Privacy Policy

Who we are

AEOForged (“we”, “us”) is an answer engine optimization platform operated by Ryan Kings from Stratford-upon-Avon, United Kingdom. We are the data controller for the personal data described in this policy. For any privacy question, email privacy@aeoforged.com or use our contact page.

What we collect

• Account data — your email address and, optionally, your name and organisation, when you sign up or log in (handled by our authentication provider).
• Billing data — when you subscribe or buy a Fix Pack, our payment processor (Stripe) handles your card details. We store the resulting customer, subscription, and order records, not your full card number.
• Sign-in providers — if you use Google sign-in, we receive your email and basic profile from Google. If you connect Google Search Console, we store OAuth tokens (encrypted) to read search performance for your connected properties.
• Marketing leads — if you submit your email to one of our free tools (on aeoforged.com or our companion funnel sites such as aeoscored.com, llmstxtgen.com, aishareofvoice.io, and aicrawlability.com) or sign up for updates, we store that email and the source tool. Marketing emails are sent only when you opt in.
• Content you submit — the URLs, text, and briefs you provide to our tools (audits, scoring, research, outlines, drafts). We process this to deliver the result you asked for.
• Technical data— standard server logs and privacy-respecting analytics (page views, aggregate usage) to keep the service reliable and understand what’s used.

How we use your data

• Provide, operate, and secure the service and your account.
• Process payments, credits, and Fix Pack orders.
• Run the tools you request and store the results in your workspace.
• Send transactional emails (receipts, alerts) and, where relevant, product updates you can unsubscribe from at any time.
• Improve our tools, scoring, and documentation in aggregate.

Legal bases (UK GDPR)

We rely on contract (to deliver the service you sign up for), legitimate interests (to secure, operate, and improve the platform), and consent (for optional marketing emails, which you can withdraw at any time).

Sub-processors and sharing

We do not sell your personal data. We share data only with the service providers that make the platform work, under their respective terms:

• Supabase — database, authentication, and storage (EU/US regions per their DPA).
• Vercel — hosting, serverless functions, and optional Web Analytics (only after cookie consent).
• Stripe — payments and subscription billing.
• Google — OAuth sign-in and, when you connect it, Search Console API access.
• Resend & Loops — transactional and marketing email delivery (marketing only with your opt-in).
• AI and research providers— content you submit to our tools may be processed by model and search providers (e.g. OpenAI, Anthropic, Brave, Perplexity) solely to generate your requested result. We use these providers’ API terms; your content is not used to train their public models.

Cookies

We use essential cookies to keep you signed in, remember UI preferences (such as sidebar state and your active client), and operate the service. With your consent, we load privacy-respecting Web Analytics to measure aggregate page usage. We do not use third-party advertising cookies.

• Essential — Supabase auth session, active workspace selection, sidebar preference.
• Analytics (optional)— Vercel Web Analytics, loaded only if you choose “Accept analytics” in our cookie banner.

Data retention

We keep data only as long as needed for the purposes above:

• Account & workspace data — while your account is active, plus up to 30 days after verified deletion request (for backup purge and billing reconciliation).
• Billing records — as required for tax and accounting (typically up to 7 years in the UK).
• Marketing leads & waitlist — until you unsubscribe, withdraw consent, or ask us to delete your email.
• Server logs — typically up to 30 days (hosting provider defaults).

You can export or delete your account data from Settings → Account & privacy when signed in, or email privacy@aeoforged.com.

Your rights (UK / EEA)

Under UK GDPR you have the right to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. Signed-in users can export or delete account data from Settings → Account & privacy. To exercise any right by email, contact privacy@aeoforged.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to correct inaccurate information. We do not sell or share your personal information for cross-context behavioural advertising. We do not discriminate against you for exercising these rights.

To submit a request, email privacy@aeoforged.com or use Account & privacy settings when signed in. We will verify your request and respond within the timeframes required by California law.

Children

AEOForged is a business tool not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@aeoforged.com and we will delete it.

International transfers

Some of our providers process data outside the UK/EEA. Where they do, they rely on appropriate safeguards such as Standard Contractual Clauses.

Changes to this policy

We may update this policy as the product evolves. We’ll revise the “last updated” date above and, for material changes, notify you where appropriate.