Who we are
DiscoveredBy is provided by MicroPyramid Informatics Private Limited (CIN U72300TG2014PTC092815), HIG499, Viswa Sai Dham, behind Anupama Hospital, 6th Phase KPHB, Hyderabad, Telangana 500072, India, or by the provider named in section 1 of our Terms of Service if your order form names another ("we", "our" or "us"). This policy explains what personal data we collect when you visit discoveredby.ai or use the DiscoveredBy app, API and MCP server, why we collect it, who receives it, and what rights you have.
For your account, billing and our website, we decide how personal data is used (we are the "controller", or "data fiduciary" under India's Digital Personal Data Protection Act). For personal data inside the projects you run in DiscoveredBy, we act for you under our Data Processing Agreement, and your own privacy notice applies to it.
What we collect
Your account
- Email address, when you sign up with an email sign-in link.
- Name, email and Google account ID, when you sign in with Google. We ask Google only for your basic profile; we do not store your profile picture.
- Your display name, which you can change in the app.
- Team invitations: the email address and role of anyone you invite to a project.
Sign-in and security records
- Sign-in attempts: the email address, IP address and browser for each attempt, so we can stop abuse and rate-limit sign-in.
- Activity log: important actions in your projects (such as exports and alert changes), with the user and, for some actions, the IP address. Members of that project can see it.
- Server logs: our servers record requests to the app and API, including IP addresses.
Billing
Payments are taken by Razorpay in its own checkout, so we never see your full card or bank details. We pass Razorpay your name and email to fill in the checkout, and we keep the payment and invoice records Razorpay sends back (amounts, status, dates, invoice links and the details Razorpay includes in those records).
What you put into the Service
Project details, brands, competitors, prompts, personas, cities and facts you enter, and the AI answers we collect for your prompts. This is mostly business information, but it can include personal data if you put it there, for example a person's name in a prompt.
What you connect
- Google Search Console and Google Analytics: read-only access. We import daily totals per search query, page, source, medium and country (impressions, clicks, click-through rate, average position, sessions, users, page views, conversions and conversion value). We do not import data about individual visitors.
- WordPress: your site address, username and an application password, which we store encrypted and use only to create draft posts when you ask.
- Server logs for crawler analytics: we keep only requests from known AI and search crawlers (path, status, size and whether the crawler was verified). Lines from ordinary visitors are discarded, and we do not store visitor IP addresses or browsers.
- Site audits: copies of the public pages of your website that we fetch to check them.
Our website
On discoveredby.ai we use Google Analytics to count visits and clicks on sign-up links. It receives your IP address, browser, device, the pages you view and the page that referred you. We do not use advertising cookies.
Analytics cookies are active by default when you arrive. You can turn them off by choosing Decline on the cookie notice shown on your first visit, and you can change your choice at any time with the Change your cookie choice button on our cookie policy. We honour a Decline immediately: the analytics cookies already set in your browser are deleted, and Google Analytics stops reading or setting analytics cookies. The Google Analytics script still loads, and the site still passes it page views and clicks on sign-up links, which Google receives without a cookie identifier. Our cookie policy lists every cookie the site and the app set.
The app loads fonts from Google Fonts and shows site icons from Google's icon service, so Google receives your IP address and browser when those load. The website serves its fonts itself.
How we use it, and our legal basis
- To provide the Service you signed up for: performing our contract with you.
- To keep the Service secure, prevent abuse and investigate problems: our legitimate interest in protecting our customers and systems.
- To send service email: sign-in links, alerts, weekly reports, notices when articles or analyses are ready, and notices about your account or these policies. Alert and weekly report emails can be turned off per project in Notifications settings. We do not send marketing email.
- To bill you and keep records the law requires: contract and legal obligation.
- To measure our website with Google Analytics: our legitimate interest in understanding how the site is used. You can object at any time by choosing Decline, as described above.
We do not sell your personal data, we do not use it for advertising, and we do not train AI models on it.
