Privacy Policy

Information we collect

Account information. When you create an account, we collect your name, your email address, your business name and account identifiers. AWS Cognito manages authentication and password storage. We do not receive your password.

Subscription and transaction information. If you start a trial or purchase a subscription, we receive your Stripe customer reference, subscription plan and status, billing email, and limited transaction details. Stripe collects and stores your payment-card information.

Information you submit for analysis. We collect the websites, brand names, product information, competitors, prompts, and other details you submit or confirm when configuring PaperHorse.

Report and service data. We store AI responses, source links, measurements, classifications, recommendations, reports, and other outputs generated while providing the service.

Feedback on actions. If you mark an action useful or not useful, we store your vote, the reason you choose and any short note you add, with your account and that action. Other people in your account can see the vote and its reason. The note is read only by PaperHorse staff, and no one else sees it. We use votes across all customers to improve the actions we suggest. Your vote, reason and note are deleted when you clear your vote, or when the brand or account is deleted.

Communications. We collect information you send through support, privacy, legal, or other communications. If you request report reminders, we use the email address you provide to send those reminders.

Service usage and device information. We collect basic records needed to operate and secure the service, such as report activity, features used, dates and times of requests, IP address, browser or device information, and diagnostic logs.

Cookies and local storage. We use cookies and browser storage for authentication, security, preferences, measuring how our website is used, and crediting referral partners. We use Google Analytics to understand how visitors use our website. Google Analytics sets its own cookies and receives information about your visit, such as the pages you view, your browser and device, and an approximate location based on your IP address. You can read how Google uses this information, and you can stop Google Analytics from collecting it with Google's opt-out browser add-on. When you open a referral partner's page, we set one first-party cookie, ph_partner, that records which partner referred you. It lasts 90 days from the last time you opened a partner's page, and records the most recent partner. We use it only to credit that partner if you later sign up for a plan, including a free trial, and not for advertising or for tracking you on other sites. We do not use advertising cookies or share personal information for cross-context behavioral advertising. We do not sell personal information. Our website does not respond to browser Do Not Track signals.

People named in actions. To help a customer decide whom to contact about an action, we may show the name of a writer, creator or other person whose work an AI answer cited, with their outlet or channel, the address of the page we found them on, and a public profile address. We take these only from what the person or their publisher has made public: their article, post, channel or website, the platform's public information, and web search results. Each is shown with where we found it. A profile we find by web search is shown as a likely match, with the reason, for the customer to confirm. This information is kept with the action in that customer's account. It is not shared with other customers, and we do not sell it. It is deleted when the customer removes it, or when the brand or the account is deleted. If you are one of these people and would like us to delete information about you, email privacy@paperhorse.ai.

Google Search Console and Google Analytics

PaperHorse lets you connect your own Google Search Console and Google Analytics 4 properties so the service can show you your search and traffic data alongside its AI-visibility analysis. Connecting is optional, nothing is read until you choose to connect, and this is separate from our use of Google as an AI model provider described elsewhere in this policy.

What we access. For the specific properties you select, we read Search Console performance data (search queries, clicks, impressions, and average position) and Google Analytics session data: how many sessions your site had each day, which traffic sources they came from, which page each session landed on, and the number of key events (the conversions you have set up in Analytics) they completed. From Google Analytics we keep only these daily figures: for visits from AI assistants such as ChatGPT or Perplexity, the number of sessions and engaged sessions, the pages those visits landed on, and the number of key events; for visits from unpaid Google search results, the number of sessions; for visits Google Analytics records as direct, meaning it has no source for them, such as someone typing your address or using a bookmark, the pages those visits landed on; and, across all your traffic, the total number of key events. We keep no figures broken out by any other source, including other search engines, social media, email, referrals and paid ads. We read daily counts and page paths, such as /pricing, and we do not request information about individual visitors. We request read-only permission only: the Search Console and Analytics read-only scopes, and nothing else. We cannot change, publish, or delete anything in your Google account, and we do not read any other Google service.

