Privacy & Data Rights
Data export, account deletion, consent management, cookie preferences, and data retention policies
Overview
AEO Optima implements full GDPR (Articles 15–20) and DPDP Act 2023 data subject rights. You can export all your personal data, request permanent account deletion, manage your consent preferences, and control cookie settings — all from self-service interfaces.
Data Export (Right of Access & Portability)
Download a complete JSON file containing all your personal data stored on AEO Optima.
What's included in the export
| Data Category | Details |
|---|---|
| Profile | Display name, email, avatar, creation date |
| Auth metadata | Email, account creation date, last sign-in, auth provider |
| Organization memberships | All organizations you belong to, your role in each |
| Project memberships | All projects you have access to |
| Consent records | Every consent event (type, timestamp, IP, user-agent) |
| Audit logs | All actions logged under your user ID |
| MCP tokens | Token metadata (no secrets) |
| API keys | Key metadata (no secrets) |
| Scheduled reports | Reports you created or are subscribed to |
| Usage records | Your personal API usage and cost records |
| Alert rules | Alert configurations you created |
How to export
- Go to Settings > Profile.
- Scroll to the Data & Privacy section.
- Click Export My Data.
- A JSON file downloads immediately.
Note: The export contains all your data with no artificial limits. Data retention policies (see below) naturally bound the volume.
Account Deletion (Right to Erasure)
Ask for your account to be deleted. Deletion takes effect after a 30-day grace period, in which you can cancel the request by contacting us.
How to request deletion
- Go to Settings > Profile.
- Scroll to the Danger Zone section.
- Click Delete Account and confirm.
- Your account enters a 30-day grace period.
- During the grace period, you can still log in. There is no cancel button: to cancel the request, email hi@techshu.ai (subject: Privacy).
- After 30 days, an automated daily process deletes your account as described below.
What gets deleted
The deletion runs these steps, in order:
- Sole-member organizations — If you are the only member of an organization, the entire organization and all its child data (projects, prompts, snapshots, analytics, reports, webhooks, etc.) are cascade-deleted.
- MCP tokens — All your MCP API tokens are deleted.
- Scheduled reports — All reports you created are removed.
- Memberships — You are removed from all organization and project memberships.
- Consent records — All your consent records are deleted.
- Usage records — Your
user_idis set to null (anonymized) to preserve aggregate billing data. - Audit logs — Your entries in organizations that continue are kept, unlinked from your account; the email address, and any IP address or browser details, recorded in each entry stay until its 730-day window ends.
- Auth account — Your authentication record is deleted, which cascades to your profile.
Cancelling deletion
There is no cancel button in the product. During the 30-day grace period, email hi@techshu.ai (subject: Privacy) to cancel the request.
Consent Management
All consent events are recorded server-side for compliance audit trails.
Consent types
| Type | When recorded |
|---|---|
terms_acceptance | On signup |
privacy_notice | On signup |
age_confirmation | On signup |
cookie_analytics | When accepting/rejecting cookies |
marketing_email | When opting in/out of marketing emails |
Each consent record stores: your user ID (none for a cookie choice made while signed out), consent type, granted/denied status, notice version, IP address, user-agent, and timestamp.
Cookie Preferences
First visit
On your first visit, a cookie banner appears. We use only the cookies needed to sign you in and for the site to work. We set no analytics or advertising cookies, and there is no third-party analytics or advertising script on our site. Our pages send us anonymous page-speed measurements (Core Web Vitals) that identify no one and set no cookie. The choice you make on the banner (Accept All or Reject Non-Essential) is recorded but turns nothing on or off today.
Changing preferences
Click Cookie Settings in the footer of our public pages at any time to reopen the consent banner and change your preferences.
Cookie expiry
Cookie consent preferences expire after 365 days, at which point the banner re-appears automatically.
What's gated behind consent
Nothing today. We set no analytics or advertising cookies, and there is no third-party analytics or advertising script on our site, so there is nothing for the banner to gate. Our pages send us anonymous page-speed measurements (Core Web Vitals) that identify no one and set no cookie.
