Aivting is a service that shows businesses how AI answers mention their brand. This policy explains what personal data we collect, why, who we share it with, and the choices you have. We wrote it in plain English. If something is unclear, email us at hello@aivting.com.
Who we are
Aivting is operated by Wisam Katesh, an individual doing business in Israel as a sole trader under the name Aivting, of Btzier 50, Karmiel, Israel ("Aivting", "we", "us"). You can reach us about privacy at hello@aivting.com.
Our role
For our website, your account, billing contacts and messages you send us, we decide how and why personal data is used. Under the GDPR and UK GDPR that makes us the controller.
When a customer uses Aivting, the customer decides what goes into its workspace and projects: the brands, competitors and prompts it tracks, the logos it uploads, the people it invites, and whether to share or export project data. For that workspace content we act on the customer's instructions, as its processor. Our Terms include the data processing terms that apply when we act as a customer's processor (see "Processing personal data for you" in our Terms). If you are a customer and need a separately signed data processing addendum (DPA), email hello@aivting.com.
What data we collect
You give us directly
- Emails you send us: if you email us, we keep your message, your name, email address and anything you include, so we can reply and keep a record of the conversation. We don't add you to a mailing list unless you ask us to.
- Account: your email address, your name if you give it to us or Google shares it, and a record of which version of our terms you accepted and when. You can create an account without a plan; it lets you view a demo with sample data.
- If you sign in with Google: when you choose "Continue with Google", Google shares with us your name, email address, profile picture and a Google account identifier, and confirms your email address. We ask only for these basic scopes. We don't receive your Google password, and we don't access your Gmail, Drive, contacts or any other Google data. We use this information only to create and secure your account and to identify you to the owners and editors of projects you join. We don't use it for advertising, and we don't sell it or share it except with the service providers that host our app (listed below). Our use of information received from Google APIs follows the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. Google processes your sign-in under its own privacy policy; Google is an independent provider of the sign-in, not a sub-processor of ours. You can remove Aivting's access at any time in your Google Account settings, and you can ask us to delete your account at hello@aivting.com.
- Workspace content: the brand names, competitor names and prompts (questions) you choose to track, including prompt lists you import from a file; logos you upload for reports; and the email addresses and roles of people you invite to a project; tags you add to prompts; and notes you pin to days on a project's chart.
- If someone invites you to a project: we receive your email address and your role (editor or viewer) from the customer who invited you. We use them only to let you join that project. If you don't join, we delete the invitation within 30 days after it expires.
- Chart notes: short notes that project owners and editors write on a project's chart. Everyone on the project can read them, including viewers the customer invites, and they appear in reports the customer exports. They don't appear on share links. A note stays in the project if its author leaves, and is deleted when the project is deleted. Please don't put personal information about other people in notes.
- Billing: we sell Aivting through Paddle, our reseller and merchant of record (see "Payments: Paddle"). At checkout, Paddle collects your name, email address, billing address or country, payment details and, if you give them, your business name and tax ID, under its own privacy notice. We never receive or store your full card number. Paddle shares with us what we need to run your subscription and answer billing questions: your name, email address, country and address, any business name and tax ID, what you bought, and the status of payments, refunds and chargebacks. Our app stores Paddle's reference numbers for you, your subscription and your payments, your plan, billing period, amounts and status, and the notifications Paddle sends us about your subscription, refunds and chargebacks. We send Paddle only a random checkout reference, so it can link your payment to your workspace.
Collected automatically
- Technical and log data: IP address, browser type, device type, pages visited, dates and times, and error logs. Our own error log keeps the error message of a server error, which can include the page or request address and an account identifier. This includes visits to shared project links by people who don't have an account. Our hosting provider records some of this to deliver and secure the site, and we use it to prevent abuse, for example by limiting how often a link can be opened.
- Bot check: when you open our sign-in or sign-up page, Cloudflare Turnstile checks that you are a person and not an automated script. To do that, Cloudflare receives your IP address and technical details about your browser and device.
