[Draft for lawyer review. Nothing on this page is in force yet.]
Aivting is a service that shows businesses how AI answers mention their brand. This policy explains what personal data we collect, why, who we share it with, and the choices you have. We wrote it in plain English. If something is unclear, email us at hello@aivting.com.
Who we are
Aivting is operated by [LEGAL NAME], [LEGAL ENTITY], of Btzier 50, Karmiel, Israel ("Aivting", "we", "us"). You can reach us about privacy at hello@aivting.com.
Our role
For our website, the waitlist, your account, billing contacts and our own marketing, we decide how and why personal data is used. Under the GDPR and UK GDPR that makes us the controller.
When a customer uses Aivting, the customer decides what goes into its workspace and projects: the brands, competitors and prompts it tracks, the logos it uploads, the people it invites, and whether to share or export project data. For that workspace content we act on the customer's instructions, as its processor. If you are a customer and need a data processing addendum (DPA), email hello@aivting.com. [LAWYER REVIEW: standard DPA to be prepared before the first EU customer; it should treat project members, share links and exports as the customer's instructions.]
What data we collect
You give us directly
- Waitlist: your work email address.
- Contact: your name, email address and the content of your message, if you write to us.
- Account [CONFIRM: once accounts launch]: your name, email address and, if you sign in with Google, the basic profile details Google shares with us (name, email address, profile picture). We do not receive your Google password.
- Workspace content [CONFIRM: once accounts launch]: the brand names, competitor names and prompts (questions) you choose to track, including prompt lists you import from a file; logos you upload for reports; and the email addresses and roles of people you invite to a project; tags you add to prompts; and notes you pin to days on a project's chart.
- If someone invites you to a project: we receive your email address and your role (owner, editor or viewer) from the customer who invited you. We use them only to let you join that project. If you don't join, we delete the invitation within [CONFIRM: 30] days after it expires.
- Chart notes: short notes that project owners and editors write on a project's chart. Everyone on the project can read them, including viewers the customer invites, and they appear in reports the customer exports. They don't appear on share links. A note stays in the project if its author leaves, and is deleted when the project is deleted. Please don't put personal information about other people in notes.
- Billing: payments are handled by our reseller, Lemon Squeezy (see "Sub-processors"). We do not receive or store your full card number. We receive limited details such as your name, email address, billing country, plan and payment status. [CONFIRM: Lemon Squeezy is live as merchant of record.]
Collected automatically
- Technical and log data: IP address, browser type, device type, pages visited, dates and times, and error logs. This includes visits to shared project links by people who don't have an account. Our hosting provider records some of this to deliver and secure the site, and we use it to prevent abuse, for example by limiting how often a link can be opened.
- Product tour: which steps of our in-app tour you have finished or skipped, so we can pick up where you left off and not show it again.
- Cookies: see "Cookies and analytics".
Collected by the service
- AI answers: Aivting collects answers that AI services (such as ChatGPT and Google's AI features) give to the prompts our customers track. These answers are written by third-party AI systems and can mention people, for example a company's founder. We store them as business content to show customers how their brand is mentioned. We do not use them to build profiles of individuals.
We do not knowingly collect sensitive data (such as health, religion or biometric data), and we ask you not to enter it into prompts or messages.
Why we use it (lawful bases)
| Purpose | Data | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Send the waitlist launch email(s) you asked for | Work email | Your consent, given when you join. You can withdraw it at any time. |
| Reply to your message | Name, email, message | Our legitimate interest in answering enquiries (or steps before a contract, if you ask about buying) |
| Provide your account and the service | Account data, workspace content, AI answers | Performance of our contract with you or your organisation |
| Let people join projects they are invited to | Invited email address, role, invitation record | On the customer's instructions, as its processor; once you join, performance of our contract with you |
| Remember your product-tour progress | Tour steps finished or skipped | Performance of our contract with you (providing the app) |
| Deliver shared project links and protect them from abuse | IP address, browser, date and time | Our legitimate interest in a secure, working service |
| Billing, invoices and tax records | Billing details | Contract, and our legal obligations |
| Keep the service secure, prevent abuse, fix errors | Technical and log data | Our legitimate interest in a secure, working service |
| Product analytics [CONFIRM: once an analytics tool is chosen] | Usage data | Our legitimate interest in improving the product, or your consent where the law requires it for cookies (see below) |
| Service and account emails (security, billing, changes to terms) | Contract, and our legitimate interest | |
| Product news and offers to customers [CONFIRM: only if the owner plans this] | Your consent, or where the law allows, our legitimate interest with an easy opt-out |
[LAWYER REVIEW: confirm the lawful basis per purpose and the legitimate-interest balancing notes.]
Under Israeli law, we collect and use data for the purposes described here and tell you whether giving it is required. Fields marked as required on our forms are needed to do what you asked (for example, we cannot reply without an email address). Everything else is optional.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
Marketing emails
If you join the waitlist, we will email you about Aivting's launch and early access. Every marketing email includes our postal address and an unsubscribe link, and we stop within 10 business days of your request (usually much sooner). We keep a record of when and where you signed up, so we can show your consent. We will not add you to other marketing lists without asking. [CONFIRM: double opt-in (confirmation email) is used for the waitlist.]
