Who we are

DiscoveredBy is provided by Runcode Inc, a Delaware corporation based in Plano, Texas, United States ("we", "our" or "us"). This policy explains what personal data we collect when you visit discoveredby.ai or use the DiscoveredBy app, API and MCP server, why we collect it, who receives it, and what rights you have.

For your account, billing, our website and the free site audit, we decide how personal data is used (we are the "controller", or "data fiduciary" under India's Digital Personal Data Protection Act). For personal data inside the projects you run in DiscoveredBy, we act for you under our Data Processing Agreement, and your own privacy notice applies to it.

What we collect

Your account

Email address, when you sign up with an email sign-in link.
Name, email and Google account ID, when you sign in with Google. We ask Google only for your basic profile; we do not store your profile picture.
Your display name, which you can change in the app.
Team invitations: the email address and role of anyone you invite to a project.

Sign-in and security records

Sign-in attempts: the email address, IP address and browser for each attempt, so we can stop abuse and rate-limit sign-in.
Activity log: important actions in your projects (such as exports and alert changes), with the user and, for some actions, the IP address. Members of that project can see it.
Server logs: our servers record requests to the app and API, including IP addresses.

Billing

Payments are taken by Stripe on its own checkout and billing pages, so we never see your full card or bank details. We pass Stripe your name and email to set up your billing account. We keep the payment, invoice and subscription records Stripe sends us, which include your billing name, email and address, and your tax ID if you give one.

What you put into the Service

Project details, brands, competitors, prompts, personas, cities and facts you enter, and the AI answers we collect for your prompts. This is mostly business information, but it can include personal data if you put it there, for example a person's name in a prompt.

What you connect

Google Search Console and Google Analytics: read-only access. We import daily totals per search query, page, source, medium and country (impressions, clicks, click-through rate, average position, sessions, users, page views, conversions and conversion value). We do not import data about individual visitors.
WordPress: your site address, username and an application password, which we store encrypted and use only to create draft posts when you ask.
Server logs for crawler analytics: we keep only requests from known AI and search crawlers (path, status, size and whether the crawler was verified). Lines from ordinary visitors are discarded, and we do not store visitor IP addresses or browsers.
Site audits: copies of the public pages of your website that we fetch to check them.

Our website

On discoveredby.ai we use Google Analytics to count visits and clicks on sign-up links. It receives your IP address, browser, device, the pages you view and the page that referred you. We do not use advertising cookies.

Analytics cookies are active by default when you arrive. You can turn them off by choosing Decline on the cookie notice shown on your first visit, and you can change your choice at any time with the Change your cookie choice button on our cookie policy. We honour a Decline immediately: the analytics cookies already set in your browser are deleted, and Google Analytics stops reading or setting analytics cookies. The Google Analytics script still loads, and the site still passes it page views and clicks on sign-up links, which Google receives without a cookie identifier. Our cookie policy lists every cookie the site and the app set.

The app loads fonts from Google Fonts and shows site icons from Google's icon service, so Google receives your IP address and browser when those load. The website serves its fonts itself.

Images in our blog are served from media.discoveredby.ai, our media host, which runs on Amazon Web Services (Amazon CloudFront, delivering files we store in Amazon S3). When you open the blog or a post, your browser fetches its images from there, so Amazon receives your IP address and browser.

Some blog posts include a YouTube or Vimeo video, shown as a card you click to play. The video player, with its scripts and cookies, loads only when you click the card. Before that, a Vimeo card loads nothing from Vimeo, while a YouTube card shows the video's thumbnail image, which your browser fetches from YouTube's image server (i.ytimg.com) as the card nears the screen, so Google receives your IP address and browser. When you click play, the player loads from YouTube's privacy-enhanced domain (youtube-nocookie.com) or from Vimeo with its do-not-track setting on. YouTube or Vimeo then receives your IP address, your browser, the video you play and our site's address (not the post you are reading), may set cookies or store data in your browser, and handles all of this under its own privacy policy. Opening the card in a new tab takes you to the video on YouTube or Vimeo itself.

