Privacy policy
Last updated October 24, 2026
Who we are
aeotrace is an AI visibility tracking service operated by devmarketing.co ("we", "us"). We are the controller of the personal data described in this policy.
For any privacy question or request, email hello@aeotrace.com.
Data we collect
- Account: your name, email address and a hashed version of your password (we never see or store the password itself). If you turn them on, your two-factor secret and recovery codes (encrypted) and your passkey public keys.
- Team: team names, who belongs to which team, their roles, and the email addresses you invite.
- Workspace: the brands you track (name, domain, country), competitors, prompts, the AI answers we fetch for those prompts, the brand mentions and cited pages we find in them, checks of your website and of cited pages, actions, drafts, and any share links you create.
- Billing: the customer and subscription ids Stripe gives us, your plan, trial dates, and the card brand and last four digits. Card numbers go straight to Stripe. We never receive or store them.
- Technical: server logs (IP address, browser user agent, the URLs requested, errors) and session data.
We do not ask for sensitive data and you should not put personal data about other people into prompts or drafts.
How we use it
- To run the service: fetch AI answers for your prompts, find mentions and citations, and show reports, actions and drafts.
- To bill you and manage your trial and subscription.
- To send service emails: email verification, password resets, team invitations and run reports.
- To keep the service secure, prevent abuse and fix errors.
- To answer you when you contact us.
What we do not do
- We do not sell your data.
- We do not run advertising, ad trackers or third-party analytics scripts.
- We do not use your data to train AI models, and Anthropic does not train its models on data sent through its commercial API.
Legal bases (GDPR)
- Contract (Art. 6(1)(b)): account, team, workspace and billing data, to provide the service you signed up for.
- Legitimate interests (Art. 6(1)(f)): logs and security measures, abuse prevention, and improving the service.
- Legal obligation (Art. 6(1)(c)): keeping invoices and payment records as tax and accounting law requires.
Service providers
We share data only with the providers we need to run aeotrace, and only what each one needs:
- Hetzner Online GmbH (Germany, EU): hosts our servers and database. All the data above is stored here.
- Cloudflare (US): DNS and network proxy. Traffic to aeotrace, including your IP address, passes through it.
- Stripe (US, with EU entities): payments, invoices and the billing portal. Stripe receives your email, team name and payment details.
- DataForSEO: fetches answers from AI engines such as ChatGPT and Google AI Overviews. It receives the text of your prompts (which can include brand and competitor names) and the target country and language. It does not receive your account details.
- Anthropic (US): classifies mentions and writes drafts. It receives the fetched answer text, your prompt, brand and competitor names, and for drafts the brand details and source text the draft is based on.
- Resend (US): delivers our emails. It receives your email address and the email content.
- Google (US): to show site icons, your browser loads favicons for brand, competitor and cited domains from Google's favicon service. Google receives your IP address and the domain whose icon is shown.
Our fonts are served from our own servers, not from a third-party font service. To check websites, our own servers fetch your site and the pages AI answers cite, identifying themselves as the aeotrace bot.
International transfers
Our servers and database are in the EU. Some providers above process data outside the European Economic Area, mainly in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework.
Retention and deletion
- We keep account and workspace data while your account is active.
- Delete account (Settings, then Profile) removes your login, profile, two-factor settings, passkeys and team memberships right away.
- Brands, prompts, answers and drafts belong to a team, so deleting your account does not delete them for teammates. To erase a team's workspace data, including your personal team, email hello@aeotrace.com and we will erase it within 30 days.
- Invoices and payment records are kept as long as tax and accounting law requires.
- Server logs are kept for a short period for debugging and security, then deleted. Daily database backups are kept in separate storage, and deleted data drops out of them as old backups are removed.
Cancelling a subscription does not delete data. To stop billing, cancel in the billing portal as well.
Your rights
Under the GDPR and similar laws you can ask us to:
- give you a copy of your data;
- correct data that is wrong;
- delete your data;
- restrict or object to how we use it;
- send your data to you or another provider in a machine-readable format.
Email hello@aeotrace.com. We answer within one month. You can also complain to your local data protection authority.
Security
All traffic uses HTTPS. Passwords are hashed, two-factor authentication and passkeys are available, and access to production systems is limited to the people who run aeotrace. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you without undue delay.
Children
aeotrace is a business tool and is not meant for anyone under 16.
Changes to this policy
When we change this policy we update the date at the top. For important changes we will also email account owners before they take effect.
aeotrace is operated by devmarketing.co. Contact: hello@aeotrace.com