Privacy Policy

1. What we collect

Account data. Your name, email address and authentication credentials. If you sign in with Google we receive your email, name and profile image from Google, nothing else.

Free AI visibility check. The check is email gated. When you run one we store the domain you entered and the email you gave, create an account for you, send you a one click login link, and keep the resulting report so you can share it by link. That report page is public to anyone holding the link.

Usage data. The brands and domains you track, the prompts generated for them, the reports and analyses you run, and your plan and billing status.

AI crawler visits, if you install the collector. Covered separately in section 4 because it works differently from everything else here.

2. Data we fetch on your behalf

To produce a report we call third party services with the domain or keywords you asked about:

• Google Ads API: keyword search volumes, CPC, competition and suggestions. Used only to power keyword research and market analysis inside LadderFox. We do not use Google Ads API data for advertising, and we never create or manage ad campaigns for you.
• Google Search Console: if you connect your account, we read your search analytics (queries, clicks, impressions, CTR, position) to ground prompts in the demand your site already has. Read only access, revocable at any time.
• DataForSEO: domain metrics, ranked keywords, backlinks, and Google AI Overviews results.
• Serper.dev: search results for keyword difficulty and SERP analysis.
• Reddit: public threads and comments, read only. We never post anything, anywhere, on your behalf.

3. What we send to AI providers

Measuring AI visibility means asking the assistants questions, so this is the part worth reading carefully.

To run a check we send your public homepage content, your brand and category, and the generated buyer questions to OpenAI, Anthropic, Google and Perplexity, depending on which engines your plan covers. We use their business APIs, not consumer accounts.

We do not send your account details, your billing data, your Search Console data or anything from another customer. We ask about public information about your brand, which is by definition what the engines already answer with.

4. The AI crawler collector

If you install our collector, it runs on your own server and inspects each incoming request. It only sends us a request whose user agent matches a known AI crawler such as GPTBot or PerplexityBot. Your human visitors are matched, discarded locally, and never transmitted to us. There is no cookie, no visitor identifier and no page content involved.

For each crawler visit we receive the user agent, the path, a timestamp and the source IP. The IP is used only to check the request against the crawler operator's published address ranges, and is never stored. What we keep is a daily count per crawler per page.

5. How we use it

• Provide, maintain and improve LadderFox
• Generate AI visibility reports, keyword research and strategy analyses
• Send transactional email: reports, login links, alerts when your score changes, password resets and billing notices
• Send a short onboarding sequence after a free check, which you can leave from any of those emails. Paid customers are removed from it automatically.
• Detect and prevent abuse

We do not sell your personal data. We do not use your data to train models. We do not use Google Ads API data for anything other than providing keyword research to you.

6. Processors we rely on

• Neon (EU region): our PostgreSQL database
• Vercel: application hosting and delivery
• Resend: transactional and onboarding email
• Stripe: payments. Card details go directly to Stripe and never reach our servers
• PostHog: product analytics
• Sentry: error monitoring
• Cloudflare Turnstile: abuse protection on the free check
• The data providers and AI providers named in sections 2 and 3

7. Storage and security

Data is stored in a PostgreSQL database hosted on Neon in the EU. All connections are encrypted with SSL. Passwords are hashed with bcrypt at a cost factor of 12, and authentication and unsubscribe tokens are signed with HMAC-SHA256.

8. Retention

• Reports and tracked brand history: kept while your account is active, because the whole point is comparing today against your baseline
• Cached keyword metrics: deleted after 30 days
• Cached search results: 24 hours
• Crawler analytics: the daily totals are kept for as long as your account is active; the per page detail is pruned on a rolling window that depends on your plan
• Shared report pages: live until you ask us to remove them

9. Your rights

Under GDPR you can access, correct, export or delete your personal data. You can revoke any third party connection such as Google Search Console at any time, unsubscribe from non transactional email from any email we send, and delete your account and its data. Email info@ladderfox.com and we will action it.

Our use of Google APIs follows the Google Ads API Terms and the Google API Services User Data Policy.

10. Changes and contact

If we change how we handle data we will update this page and its date. For anything privacy related, contact info@ladderfox.com.