The short version.
The rest of this page gives the detail. If anything here and the detail ever disagree, the detail wins.
We don't sell your data
Not to data brokers, not to anyone. The only advertising "sharing" is ad measurement on our own website, which you can switch off in one click.
Your content stays yours
Your workspaces, connected accounts and leads are used to run your dashboard. Other customers never see them, and we don't train AI models on them.
Every vendor is named
Everyone who processes personal data for us is listed below, with what they get and where they are — including every AI model we use.
Your customers' data is yours to control
When you install our chat widget, site tag or form catcher, or import customers, we handle that data for you and only on your instructions.
You're in control
Export your data or delete your account from Settings. Disconnect any service anytime. Email privacy@aisyndicate.com for anything else.
Plain answers, fast
We answer privacy requests within 30 days, usually much sooner, and never charge for a reasonable request.
The company responsible for your personal information.
AI Syndicate Collective LLC
A Florida limited liability company operating the AI Syndicate brand, website, and software.
Mailing address:
7901 4TH ST N, STE 300
St. Petersburg, FL 33702
United States
Privacy contact
Questions, access requests, deletion requests, or complaints: privacy@aisyndicate.com.
We respond within 30 days. Complex requests may take up to 60 days, in which case we'll tell you why.
Sometimes we decide what happens to data. Sometimes our customer does.
Privacy law gives these roles names: a controller decides why and how data is used; a processor handles it on someone else's instructions.
We're the controller for…
Our own customers' accounts and billing, visitors to aisyndicate.com, people who request a GEO score, book a call, chat with us or apply for a job, and the public web measurements we take to run the service. This policy covers all of that.
We're a processor for…
Data our customers collect through us about their visitors, leads and customers — chat-widget conversations, form submissions, AI-referral visits, imported customer lists, CRM contacts, and the outreach and review requests they send. The customer decides how it's used, under their own privacy policy and our Terms. See "Data we handle for our customers".
The personal data we collect, where it comes from, and why.
Personal data we don't get from you directly.
Public web pages and AI answers
Our crawler (AISyndicateBot) reads publicly available pages, and we record what AI assistants say in answer to questions. Both describe businesses, and can mention the people behind them — for example a lawyer's or realtor's name on their own website. We use this to measure visibility, never to build profiles of individuals.
Listings and reviews
Public business listings, map results and reviews (including a reviewer's public display name and review text), so a business can see and reply to what's said about it.
Business contacts (Lead Finder)
If a customer uses Lead Finder, we look up business contacts that match their ideal customer — name, job title, company, work email and LinkedIn profile — from Apollo.io, a business-contact database. It's work contact information only. If you've been contacted this way and want us to delete your details and not look you up again, email privacy@aisyndicate.com.
Leads sent by our customers' tools
A customer can forward leads to their AI Syndicate inbox from their own CRM, ad forms or lead networks. We process those as their processor.
If you visited or dealt with one of our customers, here's what our tools do.
Our customers add these tools to their own websites and businesses. They decide what to collect and are responsible for telling you about it. We use it only to provide the tool to that customer.
Want to see, correct or delete this data? Ask the business first — they control it. If you can't reach them, email privacy@aisyndicate.com and we'll pass your request on and help them respond.
The specific purposes we use personal information for.
Run the service
Create accounts, sign you in, store workspaces, run audits and AI checks, show dashboards, publish what you ask us to publish, take payments.
Security and fraud prevention
Stop unauthorized access, fake signups, abuse of free tools, fraudulent payments and attacks.
Support and service messages
Answer questions and send the emails the service needs to send: sign-in codes, receipts, security alerts, reports you've scheduled.
Product improvement
Look at usage, in aggregate wherever we can, to find bugs and decide what to build next.
Benchmarks
We keep measurements of public web pages and AI answers (such as visibility scores and citation rates) and combine them across customers into statistics — counts and averages only. Benchmarks never identify a customer, their workspace or their private content, and never use Google user data.
Marketing you've asked for
If you request a GEO score or book a call, we send a short series of follow-up emails. Every one has an unsubscribe link. We stop once you become a customer.
