Privacy Policy

Who is responsible

Nuno Miguel Duarte Unip. Lda, Rua Dr. Gomes Leal 3A, 2560-331 Torres Vedras, Portugal, is the controller for the personal data of people who use MazeRank (account holders, team members and people who receive our reports) and of visitors to our website. For data that an agency processes about its own clients through MazeRank, the agency is the controller and we act as its processor (see the Data Processing Addendum). Privacy questions: privacy@mazerank.com.

Data about you

We process:

• Account data: name, email address, password (stored hashed) or Google sign-in identifiers, role and team membership. Purpose: to provide your account (contract).
• Billing data: company name, billing address, VAT number and subscription history. Card and bank details are handled by Stripe; we do not see or store full card numbers. Purpose: billing and tax obligations (contract, legal obligation).
• Report recipients: the names and email addresses you add to receive weekly emails or monthly reports. Purpose: to send those emails (our legitimate interest, and yours, in delivering the reports you asked for).
• Usage and technical data: log-in times, actions in the dashboard, API and MCP requests, and IP address. Purpose: security, fair use and fixing problems (legitimate interest).
• Messages you send us. Purpose: to answer you (legitimate interest or contract).

Data about the businesses you track

For each website you add, we store the public information we read from that website and from Google's public business listing data, the questions we track, the answers AI engines gave, and the metrics we calculate. This is mostly business information. Where it includes personal data (for example, the name of a sole trader or a staff member mentioned on a public page), we process it only to provide the Service.

To check visibility, we send your tracked questions, together with your business name, location and language, to the AI providers listed on our Subprocessors page. We do not send them your account details.

Google sign-in and Google user data

If you choose "Continue with Google", Google sends MazeRank your name, email address, profile picture and a unique account identifier. We use them only to create your account and sign you in.

If you connect Google Analytics 4, you grant read-only access (the analytics.readonly scope). We store a refresh token, the Google account email that granted access and the list of properties you can see. Once a week we fetch only aggregated numbers: weekly sessions and key events from AI assistants, by source. We do not fetch data about individual visitors. You can disconnect at any time in the dashboard, or revoke access in your Google account.

MazeRank's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train AI models.

Free scan

When you run a free scan without an account, we store the website you entered and a hashed version of your IP address to prevent abuse. Free scans that are not turned into an account are deleted after 30 days. The scan form may be protected by Cloudflare Turnstile.

Website visitors

With your consent, we use Google Analytics to understand how our website is used. Without consent, it does not load. See our Cookie Policy.

Who we share data with

We share data only with the service providers we need to run the Service, listed on our Subprocessors page, and with authorities where the law requires it. We do not sell personal data.

International transfers

Some providers are based outside the European Economic Area, mainly in the United States. Where data leaves the EEA, we rely on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses.

How long we keep data

We keep account and website data while your account is open. When you delete a website, we delete its data; when you close your account, we delete your account data. Billing records are kept for as long as Portuguese tax law requires (generally 10 years). Free scan data is deleted after 30 days. Backups and logs are overwritten on their normal cycle.

Your rights

Under the GDPR you can ask to access, correct, export or delete your personal data, and you can object to or ask us to restrict processing. Write to privacy@mazerank.com. You also have the right to complain to a data protection authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).

Security

Data is encrypted in transit. Passwords are hashed, API keys are stored as hashes, and access is limited to the people who need it.

Children

The Service is for businesses and is not intended for anyone under 16.

Changes

We will post any changes here and, for material changes, tell you by email or in the dashboard.