Privacy Policy

This Policy applies to visitors, account holders, organization administrators, invited users, prospects, and other people whose personal information Prime processes in connection with the Service. It does not govern a third party’s independent services, websites, or privacy practices.

Business customers control their organization, members, workspaces, submitted domains, questions, connected accounts, and exports. Organization administrators may access and manage information in their organization. Where Prime processes personal information on a customer’s documented instructions, the customer may be the relevant controller or business and Prime its service provider or processor. A signed data processing addendum controls if it applies.

Account and organization information

• name, work email address, account identifier, authentication status, and profile details;
• organization, role, membership, invitation, administrator, workspace, and client-account details; and
• support requests, survey responses, feedback, and other communications.

Customer Content and research information

• brands, domains, URLs, public webpage content, competitors, products, markets, audiences, personas, goals, and positioning;
• questions, prompts, search settings, schedules, provider selections, and customer instructions;
• AI-assisted answers, citations, sources, scores, sentiment, recommendations, discovery candidates, and observation dates; and
• generated drafts, images, content plans, reports, exports, review decisions, and saved results.

Connected services and billing

• Google Search Console property, query, page, click, impression, position, authorization, and encrypted connection-token information when a customer connects it;
• DataForSEO research results and source information used for question discovery;
• subscription, plan, invoice, transaction, credit, refund, dispute, billing-customer, and payment-status information from Stripe; and
• integration settings and identifiers needed to maintain or disconnect a connected service.

Prime does not receive or store full payment-card numbers. Stripe collects and processes payment credentials under its own privacy terms.

Device, usage, and cookie information

• IP address, browser and device type, operating system, referrer, approximate location, and request timestamps;
• pages, buttons, forms, sign-up and checkout events, feature usage, and cookie-consent choices; and
• application, audit, security, diagnostic, job, delivery, and error logs.

We receive information directly from users and organization administrators; automatically from browsers, devices, and use of the Service; from connected services such as Google Search Console and Stripe; from vendors performing requested research; and from public sources such as submitted websites, sitemaps, search results, and webpages. Agencies and customers may also provide information about authorized client organizations and their users.

Prime uses information to:

• create, authenticate, administer, and support accounts and organizations;
• research submitted websites and topics, discover questions, run requested or scheduled checks, and save results;
• generate reports, recommendations, drafts, images, and exports a customer requests;
• connect and maintain optional integrations;
• provide plans and credits, process payments, prevent duplicate charges, and manage cancellations, refunds, and disputes;
• send transactional, security, support, billing, product, and legally required communications;
• monitor performance, troubleshoot failures, secure the Service, prevent fraud and abuse, and enforce our Terms;
• understand feature use and improve the Service using feedback and aggregated or de-identified information; and
• comply with law, legal process, audits, tax and accounting duties, and protect rights, safety, and property.

Where applicable law requires a legal basis, we rely on performance of a contract, legitimate interests in operating and securing a business service, compliance with legal obligations, and consent for optional cookies or connected services. Consent may be withdrawn as described in Section 11 without affecting earlier lawful processing.

To perform a check or create requested material, Prime may send the question, search settings, relevant brand or website context, and customer instructions to the selected AI or search provider. The provider returns an answer, citations, sources, or generated material that Prime stores and analyzes for the customer. Results can vary by provider, time, wording, market, device, and provider account state.

Depending on the feature, information sent to an AI provider may include a buyer question, customer-selected persona and market context, public brand and domain information, source URLs or excerpts, saved answer evidence, content instructions, or an image prompt. Prime does not intentionally send account passwords, payment-card data, or Google OAuth tokens to AI providers.

Prime may retrieve publicly available pages, sitemaps, search results, and indexed citations to research a customer’s brand, competitors, or topics. Public pages may contain personal information; public availability does not eliminate applicable privacy rights or transfer ownership. Customers must not submit credentials, protected health information, children’s data, payment card data, government identifiers, or other regulated or highly sensitive information unless a separate written agreement permits it.