Measuring our ads
Measuring whether our Facebook, Instagram and ChatGPT ads lead to signups and bookings, under the rules in "Your ad & analytics choices".
Hiring
Reviewing job applications you send us.
Legal compliance
Meet legal obligations, answer lawful requests, defend legal claims, enforce our agreements.
How AI is used on your data, and what's decided automatically.
Which AI sees what
Our AI features (Caite, drafts, reports, the chat widget) run on Anthropic's models. To measure how AI assistants talk about a business, we ask ChatGPT, Gemini, Perplexity, Grok, Meta AI, Le Chat, DeepSeek and Copilot the questions being tracked — those checks carry business names, websites and questions, not your account or contact details. Every provider is listed under "Subprocessors".
No training on your data
We don't use your content, your connected accounts or your customers' data to train AI models, and we use AI providers through their business APIs rather than consumer apps. Google user data is covered by the stricter rules in "Google user data".
You approve what goes out
AI-written replies, posts and emails are drafts unless you turn on automatic publishing for that feature. You can switch automation off at any time.
Automated decisions
Two things are decided automatically. Signup checks can refuse an account that matches patterns we see in fake signups (such as a machine-generated name). Lead scoring gives our customers a 0–100 buy-intent score so they know who to reply to first; a person at that business decides what happens next. If a signup check blocks you, email privacy@aisyndicate.com and a person will review it.
If you're in the EU, UK, or a similar jurisdiction, the legal basis for each activity.
What we do with the Google accounts you connect.
Connecting a Google service is always optional and only happens when you click Connect and approve it on Google's own consent screen. This section covers the data AI Syndicate receives through Google APIs.
Limited Use. AI Syndicate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use it
Only to provide and improve the features you use in your own dashboard. We do not sell Google user data, use it for advertising or to build ad profiles, use it to decide credit or lending, or combine it into datasets or benchmarks shared across customers. Other customers never see it.
AI processing
Some features send a limited part of this data — for example your Search Console search terms or the text of a review you're replying to — to our AI model provider (Anthropic, listed below) solely to produce the result you asked for. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, and our provider does not train its models on it.
Who can see it
Our staff don't read your Google data unless you ask us to (for example in a support request), it's needed for security or abuse investigations, or the law requires it.
How it's protected
It moves over encrypted connections (TLS) and is stored in our database provider (Supabase), which encrypts data at rest. On top of that, every Google connection token is encrypted by us (AES-256) with a key that is kept separately from the database, and tokens are only ever used by our servers — never sent to your browser.
Disconnecting and deleting
You can disconnect any Google service in Settings → Integrations or in its own tab. That deletes our stored connection token straight away, and when it's your last connected Google service we also revoke AI Syndicate's access with Google. You can revoke our access at any time at myaccount.google.com/permissions. Deleting your account removes all data we received from Google within 30 days. To have specific Google data deleted sooner, email privacy@aisyndicate.com.
Only what's needed
We ask for each permission only when you connect the feature that needs it, and only the narrowest permission that feature requires.
Every vendor that processes personal data for us.
We give at least 30 days' notice before adding or replacing a subprocessor, except where an urgent security or legal need requires a faster change.
Core infrastructure
Billing, email, messaging & scheduling
AI model providers
These run our AI features and the checks that measure how AI assistants describe businesses. They receive the questions being checked, business names, websites and facts, and the text a feature is working on — not your account password, payment data or connection tokens.
Search, web & business data
Publishing, creative & delivery partners
These partners are named in our Data Processing Addendum, which customers can request.
Sign-in, analytics & advertising (Google, Microsoft, Meta, OpenAI)
Services you connect yourself — your social networks, website CMS, code repositories, point-of-sale or booking system — aren't our subprocessors: you're directing us to send data to them. Subscribe to changes on the Subprocessors page.
Data Processing Addendum (DPA)
Customers who need one can get a Data Processing Addendum. It covers the data we handle for you, names every partner above, and incorporates the European Commission's Standard Contractual Clauses and the UK Addendum. Email privacy@aisyndicate.com to request it.
What loads depends on where you are, and you can always switch it off.
