Privacy Policy

Overview

Promvia ("we", "us") helps website owners measure how much traffic and revenue AI assistants send their site, and whether AI recommends them. This policy explains what we collect and how we use it.

Information we collect

Account information you give us: your email address and a securely hashed password. Analytics data from the Promvia snippet you install on your own site: the referring AI source, the page URL visited, an anonymous visitor identifier, and any conversion values you choose to send. We do not collect your visitors' names, emails, or other personal contact details.

How we use information

To provide your dashboards and recommendations, operate and secure your account, and improve the service. We do not use your data for advertising.

Cookies

Promvia sets three cookies and no others: one to keep you signed in, one to remember your language, and one for light or dark mode. The last two are set only when you press the switch yourself. There is no analytics, advertising or third-party cookie on this site, which is why you have not been asked to accept any — under the ePrivacy rules a strictly-necessary cookie and a preference you chose yourself do not need consent, and a banner for cookies we do not set would be theatre. The Promvia snippet on your own site sets a first-party visitor identifier so conversions can be attributed to the visit that drove them; it is not used for cross-site advertising or tracking.

Who is responsible for what

For your account — your email, your sites, your billing — Promvia is the data controller. For the visitor data our snippet collects on your website, you are the controller and Promvia is your processor: we hold and process it on your instructions and for your purposes, never our own. That distinction decides who answers if one of your visitors asks what is held about them — it is you, and we help you answer.

Where your data goes

Promvia runs in the EU and the database is EU-hosted, but several of the providers below are in the United States. Sending personal data there is a restricted transfer under EU law, and it happens on the basis of Standard Contractual Clauses or the EU–US Data Privacy Framework, depending on the provider. We name each provider rather than describing them generically so you can check that for yourself.

How we share information

We do not sell your data. We share it only with the service providers listed below, each under confidentiality obligations and only to the extent they need in order to run part of Promvia. If you enable live AI-citation checks, the search queries you choose to track are sent to the AI provider that runs them.

Service providers we use

Naming them, rather than describing them in general terms, is the point: you cannot judge how your data is handled without knowing who handles it.

• Vercel — application hosting. Sees requests to the app.
• Neon — the database. Holds your account, sites and analytics data.
• Upstash — rate limiting. Sees counters keyed to IP addresses, not content.
• Resend — transactional and digest email. Sees your email address and the message.
• Sentry (EU region) — error monitoring. Configured NOT to send IP addresses, cookies or request headers, and to redact email addresses out of error text.
• Stripe — payments, when a paid plan is used. Card details go to Stripe directly and never reach us.
• OpenAI, Anthropic, Google and Perplexity — the AI engines that answer your tracked queries. They receive the query, not your account.
• DataForSEO — Google AI Overviews, AI Mode and Bing results for your tracked queries.
• Telegram — operational alerts to us (signups, payments, failures). Deliberately carries counts and plan names only, never an email address or a name.

How long we keep things

Most of it lives as long as your account does — deleting a site removes that site's data, and deleting your account removes your information from active systems immediately. The parts that expire on their own schedule are listed here so you do not have to take a general promise on trust.

• Sign-in sessions — 30 days, then expired and cleared.
• Payment event records — 30 days (the invoice history itself stays with Stripe).
• AI crawler visits — 180 days.
• GEO coaching plans — the most recent 12 per site.
• Analytics events, conversions, citation checks and audits — for as long as the site exists, and deleted with it.

Your rights

You can see, correct, export or delete your data yourself, without asking us. Settings has a one-click export of everything on your account as a JSON file, and a delete that removes it. You can also object to non-essential email with the unsubscribe link on any digest — that never affects the mail we must send you, such as password resets. If you would rather we did it, or you want to complain, email us; if you are in the EU or Türkiye you may also complain to your national data protection authority.

Security

We hash passwords, restrict access, and take reasonable measures to protect your data. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the current version; material changes will be communicated through the service.

Contact

Questions about your privacy? Email support@promvia.app.