- Product tour: which steps of our in-app tour you have finished or skipped, so we can pick up where you left off and not show it again.
- Analytics, only if you accept: if you accept analytics cookies on our public website, Google Analytics records how you use those pages (see "Cookies and analytics"). If you don't accept, nothing is collected for analytics.
- Cookies: see "Cookies and analytics".
Collected by the service
- AI answers: Aivting collects answers that AI services (such as ChatGPT and Google's AI features) give to the prompts our customers track. These answers are written by third-party AI systems and can mention people, for example a company's founder. We store them as business content to show customers how their brand is mentioned. We do not use them to build profiles of individuals.
We do not knowingly collect sensitive data (such as health, religion or biometric data), and we ask you not to enter it into prompts or messages.
Why we use it (lawful bases)
| Purpose | Data | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Reply to your message | Name, email, message | Our legitimate interest in answering enquiries (or steps before a contract, if you ask about buying) |
| Provide your account and the service | Account data, workspace content, AI answers | Performance of our contract with you or your organisation |
| Let people join projects they are invited to | Invited email address, role, invitation record | On the customer's instructions, as its processor; once you join, performance of our contract with you |
| Remember your product-tour progress | Tour steps finished or skipped | Performance of our contract with you (providing the app) |
| Deliver shared project links and protect them from abuse | IP address, browser, date and time | Our legitimate interest in a secure, working service |
| Protect sign-in and sign-up from bots and abuse | IP address, browser and device signals | Our legitimate interest in a secure, working service |
| Billing, invoices and tax records | Billing details, Paddle reference numbers, plan and payment status | Contract, and our legal obligations |
| Handle refunds and payment disputes (chargebacks), and prevent payment fraud | Payment, refund and dispute status | Contract; our legitimate interest in handling disputes and preventing fraud |
| Keep the service secure, prevent abuse, fix errors | Technical and log data | Our legitimate interest in a secure, working service |
| Understand how visitors use our public website, so we can improve it (Google Analytics) | Pages visited, how you got to them, browser and device details, approximate location, a random identifier for your browser | Your consent, which you can withdraw at any time in "Cookie settings" |
| Remember your cookie choice | Whether you accepted or rejected analytics, when, and which version of our cookie notice you saw | Our legal obligation to respect and show your choice, and our legitimate interest in not asking you on every page |
| Service and account emails (sign-in links, security, billing, changes to terms) | Contract, and our legitimate interest | |
| Record that you accepted our terms | Account, terms version, date and time | Contract, and our legitimate interest in being able to show what was agreed |
| Help with support requests and look into problems | Account and usage information (workspace, plan, payment status, runs, error codes, usage records) | Performance of our contract with you or your organisation; our legitimate interest in a working, secure service and in resolving billing questions |
| Look at workspace content when support access is on | Prompts, AI answers, results, project members' names and email addresses | On the workspace owner's instructions (the permission given in Settings), as the customer's processor |
| Keep the support log | Which workspace and items the support tool opened or changed, and when (no content) | Our legitimate interest in showing that support access is used properly and in keeping the service secure; our legal obligations to protect data |
| Access content without permission when the law requires it or to stop a security incident or serious abuse | Only what is needed | Our legal obligations; our legitimate interest in a secure service |
Where we rely on our legitimate interests, we have weighed them against your rights and expectations, and we use only the data we need. You can ask us for more detail about that balance, and you can object at any time (see "Your rights").
Under Israeli law, we collect and use data for the purposes described here and tell you whether giving it is required. Fields marked as required on our forms are needed to do what you asked (for example, we cannot reply without an email address). Everything else is optional.
We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
Emails we send
We send only service emails: sign-in links, and messages about your account, security, billing and changes to our terms or this policy. We don't send newsletters or marketing emails. If we ever want to, we will update this policy first, ask for your consent where the law requires it, and include our postal address and an unsubscribe link in every marketing email.
Who can see workspace data
- Project members. People a customer adds to a project can see that project's content, according to the role the customer gives them. Owners and editors can see the email addresses and roles of the project's other members and of pending invitations. Viewers see only their own membership.
