Privacy Policy

1. Who this covers

This policy applies to the CredibleAI website and the CredibleAI app (together, the “Service”). “We” and “us” mean CredibleAI. “You” means a person who visits the site, joins the waitlist, or uses an account.

2. Information we collect

Information you give us

• Waitlist. Your email address and, if you add it, your company name.
• Account. Your name, email address and password. Passwords are stored as a one-way hash, never as the password itself.
• Your business. Your business name, website, address, phone number, service areas, logo, brand colours, photos, job details and anything else you enter or upload so we can produce content and check listings for you.
• Billing. Payments are taken by Stripe. We receive your plan, payment status and a customer reference from Stripe. We do not receive or store your card number.

Information we gather for you

• Your public website. We read the public pages of the website you give us to learn your services, locations, photos and brand.
• Public business listings. We look up your business on public directories (such as Google Maps, Yelp and Foursquare) to see whether your name, address, phone number and website are correct there.
• Local signals. We collect public weather, news and seasonal information for the areas you serve. This is about places, not about you.

Information collected automatically

• Sign-in cookie. One cookie that keeps you signed in. We do not use advertising cookies or third-party tracking cookies.
• Server logs. Standard request records such as IP address, browser type, the page requested and the time, kept to run and secure the Service.

3. Google user data

Connecting a Google account is optional. If you choose to connect one, Google asks for your permission first and this section describes exactly what happens after you agree. One sign-in can cover both permissions below, and Google lets you allow one and not the other.

What we access

Your Google Business Profile. We request permission to manage it (https://www.googleapis.com/auth/business.manage). With it we access:

• the list of Business Profile accounts and locations your Google account manages;
• for the location you connect: its name, address, phone number, website and business description.

Your Google Search Console. We request permission to read it (https://www.googleapis.com/auth/webmasters.readonly). This permission is read-only: we cannot change anything in your Search Console. With it we access:

• the list of websites your Google account can see in Search Console;
• for the website you connect: its weekly search results. That is the searches people typed, the page of yours Google showed, how many times it was shown, how many times it was clicked, and its average place in the results.

We do not access your Gmail, Calendar, Drive, contacts or any other Google product.

How we use it

• to show you your Business Profile details inside CredibleAI;
• to compare those details with your other directory listings and point out where they disagree;
• to update your Business Profile name, phone number, website or description, and only when you have reviewed and approved that specific change;
• to show you how your website appears in Google search, week by week;
• to suggest which pages of your website to write or improve. To write those suggestions we send some of your search terms and their numbers to the AI providers named in section 5, who process them on our behalf to return the suggestion. We do not send them your Google account details or tokens.

How we store it

We store the Google account and location identifiers, the listing details above, the name of the website you connect, its weekly search results, and the access and refresh tokens Google issues. Tokens are encrypted at rest (AES-256-GCM) and are only used from our servers to make the requests described here.

Who we share it with

We do not sell Google user data. We do not share it with anyone except service providers that host and run the Service on our behalf under confidentiality obligations (including the AI providers in section 5, only for the page suggestions described above), or where the law requires it. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalised AI or machine-learning models.

Limited Use

CredibleAI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion

You can disconnect your Business Profile at any time from the Listings page, and your Search Console from the Search Insights page. Disconnecting deletes the stored tokens for that connection and we stop reading from it. Disconnecting your Business Profile also deletes its Google account identifiers. Search results we have already read stay in your account so your history is not lost, until you ask us to delete them. You can also remove CredibleAI’s access from your Google Account settings. To have all Google data we hold about you deleted, email support@credibley.com.

4. How we use information

• to provide the Service: produce content, audit search presence and check listings;
• to create and secure your account and keep you signed in;
• to take payment and manage your subscription;
• to answer you when you write to us, and to tell you about changes to the Service;
• to email you when a seat opens, if you joined the waitlist;
• to find and fix faults, prevent abuse and meet our legal obligations.

5. AI processing

The Service uses AI models from Anthropic, OpenAI and Google (Gemini) to write and design content. To do that we send those providers the business information needed for the task, such as your services, town, brand details and photos, and, for page suggestions, search terms and numbers from a Search Console you have connected. They process it on our behalf to return a result. We do not train AI models on your information.

6. Who we share information with

We do not sell personal information. We share it only with:

• Stripe, to take payments;
• Anthropic, OpenAI and Google, to generate content as described above;
• Google, Yelp and Foursquare, to look up business listings. We send them your business name and location to find the right one. Changes you approve to a connected Google Business Profile are sent to Google;
• Pexels, to find stock photos. We send search terms, not personal information;
• our hosting provider, which stores the Service’s data;
• authorities or other parties where the law requires it, or as part of a merger or sale of the business, in which case this policy continues to apply to your information.

7. How long we keep it

We keep account and business information for as long as your account is open. When you ask us to delete your account we delete or anonymise it within 30 days, except records we must keep for tax, accounting or legal reasons. Waitlist entries are kept until a seat is offered or you ask to be removed.

8. Security

Data is sent over HTTPS. Passwords are hashed and connected-account tokens are encrypted. Access to production systems is limited to the people who need it. No system is perfectly secure, so we cannot promise absolute security, and we will tell you if a breach affects your information where the law requires it.

9. Your choices and rights

You can ask us for a copy of your information, to correct it, to delete it, or to stop using it. Depending on where you live you may have further rights under laws such as the GDPR or the CCPA, including the right to complain to your local data-protection authority. To use any of these, email support@credibley.com. We will not treat you differently for doing so.

10. Children

The Service is for businesses. It is not directed at anyone under 18 and we do not knowingly collect information from children.

11. Changes to this policy

If we change this policy we will post the new version here and change the date at the top. If a change materially affects how we use your information, we will tell account holders by email before it takes effect.

12. Contact

Questions or requests about this policy or your information: support@credibley.com. Our Terms of Service cover the rules for using the Service.