Privacy Policy

Account data. Your email address and authentication identifiers. Passwords are hashed by our auth provider (Supabase) — we never see them. If you sign in with Google or GitHub, we receive your email and basic profile from that provider.

Product data. Brands you add (name, category, location, website, competitor names) and the scan results we generate for them.

Payment data. Payments are handled entirely by Polar Software Inc. (polar.sh) as Merchant of Record. We store only your subscription status and internal identifiers — never card numbers or billing addresses.

Usage analytics (first-party). Pages viewed, interface elements clicked and the order of those actions within a visit, a random session identifier, referrer, device type (mobile/desktop), and your country and city derived from your IP address at our hosting edge. We do not store IP addresses. We also use Vercel Analytics for aggregate page metrics. We use no advertising trackers and no third-party ad cookies.

To provide the Service (run checks, build reports, generate fix packs); to send AI engines the questions needed for your checks; to bill subscriptions via Polar; to send transactional email (sign-in links, monitoring digests, competitor alerts) via Resend; to understand how the product is used and improve it; and to prevent abuse (daily limits use a truncated hash of the IP, not the IP itself). We do not sell personal data or share it with advertisers.

To run a check we send your brand's name, category, location and competitor names inside our prompts to AI providers (OpenAI, Anthropic, Perplexity, Google). This is business information you asked us to check — we do not include your email or any personal account data in prompts. Those providers process the prompts under their own terms.

Supabase (database and authentication), Vercel (hosting, CDN and aggregate analytics), Polar (payments, Merchant of Record), Resend (email delivery), and the AI providers listed above. Infrastructure is located in the EU and the United States; by using the Service you consent to this international processing.

We use cookies only to keep you signed in (Supabase auth session). Our analytics uses browser sessionStorage for a random per-visit identifier that expires when the tab closes; it is not used to track you across other websites. Because we use no advertising or cross-site tracking cookies, no cookie consent banner is required — and you won't see one.

Account and product data are kept while your account is active. Analytics events are kept for up to 12 months. If you delete your account, we remove your personal data within 30 days; billing records are retained by Polar as required by law.

You can request access to, correction of, export of, or deletion of your personal data at any time by emailing thebukharianxo@gmail.com from your account email. We respond within 30 days. Depending on your residence (e.g. EU/EEA, UK), you may also have the right to lodge a complaint with your local data-protection authority.

Data is encrypted in transit (TLS); database access is restricted with row-level security and service credentials. No method of transmission or storage is 100% secure, but we design the Service to collect the minimum data it needs — the biggest protection is that we simply don't hold your card numbers or IP addresses at all.

The Service is not directed at children and is not intended for anyone under 16.

We may update this policy; material changes are announced on this page (and by email for account holders) before they take effect.