Privacy Policy

1. Scope and who we are

AI Brand Lens LLC operates the AI Brand Lens website and service and provides software that measures how brands appear in AI-generated answers and evaluates public, brand-owned web evidence. In this policy, “AI Brand Lens,” “we,” “us,” and “our” refer to AI Brand Lens LLC. This policy applies when we act as the controller of personal information. A customer organization may be the controller of information it submits to a workspace, in which case its own privacy notice may also apply.

Aggregate site measurement

When a public website page loads, AI Brand Lens records a first-party aggregate arrival event containing the page path, referring domain when supplied by the browser, campaign parameters in the URL, broad device class, and timestamp. We also count consent choices and limited free-tool interactions, such as whether someone began entering a domain or left before submitting, without collecting the entered text. These events do not store or access a cookie or browser-storage identifier, do not contain a visitor or session identifier, do not store the connection IP address, and are not used to reconstruct a person’s journey across pages or websites. We use these limited events to understand basic site traffic, diagnose delivery, and measure campaign and tool totals. More detailed visitor, session, engagement, and advertising measurement remains optional and begins only after permission.

2. Information we collect

Information you provide

• Account and identity data: name, business email address, password credentials in protected form, social sign-in identifiers, passkey information, and multi-factor authentication records.
• Workspace and product data: organization, team membership, role, brands, domains, monitoring questions, competitors, reports, settings, and content you submit.
• Billing data: plan, subscription, transaction, and billing-customer identifiers. Payment card details are collected and processed by Stripe, not stored by AI Brand Lens.
• Communications: contact-form messages, support requests, and other correspondence.

Information collected through use

• Service and security data: session records, authentication events, timestamps, audit records, feature activity, and technical logs such as IP address, device or browser information, and error details where generated by our infrastructure.
• Optional analytics and performance measurement: if you allow analytics, our first-party measurement collects page paths, event names, referring domains, campaign parameters, broad device class, visible-page engagement time, and pseudonymous visitor and session keys used to understand aggregate traffic and conversion. The API one-way hashes these keys before storage. On the first measured event for a pseudonymous visitor, we may use the connection IP with MaxMind to derive approximate city, region, country, network, connection-type, and proxy or hosting signals for aggregate traffic analysis and abuse prevention. We do not store the raw IP in the analytics record; we retain a keyed one-way digest for repeat-abuse correlation. We do not retain raw user-agent strings or create browser fingerprints for this first-party measurement. We also load Cloudflare Real User Measurements to collect aggregate page-load and Core Web Vitals performance data from consented visits.
• Optional advertising measurement: if you allow advertising measurement after arriving from an OpenAI or Google ad, an ad-attribution reference may be carried to signup. We may report a snapshot, registration, or subscription conversion to the corresponding ad platform. Google conversions are sent from our server without loading a Google advertising tag in your browser. We do not send registration form fields through this measurement.
• Scan and evidence data: AI-provider responses, citations, calculated metrics, and publicly available content retrieved from websites and other public sources at a customer’s direction.
• Browser storage: the website and application use an essential preference record to honor your choices across aibrandlens.com subdomains. With permission, analytics also uses a pseudonymous visitor identifier and 30-minute inactivity session and loads Cloudflare’s performance-measurement beacon. The application uses local and session storage for sign-in tokens, workspace selection, preferences, OAuth handoffs, and onboarding state. See our Cookie Settings.

We may also receive information from your employer or workspace administrator, Google or Microsoft when you choose social sign-in, Stripe for billing, and public sources used for brand research.

3. How and why we use information

• Provide, authenticate, secure, maintain, and troubleshoot the service.
• Create workspaces, run requested scans, retrieve public evidence, calculate metrics, and generate reports.
• Process subscriptions and purchases, keep transaction records, and prevent fraud.
• Respond to requests and send service, security, billing, and account communications.
• If you expressly opt in, send practical product guidance and occasional offers. These messages include an unsubscribe link, and opting out does not affect transactional, account, billing, or security messages.
• With your permission, understand aggregate traffic, engagement, acquisition, and conversion so we can improve the website and evaluate advertising.
• Enforce our terms, protect users and the service, and comply with law.

