Privacy Policy

AEO Spotlight - AI Visibility Monitoring and Content Studio Platform

Last Updated: September 23, 2026

This policy covers the data we receive from connected Google services (Google Search Console and Google Analytics 4). See Google API Services below.

Introduction

AEO Spotlight ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI Visibility Monitoring and Content Studio platform (the "Service").

By accessing or using our Service, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us when you:

Register for an account
Use our monitoring, analysis, or content features
Make a payment
Contact our support team
Subscribe to our newsletter

This information may include:

Name and contact information (email address, phone number)
Billing information (processed securely through Stripe)
Brand name, website URL, brand variations, and target keywords you provide
Communication preferences

Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

IP address and browser type
Device information and operating system
Usage data and analytics
Cookies and similar tracking technologies

Monitoring and Platform Data

To provide monitoring, analysis, and content features, we process data related to your monitoring activity, including:

Brand profiles and their variations, descriptions, and keywords
Monitoring queries and their configuration, including persona, geographic target, and language
Responses, citations, and competitor data returned by third-party AI platforms and search providers (which may contain publicly available web content)
AI visibility scores, gap analyses, recommendations, and alert data
Content you generate, humanize, or publish through the Content Studio, including generated content, schema, and destination URLs
Public developer API usage and webhook delivery records

This data is used solely to provide the Service and is not shared with third parties except as described in this policy, including with the AI and search providers that power the Service (see "Third-Party Services" below).

Connected Google Services (Search Console and Google Analytics 4)

Connecting a Google service is optional, and each connection is separate. When you choose to connect one, we access read-only data for only the property you select:

Google Search Console — the list of Search Console properties your Google account can access (so you can pick one), and organic search demand for the selected property: query text, impressions, clicks, click-through rate, and average position over a rolling window.
Google Analytics 4 — the list of Analytics properties your Google account can access (so you can pick one), and per-landing-page metrics for the selected property: sessions, engaged sessions, total users, and key events over a rolling window.
Authorization tokens — an access token, which is short-lived and never stored on our servers beyond the request that uses it, and a refresh token, which is encrypted at rest with AES-256-GCM. No token is ever returned to your browser, included in any API response, or written to our logs.

We request read-only access only. We never write to, modify, or delete anything in your Search Console or Analytics account, and we do not access any other Google service on your behalf. This connection is separate from signing in with Google.

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Execute your monitoring queries by transmitting your brand information and query text to third-party AI platforms and search providers
Generate AI-assisted content briefs, articles, and schema markup at your direction
Process your transactions and send related information
Send you technical notices, updates, and support messages
Respond to your comments and questions
Monitor and analyze trends, usage, and activities
Detect, prevent, and address technical issues
Personalize your experience
Comply with legal obligations

Google API Services

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data we receive from Google APIs — Search Console performance data and Google Analytics 4 metrics — is used only to display that data to you inside the Service and to derive the features you asked for. We do not:

sell, rent, or trade Google user data, or transfer it to third parties for advertising, marketing, or data brokerage;
use Google user data to serve advertising, including retargeting, personalised, or interest-based advertising;
use or transfer Google user data to train, fine-tune, or improve generalized artificial-intelligence or machine-learning models;
allow humans to read Google user data, except where you have given us explicit permission for support, where it is necessary for security or abuse investigations, or where we are required to do so by law.

Google user data is never added to, blended with, or used to explain our AI-visibility measurements. The two are measured by different instruments and are shown side by side, never combined (see "Third-Party Services" below).

Data Protection and Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption of sensitive data in transit and at rest
Regular security assessments and vulnerability testing
Access controls and authentication mechanisms
Secure data storage with industry-standard protections

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Third-Party Services

We may employ third-party companies and individuals to facilitate our Service, provide the Service on our behalf, perform Service-related services, or assist us in analyzing how our Service is used. These third parties have access to your personal information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

AI and Search Providers

To deliver the Service, we transmit your brand name, website URL, monitoring queries, and related monitoring data to third-party AI and search providers (for example, OpenAI, Google (including Gemini and AI Overviews), Anthropic, Perplexity, Brave, xAI, and others) and to web search APIs. These providers process such data to generate the responses on which our monitoring results are based. Where you use content generation features, we may transmit relevant context and grounding materials to the AI provider used for generation. Please review the privacy policies of these providers for information about how they process data.

Key Third-Party Services:

Stripe

Payment processing services

OpenAI (ChatGPT)

AI platform monitoring and analysis

Google (Gemini, AI Overviews, Knowledge Graph)

AI platform monitoring, search, and entity verification

Google Search Console & Google Analytics 4

Optional connected sources you authorise — read-only organic query demand and on-site page metrics (see "Connected Google Services" above)

Anthropic (Claude)

AI platform monitoring

Perplexity

AI platform monitoring

Brave Search

Web search for research and grounding

xAI (Grok)

AI platform monitoring

DeepSeek

AI-assisted content and brief generation

Microsoft Clarity

Website analytics and usage tracking

Google reCAPTCHA

Bot protection on free tools and forms

AWS Cloud Hosting

Data storage and infrastructure

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Monitoring data, citations, and generated content are retained while your account is active so that you can access historical reports and track progress. You may request deletion of your data or your account at any time by contacting us.

Connected Google data is retained on a shorter, explicit cycle:

Imported Google data (Search Console query demand and Analytics page metrics) is retained while the property stays connected, so you can see history and compare windows.
Disconnecting a property deletes that property's imported data from our systems and clears the stored credentials. Content already published to your own site is unaffected.
Revoking access in Google stops further imports as soon as Google rejects the next request; disconnect the property in the Service to remove the data already imported.
Deleting your account removes connected properties, their stored credentials, and their imported data along with the rest of your account data.

Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

Right to Access

Access your personal information

Right to Correct

Correct inaccurate personal information

Right to Delete

Request deletion of your personal information

Right to Portability

Data portability rights

Right to Withdraw Consent

Revoke a connected Google service at any time

To exercise these rights, please contact us using the information provided below.

Revoking a connected Google service. You can withdraw our access at any time, without contacting us:

In the Service — open your account menu, go to Connected data, and use Disconnect on the Search Console or Google Analytics 4 card. The page states exactly what will be removed before you confirm it.
From Google — remove AEO Spotlight's access on your Google Account third-party access page. Imports then stop as soon as Google rejects the next request.
By email — write to us and we will disconnect the property and delete its imported data for you.

Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

AEO Spotlight

Email: privacy@aeospotlight.com