Legal
Privacy Policy
Last updated: 2026-07-26
1. What we collect
| Category | Data | Purpose | Legal basis (LGPD/GDPR) |
|---|---|---|---|
| Account | Email, name (optional), password hash (via Supabase Auth) | account access, service emails | contract performance |
| Business input | Domain(s) you register for analysis, competitors you declare, market/language preferences | to run the analyses you request | contract performance |
| Billing | Handled by Stripe — we store only your Stripe customer ID and purchase/payment records. We never see or store card numbers. | order data | contract performance |
| Usage | Pages viewed in the app, feature usage, technical logs | operate and improve the Service | legitimate interest |
| Communications | Emails we send (report ready, monthly delta, billing notices) and your replies | service delivery | contract performance |
What we do NOT collect: we do not access your website, analytics, ad accounts, or any system of yours. Analysis data comes from publicly available sources (search results, public AI-engine responses, public web pages) obtained via licensed data providers.
2. About the data in your reports
Reports contain information about brands and public web content (yours and competitors'), gathered from public sources. This is business information about companies, not personal data of individuals. Where third-party content appears (e.g., an AI answer excerpt), it is quoted for analysis purposes with source attribution.
3. Subprocessors
We share data only with processors necessary to run the Service:
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase | database, authentication | US |
| Stripe | payments and billing | US/global |
| Vercel | application hosting | US/global |
| DataForSEO | public search/AI-engine data provider (receives only the domains/keywords being analyzed — never your account data) | US/global |
| Resend | transactional email | US |
International transfers rely on standard contractual clauses / adequacy mechanisms as applicable.
4. Retention
- Account and order data: while your account is active + 5 years for tax/legal records.
- Analysis snapshots: while your account is active (they power your month-over-month history); deleted within 90 days of account deletion.
- You may request deletion at any time (see §6).
5. Cookies
Only essential cookies (session/authentication). No ad-tracking cookies.
6. Your rights (LGPD / GDPR)
You may request: access, correction, portability, deletion, or restriction of processing of your personal data; and you may object to processing based on legitimate interest. Contact: hello@trygeohero.com. We respond within 15 days (LGPD) / 30 days (GDPR). You may also complain to the ANPD (Brazil) or your local supervisory authority (EU).
7. Security
Data is encrypted in transit (TLS) and at rest. Access is role-scoped (row-level security per account); payment credentials never touch our systems. We notify affected users of any breach as required by law.
8. Children
The Service is for businesses and not directed at children under 18.
9. Changes
Material changes will be notified by email at least 15 days before taking effect.
Contact / Controller
Controller: the individual entrepreneur operating under the trade name "GeoHero", based in Brazil. Contact for all privacy matters and data-subject rights: hello@trygeohero.com. As a small-scale operator under Brazilian law (ANPD Resolution CD/ANPD 2/2022), we are exempt from appointing a formal DPO; this contact channel fulfills that function.