Prime does not sell customer prompt sets, citation results, or generated drafts to AI providers. Inputs and outputs sent through a provider API are processed under the applicable provider terms, enterprise settings, and retention practices. Prime does not operate or train a general-purpose foundation model on Customer Content.

For DataForSEO discovery, Prime sends the submitted public domain and standard discovery settings. DataForSEO may return candidate questions, cited-source URLs, titles or snippets, volume estimates, platform information, and observation dates. Prime does not send Google Search Console tokens or a customer’s full private workspace to DataForSEO.

Google Search Console Limited Use

Connecting Google Search Console is optional. Prime requests only the read-only webmasters.readonly scope. After authorization, Prime accesses the selected property and approximately 90 days of Search Analytics data, generally ending three days before the request. This data may include query text, page URL, clicks, impressions, and average position. Prime uses it only to provide question-discovery candidates and first-party search evidence in the customer’s workspace.

Prime stores the selected property and domain, granted scope, connection status, synchronization timestamps, and an encrypted refresh token. Access tokens are used transiently and are not stored in Prime’s database. Query and page evidence returned to an unsaved discovery queue is scheduled to expire after about 24 hours. Questions a customer chooses to save become ordinary workspace data.

Disconnecting Search Console in Prime removes the stored refresh token and stops future reads but does not itself revoke the authorization in the customer’s Google Account. Customers may separately remove Prime from their Google Account permissions. Prime does not sell Google user data, use it for advertising, or disclose it except to processors needed to host and provide the feature, with the user’s direction, or as required by law. Human access is limited to user-requested support, security or abuse investigation, or legal requirements.

Prime AI Visibility’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Prime discloses information only as reasonably needed for the purposes described in this Policy, including to these categories of recipients:

• Authentication and organization management: Clerk.
• Payments and billing: Stripe.
• Hosting and database infrastructure: Vercel and Supabase.
• AI and search processing: providers selected or enabled for a check or content request, which may include OpenAI, Perplexity, Anthropic, and Google.
• Question and citation discovery: DataForSEO and public web sources.
• Connected search performance: Google Search Console when a customer authorizes the connection.
• Communications and internal operations: customer-email providers; Slack may process limited signup and billing activity in a restricted internal channel, including name, work email, account identifier, workspace, plan or credit purchase, payment amount, and transaction reference.
• Consent, analytics, and marketing: Termly and Google Tag Manager; the marketing site currently uses Google Analytics and consent-gated StackAdapt measurement and advertising tags.
• Professional and legal recipients: auditors, insurers, advisers, authorities, or counterparties when reasonably necessary for compliance, claims, security, or a business transaction.

Vendors may process information only for the service they provide to Prime or under their separately disclosed terms when a customer directs the integration. The vendor list may change as the Service changes. Contact us for current subprocessor information or a data processing addendum.

Prime uses essential cookies and browser storage for Clerk authentication and security, Termly consent preferences, the selected Prime workspace, short-lived Google Search Console OAuth verification, verified Stripe checkout returns, and same-browser recovery of drafts and checks. The active-workspace cookie may remain for up to one year, the Google OAuth nonce for up to ten minutes, and the Stripe purchase-session cookie for up to 30 minutes. Session storage generally lasts for the browser or tab session; local storage remains until Prime or the user’s browser removes it.

Where the consent banner offers optional categories, analytics or advertising technologies load only according to the choices recorded through Termly. Google Analytics may receive page and interaction information, signup or login event categories, and purchase metadata such as transaction identifier, value, currency, and plan or product details. Prime does not intentionally include an account email or private Customer Content in those analytics events. On the marketing site, StackAdapt may receive technical, campaign, page, retargeting, and conversion information after the applicable consent. Under some privacy laws, consented advertising or cross-context analytics may be described as “sale,” “sharing,” or targeted advertising even when no money changes hands.

Prime does not disclose Customer Content or private account-workspace data to advertising networks for their targeted advertising. Visitors can reject optional cookies or reopen cookie preferences from the consent controls. Browser blocking may also be available, but can affect site functionality. The website’s cookie banner and this Policy should be read together.