Where a law requires a legal basis, we rely on performance of our contract, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent for optional marketing email, analytics, and advertising measurement. You may change or withdraw consent at any time without affecting earlier lawful processing.

4. AI processing and public-web research

When a customer runs a scan or requests an AI-assisted feature, relevant brand names, domains, monitoring questions, public evidence, and instructions may be sent to configured AI providers, including OpenAI, Anthropic, Google, and xAI, to produce responses or analysis. Do not submit confidential, sensitive, regulated, or personal information in monitoring questions or brand materials unless you are authorized to do so and the use is appropriate for the feature. Provider handling is also governed by the applicable provider terms and our arrangements with them.

AI Brand Lens may fetch publicly accessible pages, robots.txt, sitemap.xml, structured data, llms.txt, and similar materials for the domains customers ask us to analyze. Public availability does not change your responsibility to use the service lawfully.

5. When we disclose information

We do not sell personal information, and we do not currently share it for cross-context behavioral advertising. We may disclose information:

• to vendors that host infrastructure, store data, deliver email, process payments, support authentication, measure consented site performance, enrich consented analytics, or provide AI and related technical services;
• to workspace members and administrators according to their roles and the features they use;
• when you direct us to connect a third-party integration or share a report;
• to professional advisers, auditors, insurers, or a buyer in a corporate transaction, subject to appropriate safeguards; or
• when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, investigate abuse, or secure the service.

Current core providers include Cloudflare (delivery, security, and consented performance measurement), MaxMind (consented IP-derived location and network enrichment), Stripe (billing), Resend (email), Google and Microsoft (optional sign-in), and OpenAI, Anthropic, Google, and xAI (AI processing selected by the service). Their own policies apply when they act independently.

6. Retention

We keep personal information only for as long as reasonably needed for the purposes above. Account, workspace, scan, and report data are generally retained while the account or workspace remains active and for a reasonable period afterward for recovery, security, dispute resolution, and legal obligations. Authentication sessions are configured to expire after 30 days unless ended sooner. If enabled, the analytics visitor identifier stored in your browser lasts up to one year and analytics sessions expire after 30 minutes of inactivity; withdrawing analytics permission removes those identifiers from that browser. IP-derived analytics enrichment and its keyed digest follow the associated analytics record’s retention and are not used to reconstruct a raw IP address. Consent preferences last up to 180 days unless changed sooner. Billing and transaction records may be retained for tax, accounting, and fraud-prevention requirements. Backup copies may remain until overwritten under ordinary backup cycles. We may retain de-identified or aggregated information that cannot reasonably identify you.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed for the nature of the information we process, including access controls and protected credentials. No online service can guarantee absolute security. You are responsible for safeguarding your account credentials, limiting workspace access, and notifying us promptly of suspected unauthorized use.

8. International processing

We and our providers may process information in the United States and other countries where privacy laws may differ from those where you live. Where required, we use an approved transfer mechanism or other appropriate safeguard. Contact us for more information about safeguards relevant to your information.

9. Your privacy choices and rights

Depending on where you live, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, or appeal a denied request. You may also have a right not to receive discriminatory treatment for exercising a privacy right. Workspace administrators can update some account information directly.

Marketing email is optional and off unless you select the opt-in. Every marketing message includes an unsubscribe link; we also honor supported one-click unsubscribe requests and suppress future marketing after hard bounces or spam complaints.

You can accept, decline, or later change optional analytics and advertising measurement in Cookie Settings. Optional technologies remain off until you choose them. Withdrawing analytics permission prevents future measurement and removes the pseudonymous visitor and session identifiers from that browser.

To make a request, email hello@aibrandlens.com with “Privacy request” in the subject. We may verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law. We may retain or decline to delete information where an exception applies. You may also complain to your local data-protection authority.

AI Brand Lens does not currently sell or share personal information for targeted advertising. If that changes, we will provide any legally required opt-out and honor recognized opt-out preference signals where required.

10. Children

The service is intended for business users and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, contact us so we can review and delete it as appropriate.

11. Changes and contact

We may update this policy as the service or law changes. We will post the revised policy with a new effective date and provide additional notice when required. Questions and privacy requests may be sent to hello@aibrandlens.com or by mail to AI Brand Lens LLC, 2914 Pine Ave, Unit #211, Niagara Falls, NY 14301, United States.