Outside the US, California and New York, or anywhere we can't tell
Google Analytics, Microsoft Clarity and the Meta and OpenAI ad pixels stay off until you opt in on our consent banner. That covers the EU, UK, Switzerland, Canada and every other country, US visitors in California and New York, and any US visitor whose state we can't tell. In California we also turn on Meta's Limited Data Use setting if you opt in.
Other US states
Their privacy laws use an opt-out model, so analytics and ad measurement are on by default, and our banner tells you so on your first visit (on pricing and checkout pages the Privacy preferences button does instead, so nothing covers the buy buttons). Opt out anytime under Privacy preferences at the bottom of any page.
Global Privacy Control, everywhere
If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of sale and sharing, in every region: the pixels never load and no conversion events are sent.
We choose the region from the approximate country and US state our hosting provider derives from your connection; we don't store your IP address to do it. Our cookieless site analytics and performance measurement run for everyone, because they don't identify you or follow you across sites.
Where your data is processed.
Mainly in the United States
We operate from the US, and most of our subprocessors are here. Your data will be transferred to, stored and processed in the US, whose protections may differ from your country's.
EU, UK and Swiss safeguards
For personal data from the EU, EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the Swiss equivalents.
AI checks outside the US
Two of the AI assistants we measure are run from outside the US: Mistral (Le Chat) in the EU and DeepSeek in China. Those checks send only the questions being tracked and business names and websites — never your account, contact or payment details, and never Google user data.
EU representative (GDPR Art. 27)
We have no establishment in the EU. We'll appoint an EU representative if our processing requires one under Article 27; we believe it doesn't yet, and we'll update this section if that changes. EU residents can write to us in any official EU language; we'll reply in English.
How long we keep your data.
How we protect your data.
Encryption in transit
All traffic uses TLS 1.2 or higher.
Encryption at rest
Our database, file storage and backups are encrypted by our providers. Tokens for Gmail, social accounts, website CMSs, code repositories, point-of-sale systems and ad accounts are also encrypted by us (AES-256-GCM).
Passwords
Stored only as salted hashes by our sign-in provider, never in plain text, and checked against known breached passwords.
Two-factor sign-in
Add an authenticator app, and a backup phone for SMS recovery.
Locked-down data
Connection tokens and other people's data are readable only by our servers, never from a browser. Staff access is limited to people who need it.
Breach notification
If a breach affects your data, we tell you and the relevant regulators without undue delay and within the legal deadlines — including 72 hours to a supervisory authority under GDPR Article 33 where there's a risk to you.
No system is perfectly secure. We use reasonable measures suited to the data we hold, but we can't guarantee absolute security. Found a vulnerability? See our security.txt.
What you can ask us to do, depending on where you live.
Everyone
- Access — get a copy of your data.
- Correction — fix anything inaccurate.
- Deletion — delete your account and data, subject to the retention above.
- Portability — take your data with you in a machine-readable format.
- Unsubscribe — stop marketing emails (service emails continue).
- Withdraw consent — for anything we do with your consent.
EU / UK (GDPR)
- Restrict how we use your data in some situations.
- Object to anything we do on legitimate interests — including Lead Finder lookups and web measurements.
- Human review of an automated signup decision.
- Complain to your supervisory authority (UK: ICO; EU: see edpb.europa.eu).
California (CCPA / CPRA)
- Right to know what we collect, use and disclose.
- Right to delete and to correct.
- Right to opt out of sale or sharing — we don't sell; the only "sharing" is ad measurement on our site. Opt out under Privacy preferences, or with GPC.
- Right to limit use of sensitive personal information.
- Right to non-discrimination for using these rights.
- An authorized agent can make a request for you, with proof.
Other US states
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with privacy laws have similar rights. Email privacy@aisyndicate.com.
If we turn down a request, you can appeal by replying to our email; we'll answer within your state's deadline.
How to use your rights
In the dashboard. Go to Settings → Privacy · AI controls → Your data to download a JSON export instantly — your account, workspaces, audits, leads inbox, connections (without tokens), and consent and terms records — or to request deletion. Deletion happens 30 days later so you can cancel; after that it can't be undone.