Prime may create statistics that are aggregated or de-identified so they do not reasonably identify a person, customer, confidential question set, or client workspace. Prime may use those statistics to operate, secure, benchmark, explain, and improve the Service. We do not attempt to re-identify information maintained as de-identified except to test whether de-identification works or as law permits.

Prime retains account, workspace, research, result, and content data while the account is active and as reasonably needed to provide the Service. Unsaved question-discovery request queues and candidates are ordinarily configured to expire after about 24 hours. Google Search Console refresh tokens are retained until the connection is removed, Prime completes a verified deletion request, or the token is no longer needed. Billing, tax, fraud, audit, security, dispute, and transaction records may be kept longer when required for legitimate business or legal purposes.

Retention periods depend on the information’s purpose, sensitivity, contractual commitments, customer instructions, legal requirements, backup cycles, and risk of harm. After a valid deletion request or termination, Prime deletes or de-identifies information that is no longer required, subject to legal holds, fraud and security records, financial-record obligations, and temporary backup retention.

Deleting an identity-provider account does not necessarily delete the corresponding Prime organization or workspace records automatically. Contact Prime for a verified account or workspace deletion request.

Prime uses reasonable administrative, technical, and organizational safeguards designed to protect information. These include access controls, scoped organization permissions, encrypted transport, protected production credentials, and encryption for stored Google Search Console refresh tokens. No internet service or storage system can guarantee absolute security. Customers are responsible for safeguarding credentials, assigning appropriate administrators, and promptly reporting suspected misuse.

Depending on your location and relationship with Prime, you may:

• review or correct profile and organization information through the Service;
• export available reports and workspace data;
• disconnect Google Search Console in Settings;
• manage optional cookies through the consent preferences;
• unsubscribe from optional marketing email using its unsubscribe control;
• request access, correction, deletion, restriction, portability, or information about disclosures;
• object to or opt out of processing described by applicable law as sale, sharing, targeted advertising, or certain profiling; and
• withdraw consent or appeal a denied privacy request where applicable law provides that right.

Submit a request to hello@percepture.com with the subject “Privacy Request.” We may need to verify identity, account authority, and jurisdiction. An authorized agent may submit a request where permitted, subject to verification. We respond within the time and in the manner required by applicable law. Prime will not discriminate for exercising an applicable privacy right.

If Customer is your employer or organization, it may need to handle requests about workspace information that it controls. People in the European Economic Area, United Kingdom, or Switzerland may also have a right to complain to their local data-protection authority.

Prime does not use personal information to make solely automated decisions that produce legal or similarly significant effects.

Prime and its providers primarily operate from the United States and may process information in the United States and other countries. Those countries may have different data-protection laws. Where applicable law requires a transfer mechanism, Prime will use a recognized lawful mechanism for the transfer or rely on another permitted basis and will honor applicable customer data processing terms.

The Service is intended for business users who are at least 18. It is not directed to children, and Prime does not knowingly collect personal information from children through the Service. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.

Prime is not designed to process protected health information, payment-card numbers, government identifiers, biometric templates, precise geolocation, or other regulated or highly sensitive data in Customer Content unless a separate written agreement expressly authorizes that processing.

Prime may preserve or disclose information when reasonably necessary to comply with law or legal process; respond to lawful requests; protect customers, providers, Prime, or the public; investigate fraud, abuse, or security events; enforce agreements; or establish, exercise, or defend legal claims.

Information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality and any notice or choice required by law.

Prime may update this Policy prospectively as the Service, vendors, or law changes. The current version and effective date appear at the top. For a material change, Prime will provide notice through the Service, by email, or by another reasonable method and will request consent where required. Earlier versions remain available at their versioned URLs.

Prime AI Visibility is operated by Percepture, Inc.

Legal questions may be sent to hello@percepture.com with the subject “Legal Notice.” See the Terms of Service.