How AI providers are involved
To measure your visibility, we send your prompts, with the language and location you set and, where the engine supports it, the persona, to the AI engines you track. To analyse the answers and produce research, recommendations and drafts, we send OpenAI your project details, personas, facts, prompts, collected answers, text from your website's pages and, for Research and the Growth Advisor, Search Console queries and Analytics totals. Each provider handles this data under its own terms. The full list, with what each receives, is on our subprocessors page.
Google user data
DiscoveredBy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we use Google sign-in data only to sign you in, and Search Console and Analytics data only to show and analyse your own sites' performance inside your projects;
- we do not use Google user data for advertising, and we do not sell it;
- we do not use it to train AI models;
- we share it only with the subprocessors needed to provide those features, such as OpenAI for the Research and Growth Advisor analysis of your queries and totals; and
- our staff read it only with your permission, for security, or where the law requires.
You can disconnect Google at any time from the app's integration settings, which asks Google to revoke our access. You can also remove our access from your Google Account's security settings.
Who can see your data
- People in your projects, according to the role (owner, editor or viewer) you give them.
- Anyone with a share link you create for a report or an Explorer view, until it expires or you revoke it.
- Our staff, only to support you, keep the Service running or meet a legal duty. To fix a problem you report, staff may sign in to your account as you; every sign-in link we create for this is recorded in our audit log.
- Our subprocessors, as listed on the subprocessors page.
- Authorities, if the law requires it, or a buyer of our business, who would be bound by this policy.
Where your data is stored
Our servers and database are in Helsinki, Finland (European Union). Some subprocessors are in India, the United States and elsewhere, and our team works from India and the United Arab Emirates, so your data is transferred outside your country. Where the GDPR or UK GDPR requires it, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the provider's own approved transfer mechanism.
How long we keep it
| Data | Kept for |
|---|---|
| Account, project data, collected answers, imported Google data and activity records | While your account exists. Deleted within 30 days of a deletion request. |
| Crawler log data | 30 days for individual hits; 400 days for daily totals. |
| Sign-in attempt records, including for email addresses that never created an account | Kept to protect the Service from abuse. Deleted on request, unless needed to investigate abuse. |
| Server logs | Rotated automatically by size; older entries are overwritten. |
| Database backups | 7 days, then overwritten. |
| Payment and invoice records | As long as Indian tax and company law requires, currently up to eight years. |
Removing a project from the app hides it but does not erase it, so you can ask us to restore it. To erase a project or your whole account, email hello@discoveredby.ai from the account owner's address.
Your rights
Depending on where you live, you may have the right to:
- get a copy of your personal data, including in a machine-readable format;
- correct data that is wrong or incomplete;
- have your data erased;
- object to, or ask us to restrict, how we use it;
- withdraw consent where we rely on it;
- nominate someone to exercise your rights if you cannot (India); and
- complain to a data protection authority, or in India to the Data Protection Board.
These rights come from laws including the GDPR, the UK GDPR, India's Digital Personal Data Protection Act 2023 and US state privacy laws such as the CCPA. To use any of them, email hello@discoveredby.ai. We will reply within 30 days. If your data is in a project another company runs in DiscoveredBy, we will pass your request to that company.
Grievance Officer (India)
Our Grievance Officer is PENDING, MicroPyramid Informatics Private Limited, HIG499, Viswa Sai Dham, behind Anupama Hospital, 6th Phase KPHB, Hyderabad, Telangana 500072, India. Email: hello@discoveredby.ai. We aim to resolve grievances within one month of receiving them.
Security
We protect your data with access controls on every request, encryption in transit, encryption of stored integration credentials and daily backups. Our security page has the details. If a breach affects your personal data, we will tell you and the authorities as the law requires.
Children
DiscoveredBy is a business service for people aged 18 or over. We do not knowingly collect data from children.
Changes to this policy
When we make a material change, we will email account owners before it takes effect and update the date at the top of this page. We currently use 9 subprocessors; changes to that list follow the notice rules on the subprocessors page.
Contact
Questions about this policy or your data: hello@discoveredby.ai, or write to MicroPyramid Informatics Private Limited, HIG499, Viswa Sai Dham, behind Anupama Hospital, 6th Phase KPHB, Hyderabad, Telangana 500072, India.