Privacy policy

The site and the service are operated by TAMGIO (tamgio.com).

For site visitors

For visit statistics we use Google Analytics 4 (via Google Tag Manager). For visitors from the European Economic Area (EEA), the UK and Switzerland it is activated and sets its cookie only after you consent; for visitors from other countries it is on by default. You can switch it off at any time via “Decline” in the banner or “Cookie settings” at the bottom of the page — after that no cookie is set and only identifier-free signals reach Google. No other analytics tool is used.

To protect against abuse (shared report links, dashboard sign-in attempts and the contact form), your IP address is kept in a request counter for about a minute and discarded when the window ends. When the sign-in limit is exceeded, the IP is written to the technical log. Server logs hold technical details and are used only to investigate failures.

If you leave your email in the early-access or audit form, it is stored in our database (together with the request type and language) so we can contact you; it is used for nothing else and is not passed to third parties. To be removed, write to us.

For dashboard users (customers)

When an account is created for you (accounts are provisioned by TAMGIO), we store your email address and a hash of your password. When you sign in, session cookies are set (login state and CSRF protection). Your project data — tracked domains, prompts, AI engine answers and their raw archive — is stored to provide the service.

Cookies and similar storage used on the site:

No other analytics or advertising cookies are set.

Google Analytics — your consent (Art. 6(1)(a) GDPR); contact form — your consent (Art. 6(1)(a)); abuse protection and server logs — legitimate interest (Art. 6(1)(f)); dashboard account and project data — performance of a contract (Art. 6(1)(b)).

We rely on the following providers to run the service; each receives data only for its own purpose:

• Google (Google Tag Manager, Google Analytics 4) — visit analytics; only with consent in the EEA/UK/CH.
• Hostinger (VPS) — the server hosting the site.
• Supabase — dashboard database.
• Cloudflare R2 — raw archive of AI answers, report files (HTML/PDF) and daily database backups (kept for 30 days).
• Upstash — request-limit counters (IP, short-lived).
• Resend — delivery of internal operational alerts (backup and scan status) to the operator's own address; these emails contain no user email addresses or personal data, only the project name and figures.
• OpenAI, Perplexity, Google Gemini, SerpAPI — dashboard customers' prompts are sent to these engines to obtain AI answers; site visitors' data never goes to them.

Some of the providers listed (Google, Cloudflare, Upstash, Resend, the AI engines) process data outside the European Economic Area, including in the United States. Such transfers rely on the contractual safeguards these providers offer for the GDPR (data processing agreements and the European Commission's standard contractual clauses); you can request a copy of the safeguards via “Contact”.

Google Analytics keeps event data for 2 months under Google's default setting. The rate-limit IP is discarded within about a minute. An email submitted via the form is kept until your request is answered or you ask to be removed. Account and project data are kept until your account is closed; you can ask us to delete your account. Deleted data may remain in backups for up to 30 more days.

You have the right to access, rectify, erase, restrict the processing of, port and object to the processing of your data. Requests are answered within one month at the latest.

You can withdraw analytics consent at any time via the “Cookie settings” button at the bottom of the page; this does not affect the lawfulness of processing before withdrawal.

If you live in the EEA/EU, you also have the right to lodge a complaint with your country's data protection authority.

No automated decision-making or profiling about you takes place. Email and password are required to provide the dashboard service; the email submitted via the form is voluntary.

When this policy changes, the date at the top of the page is updated. For material changes, consent is asked again via the banner.