Privacy Policy — OLAB Assist

OLAB Assist is a service that checks how search engines and AI assistants read a website, monitors those signals every day and tracks how AI assistants answer questions about a brand. This policy explains which personal data we process, why, who receives it and what you can do about it.

1. Data controller

OLAB Assist
Terreton Springs Dr., Porter, TX 77365, USA
İsmail Cem Cad. 27J, 07200 Antalya/Türkiye
[email protected]

2. Data we process

Account: name, email address, the sign-in method you use (Google, Apple, or email and password or email link) and the user ID that method provides. If you sign in with email and password, the password is handled by our authentication provider; we never see or store it.
Sites and audits: the domains you check or monitor, audit results, scores, findings, score history and recorded changes.
AI answer tracking: the questions (prompts) you add, the brand name you confirm, the competitors you track, and the answers, sources and model names returned by AI assistants.
Settings: language, theme and email notification preferences.
Plan and billing: your plan, trial dates, invoices and payment status. Card details are entered with our payment provider; we never see full card numbers.
Support: messages you send us, the email address you use and any screenshots you attach.
Pilot brief form: if we send you a link to this form, we process the company and brand details, markets, competitors and other answers you provide; the contact person’s name, job title and email address; the name and email address of any colleague you nominate; and the identifier in the invitation link showing its original recipient. Answers are saved as you move between steps, so we also receive saved answers if you do not submit the form. We use this information only to prepare and run a pilot and contact you about it.
AI visibility survey: if you fill in our public AI visibility survey, the company and brand details, markets, competitors and answers you enter, and the contact details you give (name, job title and email address). Answers are saved at each step. We use them to decide and deliver the reward, to contact you about it and, combined with other answers, for our AI visibility research.
Blog reports: if you report a problem with a blog post, the topic you choose, the message you write, your email address (or your account’s email address if you are signed in), any name or brand you give, the ticket number we assign and a salted hash of your IP address to limit abuse. We use this information only to review the report, reply to you and record our decision. Reports reach our support team.
Use of the app: when you are signed in, we record the main actions you take, such as opening the app, running a scan, opening a finding, marking a fix as applied, sharing a report or viewing plans, together with the time, the site and your plan. We do not record what you type, your prompts or AI answers. We use these records only to understand how OLAB Assist is used and to improve it, and we do not share them with third parties. Changes to your subscription (trial, payment, plan change, cancellation, refund) are also kept as a history. If you delete your account, these records are kept only under an anonymous identifier that no longer points to you; the same is done two years after a subscription ends.
Error records: when something goes wrong on our site or in the app (a page error, a file that does not load, a page that stops responding, a failed request), we record what happened, the page address without its parameters, our software version, your browser and operating system name and, if you are signed in, your account. We do not record what you type or the content of the page, and your IP address is not stored. We use these records only to find and fix errors, keep them for 90 days and do not share them with third parties. If you delete your account, they are kept only under an anonymous identifier.
Blog reads and likes: we count how many times each post is read as daily totals per post and language, with no information about the reader. When you like a post, we store a keyed hash of your IP address and browser so that the same person is counted once and can take the like back; the hash cannot be turned back into an address. Read and like counts are not shown on the site.
Technical data: IP address, browser and device information and server logs. For the free audit we keep only a salted hash of the IP address to limit abuse, not the address itself.
Brand facts and alerts: information you confirm about your business, such as prices, locations or products, and statements in AI answers that contradict that information.
Report settings and logos: report titles, notes, selected sections and uploaded logos. Logos are stored in our database and loaded via a link whenever someone opens a report that displays them.
Pages cited by AI: to show why AI assistants recommend competitors, we review the public pages cited in AI answers to your questions, up to your plan's page limit per site each day. We record which of the brands you track each page mentions. We do not sign in to any site or access private pages.
Google Analytics (optional): if you connect Google Analytics, we process your selected Google Analytics 4 property and the aggregate numbers of sessions and key events originating from AI assistants over the last 60 days. We never receive data about individual visitors. Access is read-only, and the access token is stored in encrypted form. You can disconnect at any time, which also revokes our access at Google.
Google Search Console (optional): if you connect Search Console, we read the search queries, pages, clicks, impressions and average positions for your selected property over the last 28 days. We retrieve results for all countries combined and, in Market Gap Radar, for each market’s country. Access is read-only. The long-lived connection token is stored encrypted. You can disconnect at any time, which also revokes our access at Google.
Anonymous source statistics: we count how often each public website is cited in the AI answers we collect, grouped by day, AI assistant, country and language. These counts contain no questions, answers, brand names, monitored sites or account details. They are not linked to you.

Please do not send special categories of personal data (for example health data) in prompts, messages or attachments.

3. Free audits and share links

You can run an audit without an account. An audit reads only public pages of the domain: the homepage, robots.txt, llms.txt and the sitemap. Each report has a hard-to-guess link; anyone who has the link can open it, so share it only with people you choose.

First check without an account. When you use the first check on the dashboard without an account, we send the site address and the question you enter to ChatGPT (OpenAI) and Gemini (Google) to get their answers. What you entered and the result are kept against a random code that is stored only in that browser tab; closing the tab loses the code, and nothing links the check to you. If you create an account in that tab and start the free week or a plan, the site and the question move into your account and are kept as account data. Otherwise they are deleted within 24 hours, and we keep only the fact that a check was made, without its content.

4. Why we use data

To create your account and keep you signed in.
To run audits, daily site scans and AI answer tracking, and to show results, history and changes.
To send emails you asked for or that the service needs: sign-in and verification emails, weekly summaries and change alerts (you can turn the last two off in Settings).
To manage plans, trials, payments and invoices.
To answer support requests.
To keep the service secure, prevent abuse and fix errors.
To meet legal obligations.

