly accessible company information and mentions in AI-generated answers together with the supporting passages.

Where such information contains details about natural persons, it is processed only to the extent necessary for the analysis offered.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR with regard to market observation.

11. Usage and consumption data

AI Optimizr charges for paid functions through a balance of credits. For each operation we record in particular: the function used, the AI provider, the model, input and output tokens, pages retrieved, the time, a technical request identifier, the status, the credits consumed and the resulting balance. For visibility measurements we additionally record the cost of the request as reported by Eden AI.

This data serves to provide the platform, measure consumption, display the current balance, handle billing, and detect abuse and errors.

Legal basis: Art. 6(1)(b) GDPR; where data must be retained for legal reasons, additionally Art. 6(1)(c) GDPR.

12. Payments via Stripe

We use Stripe for subscription, invoicing and payment functions. We process in particular: name, email address, billing address where applicable, payment information, the Stripe customer identifier, subscription data, plan, invoice data and payment status.

Full payment details such as card numbers are processed directly by Stripe and are never stored in our own systems. We store only the identifiers of the customer account and subscription together with its status and term.

Depending on the service, Stripe may act as a processor or as a controller in its own right. Stripe describes these roles in its data processing agreement.

If we refund a payment or it is charged back, Stripe informs us. We then store which credits we took back as a result. For a chargeback we additionally store a lock note on the account with the chargeback’s identifier, amount and status and the times of locking and unlocking. This information is deleted together with the account.

Legal basis: Art. 6(1)(b) GDPR and, with regard to statutory retention obligations, Art. 6(1)(c) GDPR. For the lock note, additionally our legitimate interest in not providing services whose payment was charged back (Art. 6(1)(f) GDPR).

13. Invoicing and accounting data

We retain invoices and other data relevant under tax and commercial law in accordance with the statutory retention obligations. Deletion therefore takes place only after the applicable retention period has expired.

14. Server and security logs

To ensure security, stability and error analysis, technical log data is processed. This may include: IP address, date and time, request information, browser and device information, error codes and technical user or request identifiers.

Our legitimate interest lies in the security and reliable provision of our service.

Legal basis: Art. 6(1)(f) GDPR.

15. Cookies and similar technologies

We use strictly necessary cookies and comparable storage technologies only — in particular for sign-in, session management, security and storing technically necessary settings such as the chosen language.

There is no web analytics, no audience measurement and no advertising tracking of any kind. No analytics tools, tracking pixels or third-party marketing services are currently embedded.

Under § 25 TDDDG, accessing information on a terminal device generally requires consent; exceptions exist for operations strictly necessary to provide a digital service the user has expressly requested. We therefore use strictly necessary cookies without separate consent.

Should non-essential analytics, marketing, tracking or advertising services be used in future, they will be activated only in accordance with statutory requirements and, where required, after prior consent.

16. Data processing and service providers

We use external service providers to provide and operate our services. Where these providers process personal data on our behalf, they do so on the basis of data processing agreements under Art. 28 GDPR or equivalent data processing agreements (DPA).

Such agreements are in place – to the extent required for the respective processing – in particular with Supabase, Vercel, Firecrawl, Eden AI and Stripe. The model providers engaged by Eden AI, currently Microsoft (Azure) and Google Cloud (Vertex AI), are sub-processors of Eden AI.

Service providers process personal data only within the scope of the agreed services and in accordance with contractual or documented instructions. The specific data processed depends on which functions the user uses within AI Optimizr. It may include in particular account and contact data, technical usage data, IP addresses, project and website information, and content and analysis requests submitted by the user.

Individual providers may act as joint or independent controllers for certain processing operations. This applies in particular where a provider itself determines the means and purposes of processing because of legal obligations or for its own purposes, for example in connection with payment processing, fraud prevention, IT security or statutory retention obligations.

Some of the service providers used are based outside the European Union or the European Economic Area, in particular in the United States, or use sub-processors in third countries. Where personal data is transferred to a third country, this takes place only in compliance with Art. 44 et seq. GDPR. Depending on the provider, the transfer is safeguarded in particular by an adequacy decision, certification under the EU-U.S. Data Privacy Framework, or the standard contractual clauses (SCC) adopted by the European Commission, together with supplementary measures where necessary.

In addition, tax advisers, legal advisers and public authorities may receive data where this is necessary or legally required. Data is not passed on for any purpose other than those named in this policy. We do not sell data.

Further information on the processing of personal data by the individual services, and on purpose, legal basis and retention, can be found in the corresponding sections of this privacy policy.

17. Retention and deletion

We store personal data only for as long as necessary for the respective purposes of processing or as long as statutory retention obligations exist.

Page content retrieved and cached for a website analysis is deleted at the latest 30 days after the respective analysis.

Full answers produced in visibility and AI analyses are stored for 12 months, so that users can make historical comparisons and follow how their analyses develop. After that, the full answer content is deleted. Metrics, scores and technical metadata derived from the analyses may remain stored for the lifetime of the respective project or account.

When a user has their account deleted, the personal data belonging to it is deleted within 30 days, unless statutory retention obligations or other legal reasons stand in the way.

Backups may, for technical reasons, still contain deleted data for a limited period; they are overwritten or deleted at the latest 30 days after the deletion.

Business and billing records that must be retained by law are kept for the statutory period regardless of whether the account is deleted. Once those periods expire, this data is deleted as well.

Excepted from deletion together with the account are the check values for the starting credits (section 3). The check value of the email address is deleted 24 months after the starting credits were granted, the check value of a website domain 24 months after it was stored.

The contractual deletion and retention rules of external service providers apply in addition.

18. No special categories of personal data

AI Optimizr is not designed for processing special categories of personal data within the meaning of Art. 9 GDPR.

In particular, users should not submit health data, biometric data, information about political or religious beliefs, or data about sex life or sexual orientation in inputs, questions or other content for analysis.

19. Automated decisions

AI Optimizr uses automated analyses and AI systems to produce metrics, recommendations and evaluations.

These results do not amount to a decision based solely on automated processing which produces legal effects concerning the user or similarly significantly affects them (Art. 22 GDPR).

20. Rights of data subjects

Subject to the statutory conditions, data subjects have in particular the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), to object (Art. 21 GDPR) and to withdraw consent given (Art. 7(3) GDPR).

A withdrawal takes effect for the future only and does not affect the lawfulness of processing carried out before it.

Please send requests informally to ai-optimizr@perfomodo.com.

21. Right to object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, there is a right, subject to the statutory conditions, to object to that processing on grounds relating to the data subject's particular situation.

22. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR).

For a controller based in Baden-Württemberg, this is usually the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg). A data subject may also turn to another competent supervisory authority.

23. Security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access and unauthorised disclosure.

These include in particular: encrypted transmission over TLS, access restrictions, role-based permissions, access control enforced at the database level, secure handling of credentials, and technical logging and monitoring.

24. Changes to this privacy policy

We update this privacy policy when our services change, new service providers are engaged, technical processes change, or statutory requirements make it necessary.

The current version published on this page applies.