LEGAL

Privacy Policy

Last updated: 3 October 2026

This Privacy Policy explains how Aura AI Agents L.L.C-FZ ("Aura AI", "we", "us") collects, uses and protects personal data when you use Aura AI Visibility (the "Service"), available at www.aaivisibility.com. We are a Free Zone Limited Liability Company registered in the Meydan Free Zone, Dubai, United Arab Emirates (Commercial Licence No. 2647800.01), and the data controller for the data described here. You can reach us at support@aaivisibility.com.

1. Data we collect, and why

Scan input and the resulting report. The domain or URL you submit. A scan fetches only publicly accessible resources of that domain (the home page, robots.txt, llms.txt, sitemap and structured data). Every successful scan result is stored and published at a public, permanent address of the form /results/<domain>, together with a social preview image, so that it can be shared. Anyone who knows the address can view that report. Results pages are markednoindex so search engines are asked not to list them. A report is refreshed at most once a day and only the newest report per domain is retained.
Contact details. Your email address when you ask for an emailed copy of a report, request access to a paid tier, or use the contact form — together with the scanned domain, the nature of your request and, for the contact form, your message. Your message is relayed to our support mailbox and is not stored in our database.
Technical data. Your IP address and basic request metadata. We use the IP address for rate limiting and abuse prevention, and we also store it alongside each lead or contact record and include it in the internal notification email so that we can investigate abuse of the forms.
Share activity. When a report is shared or a visitor arrives from a shared link, we record the scanned domain and the channel used (copy link, LinkedIn, X, email). This is aggregate product analytics keyed by domain; it is not tied to your email address.
Campaign attribution. When you arrive through one of our own campaign links or adverts, the link carries campaign labels (utm_ parameters) and, for an advert, the click identifier the advertising platform appended. We keep those in a first-party cookie for 90 days (see the Cookie Policy) and record the campaign labels against a completed scan, a sign-up, the start of a free trial or a subscription, so we can tell which campaigns work. The record of a scan or sign-up holds the campaign labels and the scanned domain, never your email or the click identifier. The record of a subscription, kept with it and in Stripe, also holds the click identifier, so that we can report that subscription back to the advertising platform. If you are in the EEA, the United Kingdom or Switzerland, a banner asks first: the cookie is set and the click identifier recorded only if you accept. If you decline or do not answer, we record only the campaign labels of the page you are on when you scan, sign up or subscribe. The record of a subscription also notes whether you had accepted, declined or not answered, or were outside those countries.
Monitor subscribers. Your email address, the domains on your subscription, any competitor domains you ask us to track, and the weekly scan history, drift alerts and sampling results we produce for those domains. When you sign in, we set a signed session cookie that contains your email address and the domains you may view (see the Cookie Policy).
Server access logs you send us (Monitor and Agency). If you use AI-crawler traffic analytics, you send us batches of your own server access-log lines. We keep only lines whose user agent is a recognised crawler; lines from human visitors are discarded on receipt and never stored. For those logs you are the controller and we act as your processor under the Terms of Service.
Payment data. Payments are processed by Stripe. We never receive or store card details; we receive the subscription status, the email address you gave Stripe and the domain you asked us to monitor.

2. How we use your data

To run the scan you requested, show you the report and publish it at its permanent address.
To send you the report copy and the one follow-up we promise when you ask for one.
To provide the Monitor and Agency services: weekly scans, alerts, digests, sampling and dashboards.
To answer contact-form messages and support requests.
To operate, secure and improve the Service, including preventing abuse of the scanner and the forms.
To measure our own marketing: which campaign a scan, a sign-up, a free trial or a subscription came from. If you subscribed after clicking a Google Ads or Microsoft Advertising advert, we may report that subscription to that platform using only the click identifier it attached to the link, the time and the plan price; a free trial is reported only once it becomes a paid subscription. If you are in the EEA, the United Kingdom or Switzerland, this happens only if you accepted the consent banner, and the report to Google says that you consented to your click being used to measure the advert and did not consent to ad personalisation. We never send the platform your email address, your name or the domain you monitor.
We do not sell personal data, we do not use your email address for advertising, and we do not build advertising audiences from your data.

3. Legal bases

We process your data to perform the service you request (running scans, providing reports and subscriptions, answering your messages), on the basis of our legitimate interest in securing and improving the Service, and with your consent where you provide your email for follow-up. You may withdraw consent at any time by replying to any email we send or by writing to support@aaivisibility.com.

For visitors in the EEA, the United Kingdom and Switzerland, campaign attribution with the advertising click identifier relies on the consent you give through the banner. You can withdraw it at any time on the Cookie Policy page, which deletes the attribution cookie straight away. Withdrawing does not reach a click identifier already recorded with a subscription you took out while consent was given; write to support@aaivisibility.com and we will remove it.

4. Who we share data with

We share data only with the service providers needed to run the Service, each bound by its own data protection terms:

Vercel — hosting, serverless compute and edge network.
Supabase — the database that stores leads, subscriptions, scan history and results.
Upstash — a fallback store used if the database is unavailable.
Stripe — subscription payments. When you arrived through one of our campaign links, the checkout also carries its campaign labels, the advertising click identifier (in the EEA, the United Kingdom and Switzerland only if you accepted the consent banner) and your consent answer, which Stripe keeps with the subscription.
GoDaddy (Microsoft 365 email) and Resend — delivery of the emails we send you.
AI engine providers (OpenAI, Anthropic, Perplexity, Google) — only for Monitor sampling, where we send the prompts derived from your public site content; we never send your email address or account data to them.
Google Ads and Microsoft Advertising — only when you subscribed after clicking one of our adverts on that platform, and only the click identifier that platform attached to the link, the time the subscription became paid and the plan price, so the platform can count the subscription against the advert. No email address, name or domain is sent.

We may also disclose data where required by law or to protect our legal rights.

5. Retention

Scan results: the newest report per domain is kept indefinitely so shared links keep working; it is replaced whenever the domain is scanned again.
Leads and contact records: 24 months from the last interaction, then deleted, unless you ask us to delete them earlier.
Monitor data: for the life of the subscription and 12 months afterwards, so that a lapsed customer can resume with history intact.
Server access logs you send us: the most recent 500 batches per domain; older batches are discarded automatically.
Share and campaign activity: the most recent 5,000 events in total; older events are discarded automatically. The attribution cookie itself expires after 90 days. Subscription-level campaign records are kept with the subscription; the record used to report a subscription to an advertising platform keeps the most recent 2,000 subscriptions.
Sessions: the sign-in cookie expires after 30 days and is rejected by our servers after that regardless of your browser.

6. Your rights

Subject to applicable law (including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data), you may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. Use the Contact page with the "Privacy / data request" topic, or email support@aaivisibility.com. We will confirm your identity by replying to the address the data is tied to, and act within 30 days. If you own a domain and want its public results page removed, tell us the domain and we will delete the stored report.

7. Security

We apply technical and organisational measures appropriate to the risk, including transport encryption (HTTPS with HSTS), a strict content security policy, signed session cookies, access controls on the database and secrets held only in the hosting environment. No method of transmission or storage is completely secure.

8. International transfers

The Service is operated from the United Arab Emirates and hosted on infrastructure in the United States and other jurisdictions. Where data is transferred internationally, we take steps to ensure it remains protected consistently with this policy.

9. Children

The Service is not directed at children under 18, and we do not knowingly collect their data.

10. Changes

We may update this policy from time to time. The "Last updated" date above reflects the current version; material changes will be highlighted on this page.

11. Contact

Aura AI Agents L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. — support@aaivisibility.com — or via the Contact page.