Privacy Policy

1. Who is the data controller?

Alins Ai Studio LTD (“we”, “us”) is a limited company registered in England & Wales under number 17366754. Our registered address is 8/A Greenwood Grove, Alins Ai Studio Office, Marcham, Abingdon, England OX13 6FR. GeoRankScore is a product of this company.

For any question or request about your data: merhaba@georankscore.com

2. What data do we process?

We collect only what the service needs:

• Account details: your email address, your name if you give one, and your language preference. If you sign in with a password, it is stored irreversibly hashed — we never keep plain-text passwords.
• Business details: business name, category, city, district, country and website. You enter these so we can run the measurement.
• Scan results: the answers AI engines give, the competitor business names detected, the source URLs cited, and your calculated score.
• Technical data: your IP address on a free scan, kept for at most 24 hours to prevent abuse and cost misuse, then deleted.
• Report email request: if you ask us to email you your free scan result, we keep your address, the business name it relates to and the score from that scan. We use the address to send the report and to be able to reach you afterwards.
• Marketing consent: if you separately opt in to commercial email, we store the moment you consented, a verbatim copy of the wording shown next to the checkbox that day, and your IP address at that moment, as proof. If you do not opt in, none of this is recorded — and you still receive the report you asked for.
• Payment data: your subscription status and your Stripe customer/subscription identifiers. YOUR CARD DETAILS NEVER REACH US — payment is taken directly in Stripe’s secure form.

3. Why we process it (UK GDPR legal bases)

• Performance of a contract: creating your account, running scans, delivering your dashboard and Monday briefing, processing your payment.
• Legitimate interests: keeping the service secure, preventing abuse and automated misuse, controlling our API costs, and improving the service.
• Consent: for marketing emails only. You can withdraw it at any time through the one-click unsubscribe link in every marketing email — withdrawing does not make the processing before it unlawful.
• Legal obligation: keeping accounting and tax records.

4. What we send to AI engines

The core of the service is asking real AI engines the questions your customers would ask. Those questions contain your business name, category and location — the measurement cannot be made without them.

We send this information as query context to OpenAI, Anthropic and Google. Your account email, payment details and dashboard content are NOT sent to these engines.

Answers from these providers may not be identical to what the consumer apps return. We state this openly on our methodology page.

5. Who we share with (sub-processors)

We do not sell your data. We use these providers only to run the service:

• Stripe — payments and subscription management.
• Resend — delivery of sign-in codes and Monday briefing emails.
• OpenAI, Anthropic, Google — AI queries for visibility measurement.
• Contabo — server hosting (France, EU).
• Google Analytics 4 and Meta (Facebook/Instagram) Pixel — only if you consented on the cookie banner, for site usage and ad measurement.
• Google — only if you choose “Sign in with Google”, for authentication.
• IndexNow — only if you use the “Submit Site” feature, to notify search engines about YOUR OWN site URLs.

6. Tracking, analytics and advertising

We use third-party measurement tools to understand how you use the site and whether our ads work: Google Analytics 4 and Meta (Facebook/Instagram) Pixel. They load ONLY after you press “Accept” on the cookie banner. If you decline or ignore it, not a single request goes to these tools and the site works exactly the same.

We store your choice in a `grs-consent` cookie so you are not asked on every page. To change your mind, clear this site’s data in your browser and the banner will appear again.

If you consented, we may also report conversions such as purchases to Meta from our own server (Conversions API). Your email address is never sent in plain text in that report — only an irreversible SHA-256 hash. If you did not consent, no such report is sent.

The other cookies we set are: `grs-locale`, which remembers your language, and a security cookie that keeps you signed in. Both are necessary for the service to work and are independent of consent.

We use a live support chat (tawk.to) on the site. This service sets its own cookies and keeps an anonymous session in your browser so a conversation can continue. Its purpose is support only: it is not used for advertising, it has no access to your scan data, and no personal information reaches us unless you start a conversation. Anything you share in the chat is stored as a support record on tawk.to’s infrastructure.

To understand which channel our visitors come from, we temporarily keep campaign tags from the address bar (such as utm_source, gclid, fbclid) in your tab session. This is NOT a cookie, it is deleted when you close the tab, and it only reaches our server if you yourself ask us to email you a scan report.

To understand where people leave the product, we keep a simple count on our own server (free scan → result → fix → offer → payment). This count uses NO cookie, sends nothing to any third party and stores no personal data: the only things recorded are an irreversible key derived from the business name/category/city you entered, and which step was reached. Your name, email and IP address never enter this record, and your identity cannot be recovered from it.

7. Where your data is held

Our database and application server are hosted in France (European Union).

Some of our sub-processors (Stripe, Resend, OpenAI, Anthropic, Google) may process data outside the UK and EEA. Where that happens, transfers rely on appropriate safeguards such as the provider’s standard contractual clauses and the UK International Data Transfer Addendum.

8. How long we keep it

• Free scan cache and the IP address in it: 24 hours, then deleted.
• Report email record and any marketing consent: until you ask us to delete it or you unsubscribe. Once you unsubscribe, the consent record is kept flagged as withdrawn, because the burden of proving consent sits with us.
• Account and business data: for as long as your account is open. If you ask us to delete your account, this data is deleted.
• Scan history: kept while your account is open so we can show your score trend.
• Invoicing and accounting records: for the statutory retention periods (typically 6 years in the UK).

9. Your rights

Under UK GDPR you have the right to access your data, have it corrected, have it erased, restrict processing, obtain portability, and object to processing.

To exercise any of these, email merhaba@georankscore.com and we will respond within one month at the latest.

If you are unhappy with how we handle your data, you may complain to the UK Information Commissioner’s Office (ico.org.uk).

10. Security

All traffic is encrypted with TLS. Passwords and sign-in codes are stored irreversibly. Card details never enter our systems.

No system is 100% secure. We take reasonable, industry-standard measures to protect your data, but we cannot guarantee absolute security.

11. Children

GeoRankScore is aimed at businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

12. Changes

We may update this policy from time to time. If a change is material we will notify registered users by email. The date at the top shows the last update.