Legal
Privacy Policy
What personal data Searchedly collects, why, who we share it with, how long we keep it and your rights.
Last updated
Draft pending legal review
This policy explains how Searchedly ("Searchedly", "we") handles personal data when you visit our websites, use the Searchedly service, or are mentioned in information we process. Contact us any time at privacy@searchedly.com.
Who is responsible
- We are the controller for account and billing information, website visitors, marketing, and public business information we gather for AI visibility reports.
- We are a processor for personal data our customers put into the service (for example their users' data passing through connectors). Our customers decide how that data is used; we follow their instructions under our Data Processing Addendum. If your data is in a customer's account, contact that customer first; we'll help them respond.
What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email, organization, role | You, or a teammate who invites you |
| Sign-in and security | Sign-in events, IP address, device and browser, session records | Automatically, through our sign-in provider |
| Activity in the product | Settings you change, actions recorded in your organization's audit log | Automatically |
| Communications | Emails we send you and their delivery status, support conversations | You and our email provider |
| Billing | Billing contact, plan, invoices. Card details are handled by Stripe, our payment provider, not stored by us | You and our payment provider |
| Customer Data | Product information, connector configuration, content you create | You (we act as processor) |
| Free reports | The website you ask about, your email address, whether you want tips by email, the report and its share links | You, when you ask for a free report |
| Public business information | Company websites, product pages, public documentation and what AI assistants say publicly about a company | Public sources, collected by our crawler SearchedlyBot |
| Website and cookies | Pages visited, essential cookies; analytics only with your consent | Automatically; see the Cookie Policy |
| Error diagnostics | Technical details when something breaks, with personal data removed where possible | Automatically |
We don't knowingly collect sensitive categories of personal data and ask customers not to submit them.
How we use it, and our legal bases
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Provide the service, sign you in, keep accounts secure | Performance of our contract with you or your organization |
| Send service emails (invitations, security alerts, receipts) | Contract; legitimate interests in operating the service |
| Prevent fraud and abuse, investigate security incidents, keep audit records | Legitimate interests; legal obligations |
| Fix errors and improve the service | Legitimate interests |
| Produce AI visibility reports from public business information | Legitimate interests (helping companies understand public AI answers about them) |
| Product updates and marketing emails | Consent or legitimate interests, with an unsubscribe link in every message |
| Send a free report you asked for, and keep it available to you | Your request (steps before a contract); legitimate interests |
| Stop automated abuse of free reports (a human check by Cloudflare Turnstile, rate limits) | Legitimate interests |
| Analytics cookies and measuring how visitors move from the free audit to an account | Consent |
| Billing, tax and accounting | Contract; legal obligations |
We don't use customer data or personal data to train AI models, and we don't make decisions with legal or similarly significant effects about people based solely on automated processing.
Who we share it with
- Service providers (subprocessors) who host, secure and run Searchedly for us, under contracts that limit their use of the data. The current list, with locations, is on our Subprocessors page.
- AI providers receive the questions we send them for visibility reports. These are about companies and products; we design them not to contain personal data.
- Your organization. Organization Owners and Admins can see members' names, emails, roles and audit-log activity.
- Legal and safety. When required by law, or to protect rights, safety and the security of the service.
- Business transfers. As part of a merger or acquisition, with notice to you.
We don't sell personal data and we don't share it for cross-context behavioural advertising. We honour browser Global Privacy Control signals as an opt-out of any such sharing and of non-essential cookies.
International transfers
We're based in the United States and our main systems run there. When we transfer personal data from the EU, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments) or another lawful mechanism, together with the safeguards on our Security page.
How long we keep it
| Data | Retention |
|---|---|
| Account and organization data | While your account is active. After an organization is closed: available to export for 30 days, deleted within 60 days, and removed from backups within a further 35 days |
| Audit log | For the life of the organization (it's tamper-evident, so entries can't be edited) |
| Email delivery log | 90 days |
| Invitations | 30 days after they expire or are cancelled; 90 days after they're accepted |
| Unsubscribes and bounced addresses | Kept so we can keep honouring them |
| Free reports and their share links | 90 days after you ask for them, or sooner if you ask us to delete them |
| Website analytics events | 395 days (they hold a random visitor ID, never your name, email or IP address) |
| Error diagnostics | Up to 90 days |
| Billing records | As long as tax and accounting laws require (usually 7 years) |
Security
We protect data with encryption in transit, extra encryption for secrets, strict separation between organizations, role-based access, audit logging and continuous security testing. Details are on our Security page. No system is perfectly secure; if a breach affects your personal data we'll notify you and regulators as the law requires.
Your rights
Depending on where you live (including the EU, UK, Switzerland, California and other US states), you can ask to:
- access or get a copy of your personal data;
- correct it;
- delete it;
- restrict or object to certain processing, including direct marketing;
- move it to another service (portability);
- withdraw consent at any time, without affecting earlier processing;
- opt out of sale or sharing (we don't do either) and limit use of sensitive data (we don't collect it).
Email privacy@searchedly.com from the address on your account. We'll verify your request, respond within 30 days (45 days where US state law allows, with notice if we need longer), and won't treat you differently for exercising your rights. You can use an authorized agent where the law allows. If we decline a request you can appeal by replying to our decision. You can also complain to your local data protection authority.
Children
Searchedly is a business service and isn't directed at children under 16. We don't knowingly collect their personal data; if you think we have, contact us and we'll delete it.
Changes
We'll post updates here with a new date, and email account Owners about material changes at least 30 days before they take effect.
Contact
Searchedly — privacy questions and requests: privacy@searchedly.com.