Who can see workspace data
- Project members. People a customer adds to a project can see that project's content, according to the role the customer gives them. Depending on their role, members can see the names and email addresses of the project's other members. [CONFIRM: owners and editors see the member list]
- Share links. A project owner can create a read-only link to the project's results. Anyone who has the link can open it without an account, until it expires 30 days after it is created or the owner turns it off. Shared pages show the project's brands, competitors, prompts, results, cited sources and short excerpts of AI answers [CONFIRM: final share-page content]. They never show members' names or email addresses, and we ask search engines not to index them.
- Reports and exports. Customers can download reports and export project data, including AI answers, as files.
The customer decides who receives its share links, reports and exports, and is responsible for the copies it shares or downloads. If we delete or correct data in Aivting (for example, at your request), share links show the change, but we can't change files a customer has already downloaded.
Sub-processors
We use trusted providers to run Aivting. They process personal data only on our instructions and under a data processing agreement.
| Provider | What it does for us | Where data is processed |
|---|---|---|
| Vercel Inc. | Website and app hosting | United States (Washington, D.C. region) for the app and its servers. Pages and files may be delivered from Vercel's global network close to you. |
| Supabase Inc. | Database, sign-in and file storage (for example, logos you upload) | United States (Amazon Web Services, US East, North Virginia), including file storage for uploaded logos. |
| Lemon Squeezy | Payments, invoices and sales tax, as our reseller (merchant of record) | [CONFIRM: Lemon Squeezy LLC, United States, a Stripe company; check the current legal entity in its DPA] |
| DataForSEO OÜ | Collecting AI answers to tracked prompts (receives prompts, not your personal account data) [CONFIRM: what is sent] | Estonia (EU), with its data partners. |
| Google sign-in, if you choose it | [CONFIRM: keep this row only if Google sign-in is switched on] |
We will update this list before adding a new provider that processes personal data. [LAWYER REVIEW: whether customers under a DPA must get advance notice and a right to object.]
International transfers
We are based in Israel. The European Commission and the UK recognise Israel as giving personal data an adequate level of protection. Our database and app servers are in the United States. When personal data moves from the EU, the UK or Israel to the United States, we rely on the provider's certification under the EU-U.S. Data Privacy Framework (and its UK extension), or on Standard Contractual Clauses in the provider's data processing agreement. [CONFIRM per provider; LAWYER REVIEW: Israeli Privacy Protection (Transfer of Data Abroad) Regulations 2001 basis for Israel to US.]
How long we keep data
| Data | How long |
|---|---|
| Waitlist email | Until you unsubscribe, or [PLACEHOLDER: e.g. 12] months after launch if you don't create an account |
| Contact messages | [PLACEHOLDER: e.g. 24] months after our last reply |
| Account data and workspace content | While your account is active; deleted within [PLACEHOLDER: e.g. 30] days after you delete your workspace or your account closes, except backups, which are overwritten within [PLACEHOLDER: e.g. 30] more days |
| Collected AI answers | Same as the workspace they belong to |
| Project invitations | Until accepted or cancelled; unused invitations are deleted within [CONFIRM: 30] days after they expire |
| Share links | Until they expire (30 days after creation) or are turned off; then deleted within [CONFIRM: 30] days |
| Uploaded logos | Until you remove them; if the project or workspace is deleted, as for workspace content |
| Product-tour progress | While your account is active |
| Billing records | As long as tax law requires (in Israel, generally 7 years) [LAWYER REVIEW / accountant] |
| Logs | [PLACEHOLDER: e.g. 30–90] days |
| Consent and unsubscribe records | As long as needed to prove consent and honour opt-outs |
Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong, incomplete or out of date;
- delete your data;
- restrict or object to some uses, including any use based on our legitimate interests;
- send your data to you or another provider in a portable format;
- stop sending you marketing (you can also click "unsubscribe" in any marketing email);
- withdraw consent at any time, without affecting what we did before.
Israel: you have the right to inspect your data and ask for it to be corrected or deleted under the Privacy Protection Law, 1981, and to ask to be removed from any direct-marketing list.
EU and UK: you also have the right to complain to your local data protection authority.
US states: if a US state privacy law applies to you, you can make the requests above, and we will not treat you differently for doing so. We do not sell or share personal data for targeted advertising.
To make a request, email hello@aivting.com. We may ask you to confirm your identity. We reply within 30 days. If a request is complex, we will tell you within that time if we need longer and why. [LAWYER REVIEW: deadlines per regime: GDPR one month (+2), Israeli regulations 30 days, CCPA 45 days; 30 days meets all three.]
If your data is part of a customer's workspace (for example, you were invited by your employer or by an agency you work with), we may pass your request to that customer, because it controls that data. You can also ask the project's owner to remove you from a project at any time.
Security
We protect personal data with measures that fit a small service: encrypted connections (HTTPS), access controls that keep each customer's workspace separate, two-factor authentication on our administrative accounts, limited staff access, and regular backups [CONFIRM: each item at launch]. Share links use long random codes that we store only in scrambled (hashed) form, and they stop working as soon as they expire or are turned off. Invitation links work only for the invited email address. [CONFIRM at build] No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.
[LAWYER REVIEW: Israeli Data Security Regulations 2017, which security level applies to our database.]
Children
Aivting is a business tool. It is not meant for anyone under 18, and we do not knowingly collect data from children.
Changes to this policy
If we change this policy, we will update the date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.
Contact
Questions, requests or complaints about privacy: hello@aivting.com, or write to [LEGAL NAME], Btzier 50, Karmiel, Israel.
If you are not satisfied with our answer, you can contact the Israeli Privacy Protection Authority or, in the EU or UK, your local data protection authority.