5. Legal bases

We process data to perform our contract with you, on the basis of our legitimate interest in running and securing the service, to comply with legal obligations and, where the law requires it, with your consent. These bases follow the Turkish Personal Data Protection Law (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).

6. Who receives data

We use the following providers to run the service. Each receives only what it needs:

Google Firebase: sign-in, account security and sign-in emails.
Apple: Sign in with Apple, if you choose it.
Cloudflare: hosting, database, security, human verification on the contact form and email delivery.
OpenAI (ChatGPT), Google (Gemini), Anthropic (Claude), Perplexity and DataForSEO (for Google AI Overviews and AI Mode results): receive the text of the prompts you track so they can answer them. We do not send your name, email address or account details with the prompt. If you add brand facts, Anthropic (Claude) also receives those facts and the AI answers that mention your brand, so it can identify statements that contradict the information you provided.
Anthropic (Claude), for the help assistant: receives the questions you type into the help assistant on our site, together with the language and the page you are on, so it can answer from our help pages. Do not type personal details there.
Paddle: processes payments as merchant of record and handles invoices, taxes and refunds.
Google Analytics: measures visits to our public pages, only if you accept analytics cookies.
Google (Google Analytics APIs): only if you connect Google Analytics. We request your list of properties and the AI-assistant visit totals for your selected property. We send no other information to Google.
Google (Search Console API): only used if you connect Search Console. We request your list of properties and search performance data for your selected property. We send no other information to Google.
Meta Platforms (Meta Pixel): learns when a visitor who saw our ads on Facebook or Instagram visits our pages, runs a free audit, creates an account or starts a plan, only if you accept marketing cookies.
Google Workspace: hosts our support mailbox.

We may also disclose data to authorities when the law requires it. We do not sell or rent personal data. The only advertising use is the Meta Pixel described above, and only with your consent; it never receives your prompts, audit results or AI answers.

7. International transfers

Our providers may process data outside Türkiye and the European Economic Area, including in the United States. We use providers that offer transfer safeguards recognised under KVKK and GDPR, such as standard contractual clauses.

8. How long we keep data

Account, site, audit and tracking data are kept while your account exists.
When you delete your account in Settings, we delete your account, monitored sites, prompts, competitors, AI answers and history immediately. Audit reports created earlier stay reachable through their share links but are no longer linked to you.
If a payment cannot be collected the service is paused, and account data (sites, reports, AI answers, integrations) is deleted 7 days after the pause for the first payment after the trial, or 30 days after it for later payments (see the Terms of Use, section 5). Your email address and whether you used the free trial are kept while the account exists.
Free plan: when the 7-day free week ends and no plan is chosen, your sites and their data are kept for 30 days and then deleted. We email you 3 days before.
Billing records are kept for as long as tax and accounting law requires.
Support messages are kept for up to three years after the request is closed.
Pilot brief responses are retained for up to 24 months from the date they were last saved. If a pilot or subscription follows, they are retained for the duration of that contract. Email [email protected] and we will delete them sooner.
AI visibility survey answers and reward records are kept for up to 24 months from the date they were last saved.
Questions asked to the help assistant are kept for 30 days without your name, email address or IP address, so we can see which help pages are missing; the answers are not stored.
Security logs and hashed IP addresses are kept only as long as needed for security and abuse prevention.
Brand facts, incorrect-information alerts, report settings, fixes marked as applied and Google Analytics totals are retained for as long as the site remains in your account. They are deleted when the site is removed.
Information recorded from pages cited by AI is retained for 4 weeks.
Logos are retained for as long as your account exists. If you upload more than 100 logos, the oldest is removed.
Disconnecting Google Analytics, removing the site or deleting your account deletes the encrypted access token and revokes our access at Google.
Search Console data is retained while both the connection and the site remain in your account. Disconnecting Search Console, removing the site or deleting your account deletes this data and the encrypted long-lived connection token, and revokes our access at Google.
Anonymous source statistics contain no information about you or your account. They are therefore retained after you delete your sites or account.

9. Your rights

Depending on the law that applies to you, you can ask to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent. You can delete your account yourself in Settings. For anything else, write to [email protected]. You can also complain to your data protection authority; in Türkiye this is the Personal Data Protection Authority (KVKK).

10. Cookies and local storage

We use three kinds of cookies and similar browser storage:

Necessary: your theme and language preferences, the sign-in session created by our authentication provider, Paddle’s payment window, the human verification on the contact form (Cloudflare Turnstile), and a local draft of the pilot brief kept in your browser until you submit the form. These are required for the site to function and are always enabled.
Analytics (optional): Google Analytics 4 counts visits and shows how pages are used, so we can improve the site. It runs only if you accept analytics in the cookie banner. Advertising features are off and Google Analytics 4 does not store IP addresses. Cookies used: _ga and _ga_*.
Marketing (optional): the Meta Pixel measures our Facebook and Instagram ads: it records page views and when someone runs a free audit, creates an account, starts a trial or subscribes, together with the plan and price. It runs only if you accept marketing cookies. Cookies used: _fbp and, when you arrive from an ad, _fbc.

You can change or withdraw your choice at any time with “Cookie preferences” at the bottom of every page; withdrawing removes the analytics or marketing cookies.

11. Security

We use HTTPS, verified sign-in tokens, access controls, rate limits and other technical measures. No online service is completely free of risk, so we cannot guarantee absolute security.

12. Children

OLAB Assist is meant for businesses and professionals and is not directed at children. We do not knowingly collect data from children.

13. Changes

We may update this policy. We show the date of the latest version at the top and tell account holders by email about material changes.

14. Contact

[email protected]