Privacy Policy

AEO Optima ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Answer Engine Optimization platform ("Service").

Who we are: AEO Optima is provided by TechShu Digital Private Limited, trading as TechShu, a company incorporated in India, whose registered office is at 15C Dr. Rajendra Prasad Sarani, 1st Floor, Kolkata - 700001, West Bengal, India.

This policy applies to all users of the Service, including visitors to our website, registered account holders, team members within organizations, and API/MCP consumers. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

For purposes of the EU General Data Protection Regulation (GDPR), TechShu Digital Private Limited acts as the "data controller" for personal data collected through the Service. When processing data on behalf of our customers (e.g., team member data within an organization), we act as a "data processor."

Information You Provide Directly:

• Account information — name, email address, and password when you create an account, or profile data from Google when you authenticate via Google OAuth
• Organization & project data — organization name, project names, brand names, competitor names, and related business information
• Prompts & configurations — the queries you create for AI monitoring, schedule settings, alert rules, and other configurations
• API keys — your own third-party API keys (stored encrypted with AES-256)
• Payment information — paid plans are billed by invoice; if card payments are enabled, card details are handled by Stripe and we never store card numbers
• Communications — messages you send to our support or feedback channels
• Contact-form messages — messages you send through our contact form: your name, email address, company and the plan you ask about (if you give them) and message, and whether we could forward it to our team

Information Collected Automatically:

• Usage data — pages visited, features used, actions taken and timestamps
• Device & browser information — IP address, browser type and version, operating system and device type
• Cookies & similar technologies — only the cookies needed to sign you in and for the site to work, and preferences kept in your browser; we set no analytics or advertising cookies (see our Cookie Policy)
• Page-speed measurements — anonymous Core Web Vitals our pages send us: the page, the measurement and its rating, the kind of navigation, the device class and the connection type. They identify no one and set no cookie
• Log data — server logs including request URLs, response codes, and error messages, and our own application error log, which records what failed and may include the email address of the user it concerned

Information from Third Parties:

• Google OAuth — basic profile information (name, email, profile picture) when you authenticate via Google
• Stripe — if card payments are enabled, payment status and subscription information
• Google Analytics 4 — if you connect your GA4 account, we receive the data listed under Google User Data below
• Google Search Console — if you connect your GSC account, we receive the data listed under Google User Data below
• Optional connectors — if you enable third-party connectors (e.g., Shopify, Slack, Looker, Bing Webmaster, Reddit, Wikipedia), we receive only the data scoped to that integration

Website Access Logs You Connect:

If you connect your website's access logs to AEO Optima — by uploading a log file, running our log reader on your server, using our Cloudflare Worker, or sending a log drain from your hosting provider — we receive records of requests made to your website. A record can include the IP address and browser (user agent) of whoever made the request, the page requested and the time. We keep only the requests made by crawlers we recognise, and we store those without the IP address; we keep a coded fingerprint of the network a request came from, which cannot be turned back into the address without our secret key. Every other record, including your website visitors', is read only to find the crawler requests and is discarded without being stored. An uploaded file or a log drain sends us every record from your website; the log reader and the Cloudflare Worker send only records that name a known crawler.

What we access:

Only when a project owner or admin connects them, and only with read-only permission from Google:

• Google Analytics 4 (scope analytics.readonly) — the GA4 properties your Google account can see and, for the one property you choose for a project, its traffic from AI assistants: sessions, users, page views, engaged sessions, average session duration, bounce rate, conversions and revenue, by date, traffic source and landing page
• Google Search Console (scope webmasters.readonly) — the Search Console sites your Google account can see and, for the one site you choose, its search queries, pages, countries, devices and search appearance, with impressions, clicks, click-through rate and position, by date
• Your Google account's email address (scope userinfo.email) — to show which account a connection uses

From 20 November 2026, for the Google Analytics property you choose, we also read its daily totals of all visits by channel (organic search, direct, paid, referral, social and so on): counts of sessions, users, engaged sessions, key events and revenue, never anything about an individual visitor. We use them only to show you what share of your site's visits come from AI assistants.

