Privacy Policy

Effective date: September 8, 2026

This Privacy Policy explains how Alzaro AI (“Alzaro AI”, “we”, “us”) collects, uses, shares and protects personal data when you visit alzaro.app, create an account, use the Alzaro AI web workspace, mobile app or API, or interact with a website that embeds our AI-crawler tracking pixel. It also describes the choices and rights you have over that data.

Alzaro AI is an AI-search visibility platform. Customers tell us which brands, competitors and buyer questions (“prompts”) they want to track; we send those prompts to third-party AI answer engines through their official APIs, analyse the answers for mentions and citations, and report the results. Understanding that flow is the key to understanding this policy.

1. Who is responsible for your data

Alzaro AI is the controller of personal data processed through alzaro.app. Where a customer uploads data about their own clients, staff or website visitors into a workspace, that customer is the controller and we process it on their behalf under the Terms of Service. Questions about this policy can be sent to [email protected].

2. Data we collect

2.1 Account and team data

• Sign-up details: name, email address and a password, which we store only as a salted hash and never in plain text.
• Organisation details: the agency or company name, workspace slug, plan, roles of each team member and pending team invitations (invitee email and an invitation token that expires after 14 days).
• Preferences: language, notification and alert settings, report schedules and recipients.

2.2 Workspace content you provide

• Brand profiles: brand names, websites, descriptions, product categories and target markets.
• Competitors and prompts: the competitor names and the questions you ask us to measure.
• Uploaded documents: if you use the assisted setup feature, the brand documents (PDF, text or similar) you upload so that the platform can draft a brand profile, prompts and competitor list for you. Originals are kept only as long as the retention period configured by the operator and then deleted.
• Provider API keys: if you choose to bring your own keys for an AI provider, we store them encrypted at rest and use them only to run your measurements. We never display a stored key back to you in full.

2.3 Measurement data we generate

• The full text of AI answers returned for your prompts, the engine and model that produced them, timestamps, and the mentions, citations and scores we extract from them.
• Recommendations, AI-readiness audit results for the websites you ask us to check, and the reports we generate from that data.
• A credit ledger recording every credit added to or spent from your organisation’s balance, including the reason and the related run or purchase.

2.4 Billing data

Credit packs and subscriptions are paid through Stripe, an independent payment processor. Card numbers and bank details are entered on the hosted checkout page of Stripe and are never sent to or stored on our servers. We receive and keep a transaction reference, the amount, currency, status, the credits granted and the billing email, which we need to grant credits, issue receipts and resolve disputes.

2.5 Technical and usage data

• Server logs: IP address, browser and device type, referring page, pages requested, time of the request and any error that occurred. Logs are used for security, capacity planning and debugging and are rotated on a fixed schedule.
• Security records: failed sign-in attempts (rate-limited by email address and IP), password-reset requests and, for platform operators, an access log of every administrative action taken on a customer account.
• Mobile app and API tokens: when you sign in from the Alzaro AI mobile app or use the API, we issue a personal access token named after your device so you can see and revoke it later.
• Support conversations: if the operator has enabled an in-app support widget, messages you send through it are handled by that support provider under its own privacy terms.

2.6 Data from the AI-crawler tracking pixel

Customers can embed a one-pixel image served from alzaro.app on their own websites to learn which AI crawlers (for example GPTBot, ClaudeBot or PerplexityBot) visit those pages. When the pixel is loaded we look at the user-agent string only. If it identifies a known AI crawler we record the crawler name, its vendor, the referring page, the time of the visit and a one-way SHA-256 hash of the IP address. We do not store the raw IP address, do not set cookies through the pixel and do not record ordinary human visitors. The customer who embeds the pixel is responsible for disclosing it in their own privacy notice where required.

3. How we use data

• To create and secure your account, authenticate you and enforce role-based access within your organisation.
• To run the measurements you request: sending your prompts to the AI engines you selected, parsing the responses and calculating share of voice, mentions and citations.
• To draft brand profiles, prompt sets and competitor lists when you ask the assisted setup feature to do so.
• To meter usage, deduct credits, process purchases and subscriptions, send receipts and prevent fraud or abuse.
• To send transactional email: welcome messages, team invitations, password resets, alert notifications and finished-report notices. We do not send marketing email without your consent.
• To generate the reports and dashboards you and your team view or download.
• To monitor performance, diagnose problems and keep the platform secure.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, and we do not use your workspace content, prompts or AI answers to train any machine-learning model.