By email. For anything the export doesn't include (such as CRM contacts, chat transcripts or campaign drafts), if you don't have an account, or for corrections, email privacy@aisyndicate.com from your account email, or from another address with enough detail for us to verify you. We reply within 30 days (up to 60 for complex requests), free unless a request is clearly unfounded or excessive.
What we collect, and what we don't.
Under California's CPRA and similar laws, some data counts as "sensitive personal information." The only kind we collect is account credentials — password hashes and two-factor factors — and we use them only to sign you in and keep your account secure. We don't use them to infer anything about you or for advertising, so there's nothing further to limit.
We don't collect Social Security, driver's license or passport numbers, precise GPS location, or biometric, health, racial, religious or sexual-orientation data. Our providers derive an approximate region from your IP address for security and to apply the right privacy rules. Photos you upload for posts are used as creative material only — never for face recognition.
AI Syndicate is for businesses and adults.
Our service isn't meant for children under 16 and we don't knowingly collect their personal information. If a child has given us personal information, email privacy@aisyndicate.com and we'll delete it promptly.
How we update this policy.
We update this policy as the product changes. The effective date at the top shows the latest version. For material changes we give prominent notice — usually an email to registered users at least 30 days before the change takes effect.
Change history:
- October 11, 2026 — When you set up your account, we ask you to confirm your mobile number with a one-time texted code (US and Canadian numbers). Once confirmed, it can get you back into your account if you forget your password, and you can also use it for two-step sign-in. In the EU and Canada this step is optional. Codes are stored only as one-way keyed hashes, and the number is never used for marketing. Replying STOP to any of our texts removes the number as a recovery phone. If you start a purchase and don't finish, Stripe saves your checkout for 30 days; we email you that link once, only if you ticked the box on Stripe's page to hear from us. On our pricing and checkout pages the consent banner no longer opens over the buy buttons; the Privacy preferences button is there instead, and nothing that needs your consent loads until you choose.
- October 8, 2026 — We now ask for a phone number when you create an account or request a free GEO score, so our team can call you about your account or your score. It's stored with your account or lead record and is never used for marketing texts.
- October 11, 2026 — Added Microsoft Clarity to site analytics: heatmaps and session replays of our public pages (never the dashboard or sign-in pages), with text you type masked. It follows the same consent rules as Google Analytics, and Clarity data isn't linked to Microsoft Advertising.
- September 30, 2026 — Full review against how the product works today. Added: a summary; our controller and processor roles; the data our tools handle for customers (chat widget, site tag, form catcher, review requests, leads, CRM and outreach); data from other sources (public web, listings and reviews, Lead Finder business contacts); AI and automated decisions; job applicants; team, terms-acceptance and consent records; a retention table; and the "Google user data" section (what we read, do and keep for each Google service you connect, plus our Limited Use commitment). The subprocessor list now names every provider, including all AI model providers and the checks sent to DeepSeek in China. Changed: visitors in California and New York are now asked before any analytics or ad measurement loads, like visitors outside the US; a default we set automatically for them before is dropped and they're asked again. Corrected: in the other US states, analytics and ad measurement are on by default with an opt-out (they were described as off everywhere); server-side ad conversion events are sent only for call bookings; the export describes what it actually contains. These describe practices already in place.
- September 15, 2026 — Free trials discontinued. Plans are paid from the first day, so we no longer collect the trial-eligibility fingerprints (phone and card) described in the July 28 entry. SMS verification codes are now used for account recovery only.
- July 28, 2026 — New data category: one-way keyed fingerprints of the mobile number and card used to start a free trial, kept to enforce one free trial per customer. They can't be reversed and were never used to contact or charge you.
- July 27, 2026 — Disclosure update: de-identified measurements of public web pages and AI answers are retained and combined across customers into benchmarks.
- July 6, 2026 — Disclosure update: Google Tag Manager and Google Analytics 4, and the "Lead" conversion events (client-side and server-side via Meta's Conversions API and OpenAI's conversion API) that accompany our ad pixels.
- May 11, 2026 — Initial publication.
Questions, concerns, or a privacy request?
Email us. We respond within 30 days — usually much sooner.