How we use it:

We use it solely to provide the analytics and reporting features you enabled. We do not use Google user data for advertising, we do not sell it, and we do not transfer it to third parties except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition. We do not use Google user data to develop, improve or train AI or machine-learning models.

How we store it, and for how long:

Google user data is stored encrypted and belongs to the project it was connected for, and so to that project's organisation; the access tokens are encrypted with AES-256. Until 19 November 2026 we keep synced Google data for your plan's retention window — Free 45 days · Starter 45 days · Pro-Individual 90 days · Pro-SME 90 days · Enterprise-Brand 365 days · Enterprise-Agency 365 days · Custom 365 days; from 20 November 2026 we keep it for 365 days on every plan. We then delete it, by a weekly job, so up to 7 days after the window. An Enterprise-Agency or Custom organisation can agree a longer window, up to 2 years.

Some Google data is not on that window. After you disconnect, the Google account email and the property or site name of the connection stay with the project until you ask us to delete them, and figures already included in a report you generated, or in an insight, stay with that report or insight.

How it is shared:

We don't sell Google user data. Besides the providers under Data Sharing & Third Parties, who process it on our behalf, it reaches others only at your direction: the members of your organisation who can open the project; reports you generate, email or share by link; and AI assistants you connect to our API or MCP server with your own token, which can read it in their answers.

Human access:

Our staff look at your Google data only for support you ask for, for security, or when the law requires it.

Disconnecting and deletion:

You can disconnect at any time from Settings → Google integrations. Disconnecting asks Google to revoke our access and clears the stored tokens, so no further data is collected; the data already synced stays in the project until the end of its retention window, or until you ask us to delete it: email hi@techshu.ai, and we delete it within 90 days of your request. You can also remove AEO Optima's access from your Google account at myaccount.google.com/permissions.

Deleting a project hides it from the product but does not erase its data, its Google data included. Deleting your account takes effect after a 30-day grace period, in which you can cancel the request by contacting us. It then removes your sign-in and profile, your memberships, your MCP tokens, the scheduled reports you created and your consent records, and deletes any organisation of which you were the only member, with its projects and their Google data; in an organisation that continues, its projects and their Google data stay with it.

Limited Use:

AEO Optima’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use your personal data for the following purposes:

• Service delivery — operating the platform, capturing AI answers, generating analytics, and providing features you use
• Account management — creating and maintaining your account, managing authentication, and enforcing access controls
• Billing — processing payments, managing subscriptions, and enforcing plan limits
• Communications — sending transactional emails (invitations, alerts, scheduled reports, weekly digests), and responding to support requests
• Security — detecting and preventing fraud, unauthorized access, and other security incidents
• Improvement — analyzing usage patterns to improve the Service, fix bugs, and develop new features
• Legal compliance — complying with legal obligations, resolving disputes, and enforcing our agreements

We do not sell your personal data to third parties. Before 20 November 2026 we do not use your prompts, the answers we capture or our analysis of them to train any AI model. From 20 November 2026 we may use them, de-identified, to train our own checking models: the models that decide whether an answer names a brand, how it speaks of it and whether its facts are right. De-identified means names, contact details and anything else that identifies a person or your organisation are removed first. We never use them to train anyone else's models, and never use Google user data for training. An organisation can opt out at any time by emailing hi@techshu.ai; from then on its data is left out of training.

If you are located in the EU/EEA or UK, we process your personal data under the following legal bases:

Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may request details of this assessment by contacting us.

We share your personal data only with the following categories of third-party service providers ("subprocessors"), each of which is contractually obligated to protect your data:

We may also disclose your data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of AEO Optima, our users, or the public.

Our database is hosted in Singapore (Supabase), our web application's servers run in Singapore (Vercel), and our background services run in the United States (Render). Your data may therefore be processed in Singapore and the United States. If you are located in the EU/EEA, UK, or another region with data protection laws, your data may be transferred to and processed in those countries.