4. Legal bases (EEA, UK and similar jurisdictions)

Where data-protection law requires a legal basis, we rely on: performance of a contract for account, workspace, measurement and billing data; legitimate interests for security logging, fraud prevention, product analytics and service communications, balanced against your rights; legal obligation for tax and accounting records; and consent for any optional marketing communications, which you can withdraw at any time.

5. Who we share data with

RecipientWhat is sharedWhy
| AI answer-engine providers (Anthropic, DeepSeek, Google (Gemini), OpenAI, Perplexity, SerpApi, xAI (Grok))  | The text of the prompts you ask us to measure, together with the brand and competitor names those prompts reference. Prompts are sent from our servers; your account details are not included.  | Producing the AI answers that the platform measures. Each provider processes prompts under its own API terms and privacy policy. Do not put personal data about third parties into a prompt.
| Stripe  | Billing email, amount, currency and transaction identifiers. Payment card details go directly to the processor.  | Processing credit purchases and subscriptions.
| Email delivery provider  | Recipient address and the content of transactional messages.  | Delivering account, alert and report email.
| Hosting and infrastructure providers  | All data stored on the platform, encrypted in transit and at rest where supported.  | Operating the servers, databases, queues and backups that run Alzaro AI.
| Your own team  | Workspace content, measurements and reports for the brands you can access.  | Collaboration within the organisation that owns the workspace, according to the roles set by its owner.
| Authorities and advisers  | Only what is required.  | Complying with law, responding to lawful requests, or defending legal claims.

If Alzaro AI is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6. International transfers

The AI providers and other processors listed above may process data in countries other than the one in which you live, including the United States. Where required, we rely on recognised transfer mechanisms such as the European Commission’s Standard Contractual Clauses or an adequacy decision, and we ask processors to apply appropriate safeguards.

7. Cookies

alzaro.app uses only cookies that are necessary for the service to work: a session cookie that keeps you signed in, a CSRF token that protects forms from forgery, an optional “remember me” cookie if you tick that box at sign-in, and a cookie that stores your language preference. We do not use advertising cookies or third-party analytics trackers on the public site or in the workspace. Because these cookies are strictly necessary, no consent banner is shown; you can delete them at any time through your browser settings, which will sign you out.

8. How long we keep data

• Account and workspace data: for as long as your organisation has an account, and for up to 30 days after deletion so that an accidental removal can be reversed, unless a longer period is required by law.
• Measurement history and reports: for as long as the workspace exists, so that trends remain comparable over time. You can delete brands, prompts and reports yourself at any time.
• Uploaded setup documents: for the retention period configured by the operator (by default a limited number of days after the generation task completes), after which the originals are removed.
• Billing and ledger records: for the period required by tax and accounting law, typically 7 years.
• Server and security logs: rotated on a rolling basis, normally within 90 days.
• Crawler-pixel hits: stored as aggregated analytics in the customer’s workspace; they contain no raw IP addresses.

9. Security

We protect data with TLS encryption in transit, encryption of provider API keys and payment-gateway secrets at rest, hashed passwords, role-based access control within each organisation, tenant isolation at the database layer, rate-limited authentication, signature-verified payment webhooks and an audit log of operator access to customer accounts. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and any relevant authority as required by law.

10. Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, have it deleted, restrict or object to certain processing, receive a copy in a portable format, and withdraw consent where processing is based on consent. You can update your profile, change your password, revoke mobile and API tokens, manage team members and delete workspace content from within the application. For anything else, or to close your account entirely, email [email protected]. We will respond within the time required by applicable law and may ask you to verify your identity first. You also have the right to lodge a complaint with your local data-protection authority.

If you are a California resident, the categories above describe the personal information we collect and disclose for business purposes. We do not sell or share personal information for cross-context behavioural advertising, and we do not discriminate against you for exercising your privacy rights.

11. Data you enter about other people

When you add team members, competitors, prompts or brand documents, you confirm that you are entitled to share that information with us and with the AI providers that will process your prompts. Prompts should describe buying questions, not identify individuals. If you embed the crawler-tracking pixel on a site you operate, you are responsible for any notice your visitors are owed.

12. Children

Alzaro AI is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16 (or the higher age required in your jurisdiction). If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the product, the law or our processors change. The effective date at the top shows when it was last revised. For material changes we will notify account holders by email or by a notice in the workspace before the change takes effect. Continued use of the service after that date means you accept the revised policy.

14. Contact

Alzaro AI
 Email: [email protected]
Website: alzaro.app