Privacy Policy

Introduction

Organicus AI ("we", "us", "our") operates the organicus.ai platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Who is responsible for your data

AI PRODUCTS LTDA, CNPJ 63.045.700/0001-12, with registered address at Rua Ângelo Dias, 220 – Sala 109, Centro, Blumenau/SC, CEP 89010-020, Brasil, is the data controller (controlador) for the processing described in this policy, under the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018) and, where it applies, the GDPR. For anything in this policy, write to privacy@organicus.ai.

Information We Collect

How We Use Your Information

We use the information we collect to provide and improve our AEO audit and AI visibility analysis services, generate your Organicus Score, produce roadmaps and AutoFix suggestions, power the AI Agent assistant, send service-related communications, and comply with legal obligations.

Emails about a free analysis

If you give us your email address with a free analysis, or to start for free, we use it to send what you asked for: the report, and the code or link that confirms your address. We may also send a few follow-ups about that report or that free start — that it is ready or about to close, how to connect your site, how the work is going and, later, whether you want to continue. Every follow-up has a link to stop them.

Our legal basis under the LGPD: for the report and the confirmation, the steps you asked for before any contract (art. 7, V); for the follow-ups, our legitimate interest in following up a request you made (art. 7, IX), which you can object to at any time with that link or by writing to privacy@organicus.ai. Stopping them does not affect the report or your account.

Data Sharing & Third Parties

We share data with the following third-party service providers, solely to operate and improve our platform:

• Stripe — Payment processing and subscription management.
• Supabase — Database hosting, authentication, and file storage, in the United States (AWS us-west-2, Oregon).
• OpenAI — AI-powered audit analysis, content generation, and AI Agent functionality.
• Anthropic — AI-powered analysis, the Claude answer engine we measure your brand in, and the AI agent that helps us operate the service (see Access controls below).
• Google — Sign-in, and Search Console / Analytics data for the projects you connect.
• Google Ads — Ad measurement. On the site, the Google tag, on the terms described under Cookies below. And, from our server, the record of a step you took after a click on one of our Google ads — a free analysis started or completed, an account created, a site connected, a checkout started or a purchase made — sent only if you accepted advertising cookies, or if you are in the United States and have not turned advertising off (see Cookies). That record carries: the identifier of that click, when the step happened, the amount of a purchase and, if you gave us an email yourself, a hashed copy of it — never the address in clear.
• Vercel — Application hosting and serverless functions, in the United States.
• Railway — Background processing: audits, AI visibility checks and the delivery of approved changes to the sites you connect, on servers in Railway's EU West region (European Union).
• Upstash — The job queue our servers share and a short-lived cache (for example, the temporary access token for a site you connected), on Upstash's global database, which keeps copies in several regions.
• Sentry — Error monitoring and performance tracking.
• PostHog — Product analytics and usage insights.
• Meta Platforms — Ad measurement. On the site, the Pixel (loaded only if you accept advertising cookies). And, from our server, the record that an analysis was started — sent when you arrive from a click on one of our Instagram or Facebook ads and have not turned advertising off, or when you have accepted advertising cookies. That record carries: the identifier of that click, your IP address, your browser, the page you were on, the domain you asked us to analyse and, if you gave us an email yourself, a hashed copy of it — never the address in clear. Plus WhatsApp Business, when you choose to message us there.

Where your data is: our main database is in the United States, our background processing runs in the European Union, and our cache is replicated across regions. Your data is therefore processed outside Brazil and, depending on where you are, outside your own country.

We do not sell your personal information to third parties.

Google User Data & Limited Use

Organicus AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access Google Search Console and Google Analytics (GA4) data only for the properties you explicitly connect, and use it solely to display analytics and AEO insights inside your dashboard. We do not sell this data, use it for advertising, or transfer it to third parties except as needed to provide the service or as required by law.

Wix sites

To connect a Wix site, you install our Wix app on it from your workspace. We connect the site only if the install is shown to be yours (signed by Wix, or a site whose owner email is the email you are signed in with) and only if one of the site's published addresses is your project's domain.

• What the app reads — The site's id and its owner's email address (only to check that the site is yours; we do not store the email), the site's published addresses, which store catalog it uses, and the search titles and descriptions (SEO tags) of its pages and products. We read them to find the page or product a change is for, and to record what the field held before we change it.
• What the app writes — The title and meta description of a page or product, and only a change you approved in your workspace. On a page, Wix publishes the page's SEO fields together, so SEO edits you left unpublished on that page in Wix go live with ours. While the field still holds the value we wrote, you can roll the change back from your workspace.
• Credentials — The app's credential for your site (its instance id) is stored encrypted with AES-256-GCM. The short-lived access tokens Wix issues for it are never written to our database. They are kept only in our cache, and only until they expire.
• Change history — For each change we write, we keep what the field held before and what we wrote, so that the change can be rolled back. This history is kept until you delete the project or your account. Disconnecting Wix or removing our app does not delete it.
• Disconnecting and uninstalling — When you disconnect Wix in your workspace, or remove our app from your site in Wix, we delete the stored credential immediately and stop writing to the site. Disconnecting in your workspace does not remove the app from Wix; you remove it in your Wix dashboard. Changes already written stay on your site. To roll one back after disconnecting, connect the site again or change it in Wix.
• What we do not do — We use what we read from Wix only to connect the site and to write and roll back the changes you approved. Our software does not send it to AI providers and does not use it for advertising. Our founder and the AI agent described under Access controls may see it while operating the service. The changes themselves are drafted from your site's public pages, as described under Website Data from Audits.