We protect international data transfers through:

• Standard Contractual Clauses (SCCs) approved by the European Commission, in our agreements with subprocessors
• Adequacy decisions where applicable (e.g., EU-US Data Privacy Framework)
• Technical safeguards including encryption in transit (TLS 1.2+) and at rest

You may request a copy of the relevant transfer mechanisms by contacting us.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:

After the retention period, data is permanently deleted, anonymized or, for answers, hidden (see above). You may request earlier deletion, subject to our legal obligations (see Your Rights below).

GDPR Rights (EU/EEA/UK Residents):

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data ("right to be forgotten")
• Restriction — request that we limit processing of your data in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Lodge a complaint — file a complaint with your local data protection authority

CCPA/CPRA Rights (California Residents):

• Right to know — what personal information we collect, use, disclose, and sell
• Right to delete — request deletion of your personal information
• Right to opt-out — of the sale or sharing of personal information (note: we do not sell your data)
• Right to non-discrimination — exercising your rights will not result in discriminatory treatment

To exercise any of these rights, contact us at hi@techshu.ai. We will respond within 30 days (GDPR) or 45 days (CCPA).

We use cookies and similar technologies to operate and improve the Service. For detailed information about the cookies we use, how to manage them, and your consent choices, please see our Cookie Policy.

In summary:

• Essential cookies (Supabase authentication) are required for the Service to function and cannot be disabled
• No analytics or advertising cookies are set, and there is no third-party analytics or advertising script on our site. Our pages send us anonymous page-speed measurements (Core Web Vitals) that identify no one and set no cookie

The Service is not for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe that someone under 18 has provided us with personal data, please contact us immediately at hi@techshu.ai, and we will take steps to delete such data.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS 1.2+) and at rest
• AES-256 encryption for stored API keys
• Role-based access controls (owner, admin, member, viewer) with row-level security in our database
• Secure authentication via Supabase Auth with optional Google OAuth
• Regular security monitoring and vulnerability assessments
• Automated daily database backups

Despite these measures, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law (within 72 hours under GDPR).

As an AI monitoring platform, we want to be transparent about how data interacts with AI systems:

• What we send to AI providers: To capture answers, we send the questions you configure to the answer engines you select: to the chat engines through OpenRouter, and to Google AI Overview and AI Mode through Google Search, over Decodo's network for questions tracked in India (and through DataForSEO when Google blocks that route), or through DataForSEO for questions tracked in any other market. To analyse them, we send the brand facts you enter and the answers we capture to AI models through OpenRouter. Any of these may name people, for example a founder in your brand facts or a person an answer mentions. We never send your account details, such as your email address
• Model training: Before 20 November 2026 we do not use your questions, answers or analytics to train AI models; from that date only our own checking models, on de-identified data, as described under How We Use Your Information (an organisation can opt out). Our AI provider account (OpenRouter) is set to exclude providers that train on request data. If you connect your own AI provider key, that provider's terms with you apply instead. The AI providers and Google receive them as described above, and their own data policies apply
• AI-generated content: Answers contain AI-generated responses that may reference real people, brands, or organizations. This content is generated by third-party AI models, not by us
• Data retention by AI providers: Third-party AI providers may retain prompt data according to their own data retention policies. We encourage you to review OpenRouter's and individual AI provider privacy policies for details

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last updated" date at the top
• We will notify you via email or an in-app notification at least 30 days before material changes take effect
• We will maintain an archive of previous versions available upon request

Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

• Privacy inquiries: hi@techshu.ai
• Grievance Officer (India's Digital Personal Data Protection Act 2023): Indranil Banerjee, Head of AI & Innovation, TechShu, at hi@techshu.ai with the subject "Grievance".
• General support: hi@techshu.ai
• Website: aeo.techshu.ai

If you are located in the EU/EEA and are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority. A list of EU data protection authorities can be found on the European Commission's website.