Data Retention
An automated weekly process ages out data older than its retention period. Snapshots and alert history are retained on a plan-tier basis: the window is your plan's, listed below, and an Enterprise-Agency or Custom organisation can agree a longer window, up to 2 years. GA4 traffic and GSC search data follow the same plan windows until 19 November 2026; from 20 November 2026 they are kept 365 days on every plan, and if you ask us to delete them sooner we do so within 90 days of your request. Compliance and operational records use fixed windows regardless of plan.
Past its window, a snapshot is hidden rather than permanently erased: it no longer appears in any dashboard, chart, report, or export, but the underlying record is preserved so your historical visibility trend and forecasts stay intact. A hidden snapshot is not restored when a window lengthens or the plan changes. GA4 traffic, GSC search data, and alert history are permanently deleted at their window. Account deletion (above) deletes hidden snapshots only when it deletes their organization, that is, when you were its only member; in an organization that continues, its snapshots, hidden or not, stay with the organization.
Tier-based retention (Snapshots and alert history; GA4 traffic data and GSC search data until 19 November 2026):
| Plan | Retention |
|---|---|
| Free | 45 days |
| Starter | 45 days |
| Pro-Individual | 90 days |
| Pro-SME | 90 days |
| Enterprise-Brand / Enterprise-Agency / Custom | 365 days |
Fixed retention (independent of plan):
| Data Type | Retention Period | Reason |
|---|---|---|
| Audit logs | 730 days (2 years) | Legal/compliance audit trail |
| Consent records | 730 days (2 years) | Legal proof of consent (IP, user-agent) |
| Webhook deliveries | 90 days | PII in payload/response body |
| Usage records | 365 days | Cost/billing analytics |
| GA4 traffic data, GSC search data (from 20 November 2026) | 365 days, every plan | Google data you sync |
| Contact-form messages | 365 days | Messages sent through our contact form |
| AI crawler hits (beta) | 90 days | Per-request crawler analysis |
| Daily AI crawler counts (beta) | 25 months | Year-on-year crawl trends |
| Crawler batch receipts (beta) | 7 days | Detecting a batch sent twice |
AI crawler traffic (beta)
When you connect your server logs, the crawl agent, the Cloudflare Worker or an upload, AEO Optima keeps only the lines from known crawlers; visitor lines are discarded. No IP address is ever stored. For each crawler request we keep whether its address fell inside the range the crawler's vendor publishes, and a keyed one-way hash of its network (the /24 for IPv4, the /48 for IPv6), which is deleted with the request after 90 days. The network a batch was sent from is kept the same way, as a keyed hash, for 7 days. Two identical log lines from the same source are counted as one hit.
Why retention matters: Records like consent events and webhook deliveries contain PII (IP addresses, user-agents, email addresses). Automated retention ensures this data is not stored indefinitely, reducing compliance risk.
Legal Pages
The following legal pages are available from the footer on every page:
| Page | URL | Content |
|---|---|---|
| Privacy Policy | /privacy | Full privacy notice covering data collection, processing, and rights |
| Terms of Service | /terms | Platform usage terms and conditions |
| Cookie Policy | /cookies | Cookie types, purposes, and user controls |
| Acceptable Use | /acceptable-use | Usage restrictions and prohibited activities |
| Data Processing Addendum | /dpa | DPA with its sub-processor table (each vendor and its location) |
| Contact | /contact | Contact form, grievance officer, SLAs, category-specific emails |
Email Unsubscribe
All emails from AEO Optima include:
- One-click unsubscribe (RFC 8058) — Works natively in Gmail, Apple Mail, and other modern email clients.
- Browser unsubscribe — Click the unsubscribe link in the email footer for a styled confirmation page.
- Signed tokens — Unsubscribe links use HMAC-signed tokens with 90-day validity to prevent unauthorized requests.
Plan Availability
All privacy and data rights features are available on every plan, including Free. These are fundamental rights, not premium features.