Subprocessors & Data Retention

1. Subprocessors

These are the providers we route personal data through to operate the Service, derived directly from the integrations wired into the codebase (not a marketing list). Each acts as our processor (or, for the internal Slack notification below, as a recipient we control directly) under its own terms and DPA where applicable. Processing locations are stated per each vendor's own public documentation — we have not independently audited their infrastructure, and say so explicitly wherever we could not verify it further.

We do not sell personal data and do not run cross-context behavioral advertising. See the Privacy Policy for the lawful bases we rely on for each of these transfers and our approach to international data transfers (EU SCCs / UK IDTA / EU-U.S. Data Privacy Framework where applicable).

2. Data Retention

These periods are read directly off our database schema and account-deletion code, not restated from a policy template:

• Active account data. Domains, tracked queries, scan results, GEO Scores, and every other product record are kept for the lifetime of your account.
• Grader (lead-magnet) runs — EN Free GEO Snapshot, Brand Hallucination Check, and the CZ, SK, and DE mini-audits. Every one of these tables sets an expires_at seven (7) days after the run. Past that timestamp the public result page stops resolving. We did not find a cleanup cron that deletes the underlying database row after expiry — the row itself may persist longer for abuse-prevention and cost-monitoring purposes, the same allowance the Privacy Policy already makes for the EN Snapshot (up to 24 months for fraud-prevention / cost-analysis records). We have not yet extended that explicit language in the Privacy Policy to the CZ/SK/DE and Hallucination Check tables, even though they follow an identical pattern in code.
• Billing and cost-ledger records. usage_events (per-call cost ledger) and billing_audit_events (Stripe event audit trail) are not tied to your account by a foreign key and are not removed by account deletion (below). They are retained for accounting purposes, consistent with the up-to-ten-year retention period Czech tax/accounting law requires and that the Privacy Policy already discloses.
• Account deletion (Settings → Delete Account). See Section 5 below for exactly what this removes and what it deliberately does not.

3. IP Address Handling

Everywhere we persist an IP address in our own database — the public grader tools (EN/CZ/SK/DE and the Hallucination Check) and admin login rate-limiting — we hash it with SHA-256 plus a per-deployment salt before writing it to any table. The raw IP address is never the value we store. This is a code fact, not a policy statement: the hashing happens before the database write in every code path we found that touches a visitor IP.

This covers what our application persists. It does not cover infrastructure-level request logs our hosting/CDN provider (Vercel) may retain as an ordinary part of serving HTTP traffic — see Vercel's own documentation for their log retention.

4. Analytics Cookies and Consent

Our cookie-consent banner gates Vercel Analytics and Vercel Speed Insights behind the "analytics" toggle — they do not load until you accept. As noted in Section 1, PostHog is not currently wired into that same consent gate and initializes on every page load regardless of your cookie choice. We are surfacing this plainly rather than describing a consent flow that doesn't exist in the code today.

5. Account Deletion — What Actually Gets Removed

Settings → Delete Account is self-serve and runs immediately (not on a delayed batch job). In order, it:

• cancels your Stripe subscription, if any;
• deletes scan_results, scans, queries, geo_scores, email_reports, scan_limits, domains, subscriptions, and profiles rows tied to your account;
• signs your active session out; then
• deletes your Supabase auth.users record. Every other user- or domain-scoped table in our schema (citation intelligence, crawlability audits, competitor tracking, dashboard actions, alert history, GSC integration data, MCP API tokens, OAuth grants, and more) is declared with a foreign key back to auth.users(id) or domains(id) with ON DELETE CASCADE, so this final step removes them automatically.

What this does not delete: usage_events and billing_audit_events — see Section 2 for why. Everything else in the schema is either explicitly deleted above or cascades from the auth-user deletion.

6. Your Rights and How to Exercise Them

If you are in the EU/EEA, UK, or Switzerland, you have the rights to access, rectify, erase, restrict, and object to processing, receive your data in a portable format, and withdraw consent — the full list, lawful bases, and equivalent rights under U.S. state law, LGPD, PIPEDA, and other regimes are in Privacy Policy §12–14. Pro and Business users can also self-serve a CSV/JSON export of their own data from the dashboard.

To exercise any right, request a copy of an executed DPA, or ask about anything on this page, write to legal@geotrackerai.com. For product/account support, use support@geotrackerai.com — the same two addresses used across our Privacy Policy and DPA. We aim to respond within thirty (30) days.

7. Keeping This Page Accurate

This page is regenerated by re-checking the code paths above, not copy-edited from memory. If we add or remove a subprocessor, change a retention window, or close the PostHog consent gap noted in Section 4, we will update this page in the same change that ships the underlying code.