What we store. We store daily aggregated figures in our own database rather than raw Google responses. So that the connection keeps working without asking you to sign in repeatedly, we also store the long-lived credential Google issues us, encrypted at rest with AES-256-GCM and cryptographically bound to the specific brand and provider it was issued for. We never store it in plain text.

How we use it. We use this data to show you your own search and traffic figures inside PaperHorse, and to be explicit about where those figures are incomplete. We also compare your searches with the prompts you track and, if you choose, use them to suggest prompts you can track. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.

Who we share it with. Only the people you invite to your account, and PaperHorse staff when you ask us to help with it. It is stored in our own infrastructure and is not shared with any other third party, with one exception that only you or someone in your account can start. If you choose one of your searches to track as a prompt, we send that one search to an AI model provider we choose, which may change over time, so it can suggest the prompt's wording. We send it as soon as you choose it, before you approve anything. If you approve the prompt, we send it as you worded it to the AI and search providers listed below in every report, as we do with all your prompts. Nothing else we read from Search Console or Analytics goes to any of these providers: not your other searches, and no figures or traffic data.

How to disconnect. You can disconnect either provider at any time from the SEO page in PaperHorse. Disconnecting revokes our access with Google and removes the stored credential, so we stop reading new data. You can also remove our access yourself at any time from your Google account's third-party access settings.

What disconnecting does and does not delete. Disconnecting stops future reading; it does not delete the figures already collected, so your history remains intact if you reconnect later. If you switch to a different site or property, on the SEO page or by reconnecting, we delete the figures we held from the previous one. Choosing the same one again deletes nothing. Those figures are deleted when the brand is deleted or the account is deleted, together with the stored credential. To have them deleted sooner, email privacy@paperhorse.ai. A prompt you approved from one of your searches is one of your prompts from then on. Disconnecting, or asking us to delete your Google data, does not remove it, and it stays in the reports that used it. It is deleted when the brand or the account is deleted. Copies already sent to the providers listed below are kept under their own terms and can't be recalled.

PaperHorse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where information comes from

We receive information directly from you, automatically when you use the service, from service providers such as AWS and Stripe, from publicly available webpages and AI search services used to prepare a report, and, if you connect them, from your own Google Search Console and Google Analytics properties.

How we use information

We use personal information to:

• provide, personalize, maintain, and improve PaperHorse;
• create reports, measurements, comparisons, and recommendations;
• authenticate users and administer accounts, trials, subscriptions, and billing;
• send service, security, billing, support, and requested reminder messages;
• monitor performance, troubleshoot problems, and protect against abuse or fraud;
• comply with law and enforce our agreements; and
• create aggregated or de-identified analysis that does not identify an individual.

We do not use customer data to train our own AI models. We use commercial AI services and do not opt customer data into provider model-training programs. Provider handling is also governed by each provider's terms and data-use commitments.

Legal bases for processing

Where European Economic Area or United Kingdom data-protection laws apply, we process personal information as needed to perform our contract with you, pursue our legitimate interests in operating and securing the service, comply with legal obligations, and, where required, based on your consent. You may withdraw consent at any time, but withdrawal does not affect processing already completed.

How we disclose information

We may disclose information to:

