Privacy Policy

1. Data controller

Searchalong AI (“we”, “us”) is the data controller for personal data processed through this platform, operated at https://searchalong.xyz. Contact for privacy questions and data-subject requests: privacy@searchalong.xyz.

2. Data we collect

• Account data · email address, display name, password hash, organization name. Provided by you at signup.
• Workspace telemetry · the domains, prompts, engine responses, and citation records you generate. Stored so we can render your dashboards and compute your score deltas.
• Billing metadata · Stripe customer id, subscription plan, invoice status. Card details are held by Stripe; we never receive or store them.
• Server logs · IP address, user agent, request path, timestamp. Retained 30 days for security and abuse triage, then deleted.
• Cookies · one first-party session cookie for sign-in, one optional referral cookie (sa_ref) if you arrived via a shared link. No third-party advertising or cross-site tracking cookies.

3. Legal bases for processing (GDPR)

• Contract · account data and workspace telemetry, to deliver the service you subscribed to.
• Legitimate interest · server logs for fraud and abuse prevention, aggregate product improvement.
• Consent · optional marketing email. You can opt out at any time via the link in every message.
• Legal obligation · billing records retained for tax and audit compliance where required.

4. How we use your data

• Operate the tracking pipeline and render your workspace.
• Send transactional email (magic-link sign-in, billing receipts, weekly delta reports if you opted in).
• Respond to your support requests.
• Detect and prevent abuse of the platform.
• Comply with tax, accounting, and other legal obligations.

We do not sell your personal data. We do not use your workspace content to train third-party AI models. Aggregate, de-identified metrics may inform internal product decisions.

5. Sub-processors

We use the following third-party providers to deliver the service. Each is bound by written data-processing terms:

• Supabase · database + authentication (US region)
• Vercel · hosting + edge network (US region)
• Stripe · billing and payment processing
• Resend · transactional email delivery
• OpenRouter · unified AI engine routing (US region)
• OpenAI, Anthropic, Perplexity, Google, Groq · AI engines queried on your behalf. Prompts are transmitted at query time and not retained by these providers for training when accessed through their commercial APIs.
• Serper · Google search API for citation crawling

When we add or replace a sub-processor materially, we update this list and notify active customers by email at least 15 days in advance.

6. International data transfers

Our primary infrastructure runs in the United States. If you access the service from outside the US, your data will be transferred to and processed in the US. For customers subject to GDPR or UK GDPR, transfers rely on Standard Contractual Clauses (SCCs) with our sub-processors and, where applicable, the EU-US Data Privacy Framework.

7. Data retention

• Active account data · retained for the life of the account.
• Workspace telemetry · retained for 24 months of rolling history, then aggregated and personal identifiers removed.
• Server logs · 30 days.
• Billing records · 7 years, as required by US tax law.
• Deleted-account remnants · fully purged within 30 days of your deletion request, except billing records retained for tax compliance.

8. Your rights

Regardless of jurisdiction, you have the following rights over your personal data. Email privacy@searchalong.xyz to exercise any of them; we respond within 30 days:

• Access · request a copy of the personal data we hold about you.
• Rectification · correct inaccurate data.
• Erasure · request deletion of your account and associated data (subject to legal-retention exceptions).
• Portability · export your workspace data in a machine-readable format (JSON).
• Restriction and objection · limit or object to specific processing activities.
• Withdrawal of consent · for processing based on consent, at any time.
• Complaint · lodge a complaint with your local data-protection authority.

California residents (CCPA/CPRA) · you additionally have the right to know what personal data we collect and disclose, to opt out of any sale or sharing (we do not sell or share personal data), and to non-discrimination in service for exercising these rights.

9. Children

Searchalong AI is intended for business users. We do not knowingly collect data from anyone under 16. If we learn we have collected data from a minor, we delete it promptly.

10. Security

We use industry-standard controls to protect your data · encryption in transit (TLS 1.3), encryption at rest, row-level-security policies on the database, single-tenant workspace isolation, service-role-only writes for privileged operations, secret rotation on key exposure. No system is unbreakable · if you find a security issue, please email privacy@searchalong.xyz.

11. Breach notification

If we determine that a breach affecting your personal data has occurred, we notify affected users and, where required, supervisory authorities within 72 hours of confirmation.

12. Changes to this policy

When this policy changes we update the timestamp at the top. For material changes we notify active users by email at least 15 days before the change takes effect, and archive the prior version at https://searchalong.xyz/privacy/history.

13. Contact

Privacy inquiries and data-subject requests · privacy@searchalong.xyz. General support · hello@searchalong.xyz.