- Share links. A project owner can create a read-only link to the project's results. Anyone who has the link can open it without an account, until it expires 30 days after it is created or the owner turns it off. Shared pages show the project's brands, competitors, prompts, results, cited sources and short excerpts of AI answers (up to 300 characters each, never the full answer). They never show members' names or email addresses, and we ask search engines not to index them.
- Reports and exports. Customers can download reports and export project data, including AI answers, as files.
The customer decides who receives its share links, reports and exports, and is responsible for the copies it shares or downloads. If we delete or correct data in Aivting (for example, at your request), share links show the change, but we can't change files a customer has already downloaded.
Support access
When you ask us for help, we may need to look into your account. Only our founder, who runs Aivting, can use our support tool, and signing in to it takes a Google account and a code from an authenticator app.
What support can see without your permission. Account information only: your workspace, plan and payment status, how many projects you have, the status and number of collection runs, error codes and usage records. We use it to run the service, answer billing questions, keep Aivting secure and stop abuse. It doesn't include your prompts, AI answers, results or the people in your projects.
What support can see with your permission. A workspace owner can allow support access in Settings, under "Support access". While it's on, the support tool also shows your projects' prompts, collected AI answers, brand mentions, cited sources, and the names and email addresses of project members. Support can only read this content; it can't change, delete or export it. Permission lasts 7 days, and the owner can turn it off earlier at any time. Turning it off stops any further viewing; it can't undo what was already seen. We use what we see only to solve the problem you asked about.
The support log. Every time the support tool is used on your workspace, it records what was viewed or done and when. It records which items were opened, not their content. The workspace owner can see this log in Settings.
Without your permission, in rare cases. We look at workspace content without permission only when the law requires it (for example, a court order), or when it is necessary to investigate and stop a security incident or a serious breach of our Terms, such as illegal content. If that happens, we will tell the workspace owner first, or as soon as we can, unless the law forbids it or telling would put the investigation or other people at risk. We keep a record of what we looked at and why.
If anyone other than our founder ever needs support access, we will update this policy first, and that person will be bound by confidentiality in writing.
Sub-processors
We use trusted providers to run Aivting. They process personal data only on our instructions and under a data processing agreement.
| Provider | What it does for us | Where data is processed |
|---|---|---|
| Vercel Inc. | Website and app hosting | United States (Washington, D.C. region) for the app and its servers. Pages and files may be delivered from Vercel's global network close to you. |
| Supabase Inc. | Database, sign-in and file storage (for example, logos you upload) | United States (Amazon Web Services, US East, North Virginia), including file storage for uploaded logos. |
| DataForSEO OÜ | Collecting AI answers to tracked prompts (receives the prompt text with its country and language, not your account details) | Estonia (EU), with its data partners. |
| Resend (Plus Five Five, Inc.) | Sending our account emails, such as sign-in links, from no-reply@aivting.com (receives your email address and the content of the email). | United States. |
| Cloudflare, Inc. | Bot protection on our sign-in and sign-up forms (Cloudflare Turnstile): receives your IP address and technical details about your browser and device, to tell people apart from automated abuse. Cloudflare also uses these signals, as an independent controller under its Turnstile Privacy Addendum (cloudflare.com/turnstile-privacy-policy), to improve its bot detection. It also forwards email sent to hello@aivting.com to our inbox. | United States and Cloudflare's global network. |
| Google LLC | Website analytics (Google Analytics), only on our public website and only if you accept analytics cookies: receives the pages you visit, browser and device details, a random browser identifier and your IP address, which it uses to work out an approximate location and does not store. | United States and other countries where Google operates. |
Payments: Paddle. Paddle sells Aivting to you as our reseller and merchant of record. For your checkout, payment and tax details, Paddle is therefore a separate controller under its own privacy notice (paddle.com/legal/privacy), not a sub-processor acting on our instructions. Depending on where you are, the Paddle company is Paddle.com Market Limited (United Kingdom), Paddle.com Inc. (United States) or Paddle.com (Canada) Ltd., and Paddle's group may process data in the United Kingdom, Ireland, the United States and Canada. Paddle and we share buyer details under Paddle's data sharing terms, which use the EU Standard Contractual Clauses and the UK Addendum for transfers out of the EU and UK. Paddle is responsible for its own processing and transfers under its privacy notice.