The free site audit

Anyone can audit a public website for free at discoveredby.ai/site-audit, without an account. For each free audit we store:

The site that was entered, when the audit was requested, crawled and deleted, its headline results (pages crawled, issue counts and the top issues) and any notes our team adds.
Email addresses: each address someone asked us to send a code to, whether it was verified by entering that code, and whether "Send me occasional product updates" was ticked. That box is unticked unless you tick it.
A hashed IP address for the visitor who started the audit and for each code request: a keyed hash, never the IP address itself. To enforce the limits on codes, we also count code requests by hashes of the email address and the IP address.
Crawl data: the pages of that site we fetch, and the results built from them.

We send a code only to the address typed into the form, and the report only to an address verified by entering the code we sent it. A free audit's results are public: anyone who enters the same site sees them until the crawl data is deleted. They never show email addresses, IP hashes or who started or upgraded the audit, and the results page asks search engines not to index it.

The start form and the send-code form use Cloudflare Turnstile to check that a person, not a bot, is using them. The pages that show these forms load Turnstile from Cloudflare (challenges.cloudflare.com), so Cloudflare receives your IP address and signals from your browser, such as its user agent and TLS fingerprint. To confirm each check, our server sends Cloudflare the check's token and your IP address. We do not send Cloudflare your email address.

How we use it, and our legal basis

To provide the Service you signed up for: performing our contract with you.
To keep the Service secure, prevent abuse and investigate problems: our legitimate interest in protecting our customers and systems.
To send service email: sign-in links, alerts, weekly reports, notices when articles or analyses are ready, and notices about your account or these policies. Alert and weekly report emails can be turned off per project in Notifications settings. We send no marketing email, except occasional product updates to a verified free site audit address whose product-updates box was ticked, as described below.
To bill you and keep records the law requires: contract and legal obligation.
To measure our website with Google Analytics: our legitimate interest in understanding how the site is used. You can object at any time by choosing Decline, as described above.
To run the free site audit someone asks for: crawling the site, sending the code, sending the report to each verified address, and enforcing the free audit's limits and blocks to stop abuse. Our team may also contact a verified address about the audit that address asked for, such as about its report. This is our legitimate interest in providing the audit and report that were asked for and in keeping the free audit from being misused.
To send occasional product updates, the only marketing email we send: only to a free site audit address that was verified and whose "Send me occasional product updates" box was ticked. A ticked box alone is not enough, because anyone can type an address into the form. This relies on your consent, which you can withdraw at any time, as described under Your rights below.

We do not sell your personal data, we do not use it for advertising, and we do not train AI models on it.

How AI providers are involved

To measure your visibility, we send your prompts, with the language and location you set and, where the engine supports it, the persona, to the AI engines you track. To analyse the answers and produce research, recommendations and drafts, we send OpenAI your project details, personas, facts, prompts, collected answers, text from your website's pages and, for Research and the Growth Advisor, Search Console queries and Analytics totals. For the Search plan, we send OpenAI (through Codex) your Search Console queries with their impressions, positions and page paths, your tracked prompts, keywords and business profile, to group them into topics, and we send DataForSEO each topic's search term to look up its monthly search volume. Each provider handles this data under its own terms. The full list, with what each receives, is on our subprocessors page.

Google user data

DiscoveredBy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

we use Google sign-in data only to sign you in, and Search Console and Analytics data only to show and analyse your own sites' performance inside your projects;
we do not use Google user data for advertising, and we do not sell it;
we do not use it to train AI models;
we share it only with the subprocessors needed to provide those features, such as OpenAI for the Research, Search plan and Growth Advisor analysis of your queries and totals; and
our staff read it only with your permission, for security, or where the law requires.

You can disconnect Google at any time from the app's integration settings, which asks Google to revoke our access. You can also remove our access from your Google Account's security settings.

