Privacy Policy

1. What we collect

• Account details. Your name and email address. You can sign in with an email and password, a link we email you, Google, or GitHub. If you use a password, we store a hash of it, not the password itself. If you use Google or GitHub, they send us your name, email address and basic profile details.
• Your sites and content. The websites, sitemaps, pages, keywords, brand and competitor details you add, and the content you create in spyc.
• Connected accounts. When you connect a publishing platform or social account, we hold the access it grants, so spyc can publish to it for you. For LinkedIn and Reddit, we also read how those posts performed. For Instagram, see section 3.
• Payments. Dodo Payments runs checkout and billing. We do not store your card number.
• Free tools. You can run the free tools on spyc.ai without an account. Whatever URL or text you enter is sent to the providers that tool uses (see section 5).
• Call bookings. If you book a call on our booking page, Calendly collects your name, email address and time zone.

2. Signing in with Google

When you sign in with Google, Google asks you to grant spyc these permissions in the same step. This happens at sign-in, before you have added a site:

• Your name, email address and profile, to create and identify your account.
• Search Console access (read-only, and read-and-manage), so we can read Search Console data for the sites you add to spyc and check whether their pages are indexed.
• Indexing API access, so we can submit your pages to Google for indexing.

We use this access only to run those features for the sites you add. spyc's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove spyc's access at any time from your Google Account permissions. Search Console and Google indexing features stop working for your sites when you do.

3. Connecting Instagram

You can connect an Instagram professional (Business or Creator) account so spyc can publish the posts and Reels you create or schedule. Instagram asks you to approve this when you connect. We then receive:

• Your account's ID, username, account type and profile picture, to show which account is connected and to check that it can publish.
• An access token, which lets us publish to that account. We store it encrypted and renew it before it expires.

We use this access only to publish the images, carousels and Reels, with their captions, that you or your team create or schedule in spyc. To publish, we place the image or video at a public link in our file storage so Instagram can download it. We do not read your direct messages or comments, and we do not sell or share your Instagram data.

You can disconnect at any time with Remove under Instagram Agent, then Accounts, or in Instagram under Settings, Website permissions, Apps and websites. Either way, spyc can no longer publish to that account. To have all your Instagram data deleted, follow section 8.

4. What we use it for

• To run spyc for you: tracking, audits, content, publishing and indexing.
• To send your questions, pages and brand details to AI model providers, so they can produce the results you ask for.
• To bill you for a paid plan.
• To email you: sign-in links, team invites, account messages, product emails and our newsletter.
• To keep spyc running and secure, and to fix problems.

5. Who receives your data

We send data to the companies below, each for the reason given. We do not sell your personal information.

• AI model providers: OpenAI, Google (Gemini), Perplexity, Anthropic and xAI. Which of them your account uses depends on your plan. They receive the questions, pages and brand details needed to produce your visibility results, audits and content.
• BrightData: runs your tracked questions through the public ChatGPT, Gemini and Perplexity websites, so you see the answers people get there.
• Search data providers: DataForSEO, for Google AI Overview results, Bing index checks and keyword data. SerpApi, for Yandex index checks.
• Search engines: Google Search Console and the Google Indexing API (see section 2). Bing, Yandex and Naver receive your page URLs when you submit them for indexing.
• Email: Resend sends account emails such as team invites. Customer.io receives your name and email address to send product emails. Beehiiv receives your email address to send our newsletter.
• Payments: Dodo Payments.
• Our website: Google Analytics measures visits to spyc.ai. Calendly handles call bookings.
• Free tools: depending on the tool, the URL or text you enter goes to OpenAI, Perplexity, Google AI Studio, xAI, Anthropic, SerpApi or Google PageSpeed Insights.
• Platforms you connect: WordPress, Ghost, Webflow, Shopify, Wix, LinkedIn, Reddit, Instagram (Meta), or a custom API or webhook you set up. When you publish, we send the content to that platform, and its own terms apply from there.

We may also share information when the law requires it, to protect our rights or our users, or as part of a merger, acquisition or sale of assets.

6. Cookies and analytics

The app uses a cookie to keep you signed in. If you block it, you cannot sign in. On spyc.ai, Google Analytics sets cookies to measure which pages people visit, and Google receives that browsing data. You can block these cookies in your browser settings.

7. Storage and how long we keep it

Your data is stored in a MongoDB database. No way of storing or sending data is completely secure, so we cannot promise it will never be accessed without permission. We keep your account and its data until you ask us to delete it. We may keep some of it longer if we need it to meet a legal obligation, resolve a dispute or enforce our agreements.

8. Deleting your account and your other rights

There is no delete button in the app. To delete your account, email business@spyc.ai from the address on your account. We then delete the account and its data. This is permanent and cannot be undone. Content you already published to a connected platform stays there.

Depending on where you live, you may also have the right to see, correct or export your personal information, or to object to how we use it. Email the same address and tell us what you need.

9. Children's Privacy

spyc is not directed to children under 16, and we do not knowingly collect personal information from children.

10. Changes to this policy

When we change this policy, we update the date at the top of this page.

11. Contact

Questions about this policy or your data go to business@spyc.ai.