Privacy Policy

1. Who we are

Vettaly is operated by Panorai LLC ("we", "us"). We are the controller of the personal data described in this policy. Questions and requests go to [email protected].

2. What we collect

• Account data: your name, email address and a hashed password, plus the organizations you belong to and your role in them.
• What you add to the service: site URLs, keywords, competitors, settings, and the status you give to findings and opportunities.
• Google data, only if you connect it: Search Console search performance (read-only) and Google Analytics 4 traffic sources (read-only), together with the OAuth tokens needed to fetch them.
• Files you upload, such as server access logs or Bing Webmaster Tools exports. We parse them and keep only daily counts per AI engine and page; the raw file is not stored.
• Public web content: the pages our crawler fetches when you run an audit. If those pages contain personal data, it is processed as part of the report.
• Billing data: Stripe handles payment. We receive a customer ID, subscription status and purchase records, never your card details.
• Technical data: guest checks are rate-limited by IP address, held in memory for the day and not written to our database. Our hosting provider keeps standard server logs.

3. Cookies and local storage

We set a session cookie that keeps you signed in. If you accept analytics cookies in the banner, we also use Google Analytics, which sets its own cookies, to understand how the site is used: pages visited, referring site, device and approximate location. Until you accept, Google Analytics is not loaded at all, and you can change your choice at any time under "Cookie settings" at the bottom of the page. Access tokens in share, trial and client-dashboard links are removed from page addresses before anything is sent. Your browser's local storage remembers your light/dark theme and, briefly, a guest report you are about to claim. We use no advertising cookies. Stripe sets its own cookies on its checkout pages.

4. How we use it

• To run the service: crawl and score pages, track rankings, fetch backlink and keyword data, and show you the results.
• To bill you and manage your plan, credits and quotas.
• To send the emails you would expect: weekly and monthly reports, alerts you turned on, and service notices.
• To prevent abuse and keep the service secure.
• To improve opportunity scoring: we count how each type of opportunity turned out across all customers. Only per-type statistics are kept, never any single customer's data.

We do not sell your personal data, show ads, or use your data to train AI models.

5. Legal bases

Where the GDPR or similar laws apply, we rely on: performing our contract with you (running the service and billing), our legitimate interests (security, abuse prevention, aggregate statistics), your consent (connecting Google accounts, which you can withdraw at any time), and legal obligations (tax and accounting records).

6. Google user data

Vettaly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We request read-only access: https://www.googleapis.com/auth/webmasters.readonly and https://www.googleapis.com/auth/analytics.readonly.
• Google data is used only to show you your own search and traffic data and to build features you request from it, such as opportunities, reports and content briefs.
• It is not sold, not used for advertising, and not used to develop or train generalized AI or machine-learning models.
• People at our company do not read it unless you ask us to, it is needed for security or abuse investigation, or the law requires it.
• You can disconnect at any time at https://myaccount.google.com/permissions. Ask us and we will also delete the data already fetched.

7. Who we share it with

We use the following service providers, each only for the purpose listed:

• Hosting provider: runs our servers and stores our database.
• Stripe: payment processing. Purchases are made through Stripe as merchant of record (see the Terms of Service), so Stripe also receives your billing details and handles tax.
• Anthropic: generates AI suggestions and content briefs when you start them. The relevant page content and findings are sent with the request.
• DataForSEO and SerpApi: return rankings, backlink, keyword and trend data for the domains and keywords you query.
• Google: Search Console and Analytics data when you connect them.
• Resend: delivers our emails, so it receives your email address and the email content.
• Google Analytics: measures how the site is used, as described under Cookies and local storage.

We may also disclose data if the law requires it, to protect our rights or users, or to a successor if the business is sold or merged.

8. International transfers

Our providers may process data outside your country, including in the United States. Where required, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.

9. How long we keep it

• Guest reports: deleted after 24 hours.
• Audit reports: kept according to your plan (the Free plan keeps the most recent 3), until you delete them or close your account.
• Account data: for as long as your account exists. After you ask us to delete your account, we delete it within 30 days, apart from what we must keep by law, such as billing records.
• Shared third-party lookups, such as a domain's backlinks: cached for a limited time and shared between customers, because they describe public websites rather than you.

10. Security

Passwords are stored as hashes, traffic is encrypted in transit, and access to production data is limited to the people who need it to run the service. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

11. Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, and to object to or restrict how we use it. Email [email protected] from the address on your account and we will respond within 30 days. You can also complain to your local data protection authority.

12. Children

Vettaly is a business tool and is not intended for anyone under 16. We do not knowingly collect children's data.

13. Changes

If we change this policy in a way that matters, we will update the date above and notify account holders by email or in the app before the change takes effect.