Privacy policy

The data controller is Web Experty LLC, which operates OrganicIQ. Our registered address and contact addresses are at the foot of this page. If you want to exercise any of the rights described here, those are the addresses to use.

We collect only what the service needs to work:

• Account data — your name, email address, phone or WhatsApp number, optional company name, timezone and a securely hashed password. The phone number is collected at checkout so we can reach you about your purchase and your account.
• Payment data — the plan purchased, the amount, the currency, and the Stripe identifiers for the session and payment. Card numbers are handled entirely by Stripe and never reach our servers.
• Project data — the domains, brand names, competitors and AI prompts you enter, along with the public page data and AI responses collected on your behalf.
• Technical data — session records including the IP address and browser user agent at sign-in, and an audit log of significant account actions. These exist to protect your account.

• To provide the service: monitoring the sites you nominate and running the prompts you create.
• To manage your plan, access period and limits.
• To send transactional email: account activation, password reset, team invitations, expiry reminders, and the weekly opportunity summary if you have it enabled.
• To protect the service against abuse, credential stuffing and fraudulent payments.

We do not sell personal data, we do not share it with advertising networks, and we do not use your project content to train models.

We use the following processors to run the service. Each one receives only what it needs for its own task, and none of them is permitted to use your data for its own purposes.

• Stripe Payments Europe, Ltd. and Stripe, Inc. — payment processing. Stripe receives your name, email address, phone number and billing address directly through its own checkout pages, and holds your card details. We never see or store a card number. Stripe acts as a controller in its own right for fraud prevention and regulatory purposes; see stripe.com/privacy.
• Vercel Inc. — application hosting. It processes the content of requests you make to the site, including your IP address.
• Neon Inc. — the managed PostgreSQL database holding your account, projects and results.
• OpenRouter, Inc. — the gateway through which a tracked prompt reaches the AI model you select, and which routes it to that model’s own provider. It receives the prompt text and the model choice. Your name, email address and account identifiers are not sent with it.
• Resend (Plus Five Five, Inc.) — transactional email delivery: your activation link, password resets, invitations, expiry reminders and the digests you have switched on. It receives your email address, your name as it appears in the greeting, and the content of the message. It is not used for marketing, and we send no newsletter.
• Tavily (Tavily Inc.) — the search provider used to check whether a page appears for a query you have chosen to track. It receives the query text and nothing else: not your name, not your email address, not your account identifiers.

The websites you ask us to monitor are third parties we fetch public pages from; we send them nothing about you beyond the ordinary content of an HTTP request.

The application and its database run in the United States. If you are in the United Kingdom or the European Economic Area, this means your personal data is transferred outside your country. Those transfers rely on the standard contractual clauses our processors publish in their data processing agreements, which is the lawful mechanism for such a transfer.

The AI model you select for a prompt may run in another country again. The provider and model are named on every result, so you can always see where a prompt was sent before you run it.

OrganicIQ scores and ranks opportunities, but it makes no automated decision about you with a legal or similarly significant effect. Every score is shown with the factors that produced it, and nothing in the product acts on your account without you choosing to.

OrganicIQ sets one cookie, which holds your session token. It is HTTP-only, restricted to this site, and necessary for signing in. We do not use advertising or analytics cookies, so there is no tracking consent banner to dismiss.

Your light or dark theme preference is kept in your browser’s local storage. It never leaves your device and is never sent to us.

• Account and order records are kept while your account exists, and afterwards only as long as required for tax and accounting obligations.
• Project data, page snapshots, AI results and opportunities are kept while your account exists. Expiry of a plan does not delete them.
• Expired and revoked session records are pruned automatically.

You can ask us for a copy of your personal data, ask us to correct it, or ask us to delete your account and the data associated with it. You can also object to our processing or ask us to restrict it, and to ask us to transfer it to another provider in a portable format. Email us at the address at the foot of this page, or use the contact page, and we will respond within one month.

You can withdraw consent to the optional opportunity summary email at any time from your account settings, without affecting anything else.

If you are in the United Kingdom or the European Economic Area and you believe we have handled your data improperly, you can complain to your national data protection authority. We would rather you told us first, so we can put it right.

Passwords are hashed with bcrypt. Sessions are opaque random tokens of which only a keyed hash is stored, so a database copy cannot be replayed as a login. Outbound website fetching is restricted to public addresses, and access to each workspace’s data is checked on every request.

We will update this page when what we do changes, and will update the date at the top. Where a change materially affects how we handle your data, we will email account owners before it takes effect.