Privacy Policy

GroundScore (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data when you use the GroundScore platform (“the Service”).

Account information

When you sign up, we collect your email address and name through Google sign-in or email magic link authentication. We do not collect or store passwords. Authentication is handled through OAuth (Google) or one-time magic links (Resend).

Scan data

When you add a site to GroundScore, we scan publicly accessible pages of that domain. Scan data includes: HTTP response codes, DNS records, meta tags, robots.txt content, sitemap availability, security headers, page content for AI visibility analysis, and domain authority signals from third-party providers.

We store scan results, scores, pillar breakdowns, action items, and historical trends in our database to provide the Service, including weekly reports and score change tracking.

Payment information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other payment credentials. We receive from Stripe: subscription status, plan type, billing period dates, and payment success/failure events.

Usage data

We use PostHog for product analytics. This includes: pages viewed, features used, scan counts, and session data. PostHog is self-hosted or EU-based. We do not share usage data with advertising networks.

Anonymous quick check

The free quick check on our landing page does not require an account. We process the domain you enter to return scan results. We log the requesting IP address temporarily for rate limiting (3 requests per hour) but do not associate quick check results with any user account. IP logs are stored in memory only and are not persisted to disk.

We use the data we collect to:

• Provide and maintain the Service (scanning, scoring, reporting)
• Send transactional emails (magic link authentication, weekly digests, scan notifications)
• Process payments and manage subscriptions
• Improve the Service through aggregate, anonymized analytics
• Detect and prevent abuse (rate limiting, SSRF protection)

We do not sell your personal data or scan data to third parties.

The Service integrates with the following third-party providers:

• Stripe: payment processing (privacy policy)
• Google OAuth: authentication (privacy policy)
• Resend: transactional email delivery (privacy policy)
• PostHog: product analytics (privacy policy)
• AI search engines(ChatGPT, Perplexity, Claude, Gemini, SearchGPT): queried to estimate your site's AI visibility. We send your domain name and structured prompts. Responses are stored to compute your AI Presence score.
• Domain authority providers(Moz): queried for domain reputation signals. We send your domain name. Responses are stored as part of your Authority & Trust score.

Account data: Retained while your account is active. Upon account deletion, your personal data (name, email) is removed. Scan data may be retained in anonymized form for aggregate analytics.

Scan data: Retained for the duration specified by your plan (last 2 scans for Free, 12 months for Pro, unlimited for Agency plans). Historical scores and anonymized aggregate data may be retained indefinitely for benchmarking and research purposes.

Payment records: Billing events are retained for accounting and compliance purposes as required by law.

We use industry-standard security measures to protect your data, including: encrypted connections (HTTPS/TLS), secure authentication (OAuth 2.0, one-time magic links), and access controls on our database and infrastructure.

The Service is hosted on Railway with managed database infrastructure. We do not store passwords, payment credentials, or other high-sensitivity credentials in our application database.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your account and associated personal data
• Export your data (available in Settings)
• Object to processing of your personal data
• Withdraw consent for optional communications

To exercise any of these rights, contact us at help@groundscore.ai. We will respond within 30 days.

You can delete your account at any time from your Settings page. Account deletion removes your personal data and deactivates all monitored sites.

The Service uses essential cookies for authentication (session token) and local storage for UI preferences. We do not use advertising cookies or third-party tracking cookies.

PostHog analytics may use a first-party cookie to distinguish unique visitors. This data is used for product improvement only and is not shared with advertising networks.

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

The Service is operated from the United States. If you access the Service from outside the United States, your data may be transferred to and processed in the United States. By using the Service, you consent to this transfer.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The “Effective date” at the top of this page indicates when the policy was last revised.

Questions about this Privacy Policy? Contact us at help@groundscore.ai.