Privacy Policy

1. Information We Collect

We collect information you provide directly to us (name, email, business info), usage data (pages visited, features used), and business data you connect (Google Search Console, Google Analytics, Blogger, website URL, and any social accounts you authorize for publishing). We use cookies, local storage, and similar tracking technologies to collect this usage data and operate the Service; see our Cookie Policy for details and how to manage your preferences. We do not sell your personal data.

Our use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data obtained through Google APIs (including Google Search Console, Google Analytics, and Blogger) to develop, train, or fine-tune generalized AI or machine learning models.

2. Google User Data

If you choose to connect a Google account, we request only the access listed below, and only after you click Connect and approve it on Google’s consent screen:

• Google Search Console (read-only): search performance data for your verified sites, such as queries, clicks, impressions, and pages. We show it in your dashboard.
• Google Analytics 4 (read-only): traffic reports for your property, specifically session counts by traffic source, so we can show how much of your traffic arrives from AI search tools.
• Blogger: the list of your blogs, and publishing articles you have approved to the blog you choose.

We use this data only to provide these features to you inside Discov AI. We do not use it for advertising, we do not sell it, and we do not transfer it to others except (a) to the subprocessors described in Section 5 that run the Service on our behalf, (b) with your consent, (c) as needed to comply with law, or (d) as part of a merger or sale, with notice to you. No person at Discov AI reads your Google data except with your consent, for security or abuse investigation, or where the law requires.

Where a feature uses an AI language model provider to generate text for you, we send that provider only what the feature needs. Our providers are configured so they do not train on it, and we do not use your Google data to train generalized AI or machine learning models.

We store the access tokens Google gives us in encrypted form, and we do not store your Google password. You can disconnect any Google connection at any time from Integrations in the app, and you can also revoke our access at myaccount.google.com/permissions. When you disconnect, we remove the connection and overwrite the stored tokens so they can no longer be used. Deleting your account from Settings > Account also removes your integration credentials.

3. How We Use Your Information

We use your information to provide and improve the Discov AI service, generate your Visibility Score, publish content on your behalf (with your authorization), send product updates, and respond to support requests.

4. Data Storage and Security

All data is stored on secure, encrypted servers. We use industry-standard encryption protocols for data in transit and at rest. We do not store Google or social media passwords.

For active accounts, we retain Customer Data for as long as the account remains active and as needed to provide the Service. Operational log data is retained only as long as needed for security, debugging, and abuse-prevention purposes, and backup archives follow our infrastructure providers’ standard backup rotation schedules, protected by the same security controls as production data. Upon account cancellation or termination, Customer Data remains available for export for 60 days, after which it may be permanently deleted from our active systems, consistent with our Terms of Service.

5. Third-Party Services

We share data with categories of third-party subprocessors as necessary to deliver our service, including: AI large language model providers, cloud infrastructure and hosting providers, authentication providers, payment processors, transactional email providers, search and business-data providers, and social media and content-publishing integrations you authorize. Each has its own privacy policy.

We do not use Customer Data to train, fine-tune, or otherwise develop our own foundation models or proprietary AI algorithms. We select and configure our subprocessors specifically to prevent them from using Customer Data to train their own foundation models. If we become aware that a subprocessor’s terms no longer support this restriction, we will promptly transition to an alternative subprocessor or configuration that does, and will notify you without undue delay if your data was processed by that subprocessor in the interim.

6. International Data Transfers

Where personal data is transferred from the EEA, UK, or Switzerland to the United States or another jurisdiction without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or another legally recognized transfer mechanism with our subprocessors to protect that data.

7. Children’s Privacy

The Service is intended for business users and is not directed to, or knowingly used by, children under 13 (or 16 where applicable local law requires a higher age). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@discov.us and we will delete it.

8. Your Rights

Depending on where you live, you have some or all of the following rights over your personal data. Contact us at support@discov.us to exercise any of them; we respond within 30 days (or sooner where required by law). We operate as a digital-first service and handle all privacy requests and correspondence electronically.

If GDPR applies to you (EU/UK/EEA):

We process your personal data based on the following lawful bases: to perform our contract with you, to comply with legal obligations, for our legitimate interests in operating and improving the Service, and, for non-essential cookies and similar tracking technologies, your consent.

• Access — request a copy of the personal data we hold about you. You can download it yourself at any time from Settings > Account > "Download my data" (JSON).
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data, subject to legal retention requirements. You can delete your account from Settings > Account, which removes your data, stored files, and integration credentials and cancels your subscription.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on our legitimate interests, including profiling.
• Lodge a complaint with your local data protection authority.

If CCPA/CPRA applies to you (California):

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we hold about you, subject to certain exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. We do not sell your personal data, nor do we “share” it for cross-context behavioral advertising purposes as defined under the CPRA. Our AI and analytics subprocessors operate strictly as Service Providers, consistent with our Terms of Service. If you have questions about our data practices, contact us at support@discov.us.
• Right to non-discrimination for exercising any of these rights.
• We do not collect or process Sensitive Personal Information as defined under CPRA.
• We do not currently automatically recognize browser-based opt-out signals such as Global Privacy Control (GPC); to opt out of any applicable sale/sharing, contact us at support@discov.us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting the updated policy here with a new effective date.