How We Protect Your Data

We protect all personal data we process — and in particular sensitive data such as Google user data obtained through Google APIs — with the following technical and organizational measures:

• Encryption in transit — All data exchanged between your browser, our servers, and third-party APIs (including Google APIs) is encrypted with TLS (HTTPS).
• Encryption at rest — Our databases and file storage are encrypted at rest using AES-256. OAuth access and refresh tokens for connected Google accounts are additionally encrypted at the application layer with AES-256-GCM before being stored.
• Access controls — Personal data, including Google user data, is processed only by the application components that need it to deliver the features you request. Access to our production systems is limited to our founder and to an AI agent (Anthropic's Claude) that works with the founder's credentials and under the founder's direction, and is used only for support, security, operations or legal compliance. Multi-factor authentication is enabled on every account with access to our production systems. Neither our founder nor the AI agent looks at a specific customer's Google Search Console or Google Analytics data, except at that customer's request, for security purposes, or to comply with the law; the automated processing that delivers the features you use is not affected. This is consistent with Google's Limited Use requirements.
• Data minimization — We request only the minimum OAuth scopes required, and store only the data needed to display your analytics and AEO insights in your dashboard.
• Monitoring & incident response — We monitor our systems for errors and failures. If a security incident affects your personal data, we will notify you and the competent authorities (in Brazil, the ANPD) without undue delay, whenever and as applicable law requires (including the LGPD and the GDPR).
• Revocation & deletion — You can disconnect a Google integration at any time from your dashboard; doing so deletes the stored OAuth tokens and the associated Google data from our systems. You can also revoke Organicus AI's access at any time in your Google Account security settings (myaccount.google.com/permissions). When you delete your account, we delete your personal data from our production systems. Records we are legally required to keep (billing and tax records) are retained for the statutory period and then deleted.

Data Retention

We keep your account data until you delete your account. Audit data and analysis results are kept until you delete the project they belong to or your account. You may request deletion of your data at any time by contacting us.

Free-analysis reports, the contact details left with them, and conversations you start with us on WhatsApp are kept for 12 months after your last interaction with us and then deleted or anonymised — unless you become a customer, in which case the account rules above apply.

The ad measurement records described above under Google Ads are deleted twelve months after the step they record.

When we compare two versions of our offer, we record which version a site was shown and what followed — an analysis, an account, a purchase or a refund — together with the email address given with it, if any. That address follows the free-analysis rule above, and deleting your account removes your address and your account from these records at once; the site, the version and the steps stay, without you, for the comparison's results.

Some records survive account deletion because the law requires us to keep them: billing and tax records for the statutory periods under Brazilian tax and consumer law, and application access logs for the period set by the Marco Civil da Internet. We keep them only for as long as required and use them for nothing else.

Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

• Access — Request a copy of the personal data we hold about you.
• Deletion — Request that we delete your personal data.
• Portability — Request your data in a structured, machine-readable format.
• Correction — Request correction of inaccurate personal data.
• Objection — Object to certain processing of your personal data.
• Revoke consent — Withdraw consent you have given, at any time. Processing that rests on another legal basis is not affected.
• Complain to the authority — Petition the Brazilian National Data Protection Authority (ANPD), or the supervisory authority of your jurisdiction, if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@organicus.ai.

Cookies

We use essential cookies for authentication, session management and basic site functions — such as remembering which version of a page you were shown, so it does not change between visits. We also use analytics cookies (PostHog and Google Analytics) and advertising cookies (Google Ads, and Meta's Pixel, which writes the _fbp and _fbc cookies), on these terms. PostHog and Meta's Pixel load only after you accept their category. The Google tag runs on every page in Google's Consent Mode and follows your choice; until you choose, outside the United States it sets no analytics or advertising cookies and sends Google only signals without cookies (such as the page, the time and your browser), which Google may use to estimate how ads perform, while in the United States it measures analytics and advertising until you turn them off — and a Global Privacy Control signal from your browser counts as turning advertising off. When you arrive from one of our Google ads, the identifier of that click stays only in that browser tab until you accept advertising cookies; once you accept, we keep it in our own cookie for up to 90 days, so that a free analysis you start later is credited to that ad, and turning advertising off deletes that cookie. A free analysis you start keeps the click identifier with its record for as long as that record is kept (see Data Retention). You can control cookie preferences in your browser settings and withdraw your consent at any time in your account's privacy settings.

Three of these cookies are ours, by name. organicus_x is functional: it remembers which version of a page you were shown and holds a random identifier for this browser — nothing that names you — so that the sites one browser analyses count as one visitor when we compare versions; it lasts up to 400 days from your last visit. organicus_recent_reports is functional too: it holds the link codes of up to 3 reports this browser opened — nothing that names you — so that after you sign in we can offer to continue with one; it lasts up to 14 days from the last report you opened. organicus_click is an advertising cookie: it holds the identifier of a click on one of our Google ads, is set only as described above, and lasts up to 90 days.

Contact Information

If you have questions about this Privacy Policy or our data practices, contact us at privacy@organicus.ai.