Who can see your data

People in your projects, according to the role (owner, editor or viewer) you give them.
Anyone with a share link you create for a report or an Explorer view, until it expires or you revoke it.
Anyone who enters the same site in the free site audit, which shows that site's results until its crawl data is deleted, without email addresses, IP hashes or who asked for the audit. Our staff see the whole free audit record, email addresses included, to contact verified addresses about the audits they asked for, to send occasional product updates to the verified addresses whose box was ticked, and to stop abuse.
Our staff, only to support you, keep the Service running or meet a legal duty. To fix a problem you report, staff may sign in to your account as you; every sign-in link we create for this is recorded in our audit log.
Our subprocessors, as listed on the subprocessors page.
Authorities, if the law requires it, or a buyer of our business, who would be bound by this policy.

Where your data is stored

Our servers and database are in Helsinki, Finland (European Union). Some subprocessors are in India, the United Arab Emirates, the United States and elsewhere, and we and our technology partners work from the United States, India and the United Arab Emirates, so your data is transferred outside your country. Where the GDPR or UK GDPR requires it, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the provider's own approved transfer mechanism.

How long we keep it

Data	Kept for
Account, project data, collected answers, imported Google data and activity records	While your account exists. Deleted within 30 days of a deletion request.
Crawler log data	30 days for individual hits; 400 days for daily totals.
Sign-in attempt records, including for email addresses that never created an account	Kept to protect the Service from abuse. Deleted on request, unless needed to investigate abuse.
Free site audit crawl data: the pages fetched and the results built from them	Kept while a crawl waits or runs, then deleted 48 hours after the crawl whose results the audit shows finishes, or at once when the audit's first crawl saves no page. An upgrade crawl that saves no page is deleted at once, and the earlier 25-page results keep their own 48 hours.
Free site audit records: the site, email addresses, product-updates choices, hashed IP addresses, headline results and our notes	Kept until our team deletes the record. Deleted on request.
Blocks we place on a site, an email address, an email domain or a hashed IP address to stop abuse of the free site audit	Kept until our team removes the block.
Hashed counters for the free site audit's code limits	2 days.
Server logs	Rotated automatically by size; older entries are overwritten.
Database backups	7 days, then overwritten.
Payment and invoice records	As long as tax and company law requires.

Removing a project from the app hides it but does not erase it, so you can ask us to restore it. To erase a project or your whole account, email hello@discoveredby.ai from the account owner's address. To have a free site audit record deleted, email the same address with the site or the email address it holds.

Your rights

Depending on where you live, you may have the right to:

get a copy of your personal data, including in a machine-readable format;
correct data that is wrong or incomplete;
have your data erased;
object to, or ask us to restrict, how we use it;
withdraw consent where we rely on it;
nominate someone to exercise your rights if you cannot (India); and
complain to a data protection authority, or in India to the Data Protection Board.

These rights come from laws including the GDPR, the UK GDPR, India's Digital Personal Data Protection Act 2023 and US state privacy laws such as the CCPA. To use any of them, email hello@discoveredby.ai. We will reply within 30 days. If your data is in a project another company runs in DiscoveredBy, we will pass your request to that company.

Grievance Officer (India)

Our Grievance Officer is Kamal Karna, Runcode Inc, Plano, Texas, United States. Email: hello@discoveredby.ai. We aim to resolve grievances within one month of receiving them.

Security

We protect your data with access controls on every request, encryption in transit, encryption of stored integration credentials and daily backups. Our security page has the details. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Children

DiscoveredBy is a business service for people aged 18 or over. We do not knowingly collect data from children.

Changes to this policy

When we make a material change, we will email account owners before it takes effect and update the date at the top of this page. We currently use 12 subprocessors; changes to that list follow the notice rules on the subprocessors page.

Contact

Questions about this policy or your data: hello@discoveredby.ai.

Privacy Policy