• Cloud and security providers. AWS provides authentication, hosting, storage, networking, and related infrastructure.
• Payment providers. Stripe processes subscription payments and helps administer billing.
• Referral partners. If you sign up, or start your first plan, after visiting a referral partner's page on paperhorse.ai, we pay that partner a commission and show them the following so they can be credited and paid for the referral: your business name; the name and email address of your account's owner; the date your account was linked to them; the date of your first payment; whether your subscription is in a trial, active or canceled, and the date it was canceled; for each of your payments, its date, the billing period it covers, and the commission we pay the partner for it, which shows which plan you are on; and, if a payment is refunded or disputed, the commission we take back for it, which shows how much of that payment was returned, and the month we take it back in. We do not share your reports, prompts, competitors or any other content of your account, unless you invite the partner to your account or share it with them yourself. To ask us to stop sharing this information, email privacy@paperhorse.ai. If you do, we stop sharing your information with that partner and stop paying them a commission for your account, from then on.
• People you invite. Anyone you invite to your account, including someone from a referral partner, can see your account's reports and data, including figures from a connected Google Search Console or Google Analytics property.
• AI and search providers. The prompts and context needed to generate or evaluate report results are processed by OpenAI, Anthropic, Google and Perplexity, the companies behind the AI assistants a report measures; by a search data provider that retrieves Google's AI Overviews and AI Mode answers for your questions; and by an AI model provider we choose for other steps of our service, which may change over time. Some of these providers search the web to answer, using their own search services. From a connected Google Search Console or Google Analytics property, only two things are sent to any of these providers. The first is the one search you choose to track: we send it to an AI model provider we choose, and that choice may change over time, so it can suggest the prompt's wording before you approve it. The second is the prompt you approve, sent as you worded it in every report. No other searches and no figures are sent.
• Professional advisers and authorities. We may disclose information to advisers, courts, regulators, or law enforcement when reasonably necessary to comply with law, protect rights and safety, or establish and defend legal claims.
• Business transaction participants. Information may be disclosed in connection with financing, due diligence, a merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections. Data we read from a connected Google Search Console or Google Analytics property, and prompts you approved from your searches, are not disclosed for financing or due diligence. They are transferred in a merger, acquisition, reorganization or sale of assets only with your explicit consent first.

AI providers receive the prompt and business context needed for the relevant request. They do not receive your PaperHorse password or payment-card number from us.

Automated web search and third-party content

PaperHorse may use automated web search to locate public webpages relevant to a report or recommendation. Search results and external webpages are controlled by third parties. We receive the links and context returned to the service and store relevant portions with the report.

Data retention

We keep personal information only as long as reasonably necessary for the purposes in this policy, including providing the service, maintaining business and transaction records, resolving disputes, enforcing agreements, and complying with law.

Reports remain available until you delete them or close your account. Deleted reports are generally retained in a soft-deleted state for up to 30 days before permanent deletion. Backup copies and logs may remain for a limited additional period as part of routine security and disaster-recovery processes.

After an account-deletion request, we generally delete or de-identify associated account and report data within 30 days. We may retain limited information when required for tax, accounting, fraud prevention, security, or other legal obligations.

Figures collected from a connected Google Search Console or Google Analytics property are kept while the connection exists and remain if you disconnect, so that reconnecting does not lose your history. They are deleted when you switch to a different site or property, when the brand or the account is deleted, or sooner on request. A prompt you approved from one of your searches is kept like your other prompts, including after you disconnect, and is deleted when the brand or the account is deleted.

International data transfers

PaperHorse is based in the United States, and our providers may process information in the United States and other countries. Where required, we use contractual or other recognized safeguards for transfers of personal information across borders.

Your privacy rights

Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of, deletion of, or a copy of your personal information; to object to or restrict certain processing; to withdraw consent; and to appeal our response to a request. You may also have the right to lodge a complaint with your local data-protection authority.

PaperHorse does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We will not discriminate against you for exercising a privacy right.

You can access account information and delete individual reports through the service. To make another privacy request, email privacy@paperhorse.ai. We may need to verify your identity and authority before completing a request.

Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, encryption for stored service data, managed authentication, access controls, logging, input validation, and rate limits. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children's privacy

PaperHorse is intended for business users and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us so we can investigate and delete it where appropriate.

Changes to this policy

We may update this Privacy Policy as PaperHorse and applicable law change. We will post the revised policy with a new effective date. If a change materially affects how we handle personal information, we will provide additional notice when required by law.

Contact us

PaperHorse LLC is responsible for the personal information described in this policy. Send privacy questions or requests to privacy@paperhorse.ai.

For account, billing, or general support, email support@paperhorse.ai.