If you sign in with Google, Google provides the sign-in as an independent provider under its own privacy policy (see "What data we collect"), so it is not listed here.
We will update this list before adding a new provider that processes personal data. For personal data in customers' workspace content, we update it at least 14 days in advance, and customers can object, as our Terms explain.
International transfers
We are based in Israel. The European Commission and the UK recognise Israel as giving personal data an adequate level of protection. Our database and app servers are in the United States. When personal data moves from the EU or the UK to the United States, we rely on these safeguards: Vercel is certified under the EU-U.S. Data Privacy Framework and its data processing agreement also includes the EU Standard Contractual Clauses and the UK Addendum; Supabase's data processing agreement uses the EU Standard Contractual Clauses and the UK Addendum; Resend is certified under the EU-U.S. Data Privacy Framework and its data processing agreement also includes the EU Standard Contractual Clauses and the UK Addendum; Cloudflare is certified under the EU-U.S. Data Privacy Framework; Google LLC is certified under the EU-U.S. Data Privacy Framework and its UK extension, and its data processing terms for Google Analytics also include Standard Contractual Clauses. When personal data moves from Israel to these providers abroad, we follow the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001: each provider has committed in writing, in its data processing agreement, to protect the data and to use it only to provide its service to us. Our backup copies are kept in Israel (see "Security").
How long we keep data
| Data | How long |
|---|---|
| Emails you send us | 24 months after our last reply |
| Account data and workspace content | While your account is active. If you delete your account in the app, it is deleted 30 days after you ask (our deletion job runs every hour, so it may finish up to an hour later). If your workspace is deleted or your account closes in any other way, within 30 days. Copies in backups are deleted within 30 more days. |
| Projects you delete | When a project's owner deletes it in the app, it is removed right away: no one can open it any more, and its members, invitations and share links are deleted. Its prompts, collected AI answers, results, notes, tags and uploaded logo are then erased from our database and file storage, usually at once and within 24 hours. Copies in backups are deleted within 30 days. |
| Record of a project deletion | When it happened and which account did it (not the project's name or content), to limit repeated deletions and for security. Kept while the workspace exists; the account link is removed if that account is deleted. |
| Usage records | The time, AI service and cost of each answer we collect (no prompts or answers), for billing, keeping our running costs under control and preventing abuse. Kept while the workspace exists, also after a project is deleted. After the workspace is deleted, kept only as long as we need them for our accounts and tax records, and no longer than 7 years. |
| Requests sent to DataForSEO | DataForSEO keeps its records of the collection requests we send (prompt text, country and language) and the answers it returns for up to 365 days under its own policy, then deletes them. Deleting a project in Aivting doesn't change that. |
| Accounts without a plan | If you create an account but never choose a plan, don't join a project and have no pending invitation, we delete the account and its sign-in record 30 days after you created it. We don't use it to contact you. |
| Record of terms acceptance | While your account is active; deleted with your account |
| Collected AI answers | Same as the workspace they belong to |
| Project invitations | Until accepted or cancelled; unused invitations are deleted within 30 days after they expire |
| Share links | Until they expire (30 days after creation) or are turned off; then deleted within 30 days |
| Uploaded logos | Until you remove them. If the project is deleted, within 24 hours. If the workspace is deleted, as for workspace content. |
| Product-tour progress | While your account is active |
| Billing records | Our records of subscriptions, payments, refunds and chargebacks (including the notifications Paddle sends us) and Paddle's payout statements: as long as tax law requires (in Israel, generally 7 years). Paddle keeps its own records under its privacy notice. |
| Server logs | 30 days |
| Analytics data (only if you accept) | Google Analytics keeps the data linked to your browser identifier for 2 months, then deletes it. After that, we keep only totals that don't identify you. |
| Analytics cookies in your browser (`_ga`, `_ga_MVZEHT7WBK`) | Up to 13 months, unless you reject analytics, turn it off in "Cookie settings" or clear your cookies first; we delete them as soon as you reject or turn analytics off. |
