Privacy Policy

Overview

Promvia ("we", "us") helps website owners measure how much traffic and revenue AI assistants send their site, and whether AI recommends them. This policy explains what we collect and how we use it.

Information we collect

Account information you give us: your email address and a securely hashed password. Analytics data from the Promvia snippet you install on your own site: the referring AI source, the page path visited (query strings and fragments are removed before anything is stored), a pseudonymous visitor identifier (a keyed digest computed on our server — the raw browser id is never stored), and any conversion values you choose to send, labelled by a goal key you define. Goal keys are event identifiers (letters, digits and . _ : - only); anything shaped like an e-mail address or a URL is stored as 'other', and you must not put a person's name or other personal data in one — we cannot tell a name from an event name. We do not intentionally collect your visitors' names, emails, or other personal contact details; the snippet and its endpoints are built so that page URLs, referrers and visitor ids cannot carry them, and the goal key is the one field only you can keep clean. If you connect Google Analytics 4, we store an encrypted, read-only access grant and read aggregated daily figures from it — sessions, key events and purchase revenue per AI source — never individual visitors; disconnecting revokes the grant at Google and deletes those figures.

How we use information

To provide your dashboards and recommendations, operate and secure your account, and improve the service. We do not use your data for advertising.

Cookies

Promvia sets five cookies on this site and no others: one to keep you signed in, one that records nothing but the fact that you are signed in so a page can show the right menu without being rebuilt for you, one to remember your language, one for light or dark mode, and one that remembers whether you hid the dashboard's side menu. The last three are set only when you press the switch yourself, and connecting a Shopify store adds two short-lived security cookies for the length of that flow. There is no analytics, advertising or third-party cookie on this site, which is why you have not been asked to accept any — under the ePrivacy rules a strictly-necessary cookie and a preference you chose yourself do not need consent, and a banner for cookies we do not set would be theatre. The Promvia snippet on your own site sets a first-party visitor identifier so conversions can be attributed to the visit that drove them; it is not used for cross-site advertising or tracking.

Who is responsible for what

For your account — your email, your sites, your billing — Promvia is the data controller. For the visitor data our snippet collects on your website, you are the controller and Promvia is your processor: we hold and process it on your instructions and for your purposes, never our own. That distinction decides who answers if one of your visitors asks what is held about them — it is you, and we help you answer.

Where your data goes

Promvia runs in the EU and the database is EU-hosted, but several of the providers below are in the United States. Sending personal data there is a restricted transfer under EU law, and it happens on the basis of Standard Contractual Clauses or the EU–US Data Privacy Framework, depending on the provider. We name each provider rather than describing them generically so you can check that for yourself.

How we share information

We do not sell your data. We share it only with the service providers listed below, each under confidentiality obligations and only to the extent they need in order to run part of Promvia. If you enable live AI-citation checks, the search questions you choose to track are sent to the AI provider that runs them.

Service providers we use

Naming them, rather than describing them in general terms, is the point: you cannot judge how your data is handled without knowing who handles it.

• Vercel — application hosting. Sees requests to the app.
• Neon — the database. Holds your account, sites and analytics data.
• Upstash — rate limiting. Sees counters keyed to IP addresses, not content.
• Resend — transactional and digest email. Sees your email address and the message.
• Sentry (EU region) — error monitoring. Configured NOT to send IP addresses, cookies or request headers, and to redact email addresses out of error text.
• Stripe — payments, when a paid plan is used. Card details go to Stripe directly and never reach us.
• OpenAI, Anthropic, Google and Perplexity — the AI engines that answer your tracked questions. They receive the question, not your account.
• DataForSEO — Google AI Overviews and AI Mode results for your tracked questions.
• Telegram — operational alerts to us (signups, payments, failures). Deliberately carries counts and plan names only, never an email address or a name.

How long we keep things

Most of it lives as long as your account does — deleting a site removes that site's data, and deleting your account removes your information from active systems immediately. The parts that expire on their own schedule are listed here so you do not have to take a general promise on trust.

• Sign-in sessions — 30 days, then expired and cleared.
• Payment event records — 30 days (the invoice history itself stays with Stripe).
• AI crawler visits seen by our edge snippet — 180 days.
• AI crawler visits from your CDN logs and your own reports — 90 days. From a CDN log we keep only lines from AI crawlers, with the query string removed and without the IP address.
• GEO coaching plans — the most recent 12 per site.
• Analytics events, conversions, citation checks and audits — for as long as the site exists, and deleted with it.

Your rights

You can see, correct, export or delete your data yourself, without asking us. Settings has a one-click export of everything on your account as a JSON file, and a delete that removes it. You can also object to non-essential email with the unsubscribe link on any digest — that never affects the mail we must send you, such as password resets. If you would rather we did it, or you want to complain, email us; if you are in the EU or Türkiye you may also complain to your national data protection authority.

Security

We hash passwords, restrict access, and take reasonable measures to protect your data. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the current version; material changes will be communicated through the service.

Contact

Questions about your privacy? Email support@promvia.app.