Privacy Policy

1. What this covers

This policy explains what data AI Tracker collects, why, and how it's handled — both data about you as a customer, and data our connectors detect about AI-bot visits to your tracked websites.

2. Account data we collect

• Email address and name, when you create an account
• Billing details — handled entirely by Paddle.com (our Merchant of Record); we never see or store your card number
• API keys and tokens you generate for connectors or programmatic access

3. Website visit data we collect

When a connector installed on your website detects a likely AI-agent visit, it sends us:

• The visiting bot's user-agent string and IP address
• The URL path visited on your site, referrer, and HTTP status code
• Timestamp of the visit

We cross-check the visiting IP against each AI provider's published IP ranges to confirm the visit is genuine rather than a spoofed user-agent, and we resolve the IP to a country for reporting purposes. We do not collect data about your website's human visitors beyond what a connector explicitly captures for AI-referral tracking (e.g. a human arriving from an AI chat answer), which is handled the same way as any other visit metadata above.

4. How we use data

• To operate your dashboard and show you AI-visit analytics for your own sites
• To detect and verify AI-bot traffic, including spoofing/fraud detection
• To process billing via Paddle and manage your subscription
• To send account-related notifications (e.g. plan status, alerts you've configured)
• To improve detection accuracy and service reliability

We do not sell your data or your website visitors' data to third parties.

5. Third parties we use

• Paddle.com — billing, invoicing, and payment processing (Merchant of Record)
• Supabase — database and authentication hosting
• Vercel — application hosting
• IP geolocation lookups, to resolve visiting IPs to a country

6. Data retention

We retain your account and site data for as long as your account is active. AI-visit data is retained to support historical reporting; you can request deletion of your account and associated data at any time by contacting us.

7. Your rights

You can access, export, or request deletion of your account data at any time from your account settings, or by emailing us. If you're in a jurisdiction with statutory data protection rights (e.g. GDPR, CCPA), we'll honor requests consistent with those rights.

8. Security

API tokens are encrypted at rest. We use industry-standard practices to protect your data, but no method of transmission or storage is 100% secure.

9. Changes to this policy

We may update this policy from time to time; material changes will be reflected here with an updated date.

10. Contact

Questions about this policy or your data: ish@hardstuck.ai