| Your cookie choice (`aivting_consent`) | 6 months in your browser; then we ask again |
| Error log | Our own record of server errors, which can include the page or request address and an account identifier, so we can find and fix problems: 30 days |
| Support log | 24 months from each entry, also after the workspace or account is deleted, to show that support access was used properly and for security |
| Support access permissions | While active (up to 7 days). Expired or turned-off permissions are deleted within 30 days; the support log keeps when access was given and when it ended |
| Blocked attempts to open our support tool | 24 months, for security (a scrambled account identifier, the time and a reason code) |
Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong, incomplete or out of date;
- delete your data;
- restrict or object to some uses, including any use based on our legitimate interests;
- send your data to you or another provider in a portable format;
- not receive direct marketing (we don't send any today);
- withdraw consent at any time, without affecting what we did before.
Israel: you have the right to inspect your data and ask for it to be corrected or deleted under the Privacy Protection Law, 1981, and to ask to be removed from any direct-marketing list.
EU and UK: you also have the right to complain to your local data protection authority.
US states: if a US state privacy law applies to you, you can make the requests above, and we will not treat you differently for doing so. We do not sell or share personal data for targeted advertising.
For checkout and payment details that Paddle holds as a separate controller, you can also contact Paddle directly (paddle.com/legal/privacy). We will help if you ask us.
Deleting your data
- If you have an account: you can delete it yourself in the app: select Account, then Settings, then Delete account. If you have a paid plan, cancel it in Manage billing first. Your account and the workspaces you own alone are deleted 30 days after you ask (up to an hour later, when our hourly deletion job runs), and you can cancel the request until then. Copies in backups are deleted within 30 more days. You can also email us to ask.
- If you visited our public website: select "Cookie settings" and turn analytics off, or select "Reject". That stops Google Analytics and deletes its cookies from your browser. Google Analytics links data to a random browser identifier, not to your name or email address, so we usually can't find your analytics data from your email address alone. Google deletes it after 2 months. If you want it deleted sooner, email us the value of the `_ga` cookie in your browser and we will delete the data linked to it in Google Analytics.
To make a request, email hello@aivting.com. We may ask you to confirm your identity. We reply within 30 days, or within one month if that is sooner. If a request is complex, we will tell you within that time if we need longer and why.
If your data is part of a customer's workspace (for example, you were invited by your employer or by an agency you work with), we may pass your request to that customer, because it controls that data. You can also ask the project's owner to remove you from a project at any time.
A workspace owner can see the support log and turn support access off in Settings at any time. You can also ask us for a copy of the support log for your workspace, including after the workspace has been deleted.
Security
We protect personal data with measures that fit a small service: encrypted connections (HTTPS), access controls that keep each customer's workspace separate, access to customer accounts limited to our founder, through a support tool that needs two-step sign-in and logs each use. Our database provider's plan doesn't include automatic backups. Before major changes, we make a backup copy of our database by hand. Copies are kept on our founder's own computer in Israel, under our control, and we delete each copy within 30 days of making it. Share links use long random codes that we store only in scrambled (hashed) form, and they stop working as soon as they expire or are turned off. Invitation links work only for the invited email address. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.
Children
Aivting is a business tool. It is not meant for anyone under 18, and we do not knowingly collect data from children.
Changes to this policy
If we change this policy, we will update the date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.
Contact
Questions, requests or complaints about privacy: hello@aivting.com, or write to Wisam Katesh (Aivting), Btzier 50, Karmiel, Israel.
If you are not satisfied with our answer, you can contact the Israeli Privacy Protection Authority or, in the EU or UK, your local data protection authority.