Privacy Policy

Updated: August 10, 2026

Effective immediately for new customers. For existing customers, these changes take effect September 9, 2026 (30 days' notice, per the prior Terms).

Who we are

Geotally is operated by BestDid Technology, LLC (“BestDid”, “we”, “us”). Geotally is an AI brand-visibility tracker: you tell us which brands and which questions (“prompts”) you want to monitor, we ask AI answer engines those questions on a schedule, and we analyse the answers for mentions of your brand and your competitors.

This policy explains what we collect, why, who we share it with, how long we keep it, and what you can do about it. It applies to the Geotally website (geotally.ai), the Geotally web application (app.geotally.ai), and the Geotally iOS app.

Contact: support@geotally.ai

For customers in the EU, EEA, or UK, BestDid Technology, LLC is the controller of the account data described in this policy. Where you use Geotally to process data on behalf of your own clients, we act as your processor under our Data Processing Agreement.

What we collect

• Account information.Your email address, a password (stored only as a salted one-way bcrypt hash — we cannot read it), and optionally your full name and company name. If you turn on two-factor authentication we store your TOTP secret encrypted with AES-256-GCM, plus hashed single-use backup codes. If you register a passkey we store its public key and credential identifier — never a private key, never a fingerprint or face scan, which stay on your device.
• Team members.If you invite colleagues on the Agency plan, we store each member's email address, name, password hash, role, and which brands they may access.
• What you put into the product.Brand names, website domains, competitor names, alternate spellings, target countries, and the prompt text you author. This is business information you choose to enter. Please do not enter personal data about identifiable individuals into prompts or brand fields — the product is not designed for it, and our Acceptable Use Policy prohibits it.
• AI engine responses. The text the engines return for your prompts, plus the citations, source URLs, and the mentions, sentiment, and scores we extract from them. These are stored as historical snapshots so you can see change over time.
• Support tickets. The subject and message body of any ticket you open, and our replies.
• Publishing connections. If you connect a WordPress site so Geotally can publish drafts to it, we store the site URL, the username, and the WordPress application password encrypted with AES-256-GCM. The password is never returned to your browser and never sent anywhere except your own site.
• Billing information.Your subscription tier and status, and an identifier from the payment processor — a Stripe customer and subscription ID for web purchases, or an Apple original transaction ID and a RevenueCat user identifier for App Store purchases. We never see, receive, or store your card number, CVC, or bank details.
• Mobile push tokens. If you allow notifications in the iOS app, we store the Expo push token for that device and whether it is still active, so we can tell you when a run finishes or a report is ready.
• Security and audit log. For every sign-in attempt, password change, two-factor event, admin action, and rate-limit trip, we record the event type, the account it relates to, the IP address, the browser or app user-agent string, and the request path. This is how we detect credential-stuffing, account takeover, and abuse.
• Cookies.See “Cookies and tracking” below.

We do notcollect your device location, your contacts, your photos, your health data, or any advertising identifier. The “country” you set on a prompt is a market you want measured — it is not read from your device.

How we use your data, and our lawful basis

Under EU and UK data-protection law we must tell you the lawful basis for each purpose (GDPR Article 6).

• Authenticate you, enforce your plan limits, run your prompts, build your dashboards and reports. Performance of a contract (GDPR Art 6(1)(b)).
• Send transactional email (verification, password reset, billing, team invitations, deletion confirmation). Performance of a contract (GDPR Art 6(1)(b)).
• Send in-app and push notifications you have enabled (run complete, report ready, cost-cap warning). Performance of a contract (GDPR Art 6(1)(b)).
• Send the weekly digest email. Consent, withdrawable any time (GDPR Art 6(1)(a)).
• Answer your support tickets. Performance of a contract (GDPR Art 6(1)(b)).
• Keep a security audit log, apply rate limits, detect abuse and fraud. Legitimate interests in running a secure service, balanced against your privacy (GDPR Art 6(1)(f)).
• Monitor errors so we can fix them. Legitimate interests (GDPR Art 6(1)(f)).
• Keep billing and tax records. Legal obligation (GDPR Art 6(1)(c)).

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use it for advertising of any kind, and we do not track you across other companies' apps or websites. We do not use your brands, prompts, or the AI responses you collect to train our own models, and we use the AI providers listed below on commercial API terms under which submitted content is not used to train their models.

What we send to AI engines

When one of your prompts runs, we send the prompt text you wrote, and a country and language code to the engine providers you have enabled. We do not send your email address, your name, your account identifier, or your billing information to any AI engine.

• ChatGPT.Prompt sent to OpenAI's API with web search enabled.
• Claude.Prompt sent to Anthropic's API with web search enabled.
• Gemini.Prompt sent to Google's Gemini API with search grounding.
• Perplexity.Prompt sent to Perplexity's Sonar API.
• Google AI Overviews. Prompt sent to SerpApi, which retrieves the Google AI Overview for that query.
• Microsoft Copilot. Emulated, not queried. Microsoft publishes no Copilot API. We retrieve Bing search results for your prompt through SerpApi and generate a Copilot-style answer from those results using OpenAI. No prompt or other data is sent to Microsoft.Results are representative of Copilot-style output, not fetched from the Microsoft Copilot product. If you do not want your prompts processed this way, deselect Copilot in your brand's engine settings.

Two optional features send data to AI providers outside the normal run path. Prompt research and competitor discovery send your brand name, domain, and country to OpenAI or Anthropic to suggest prompts and competitors. Social pulse, where enabled, sends the brand and competitor names (not your prompts) to xAI once a week to summarise public discussion on X, and verifies the cited posts against the X API.

Sub-processors

We share the minimum data necessary with the companies below. Each is bound by a written data-processing agreement.

Infrastructure

• Vercel, Inc. (United States). Website and web-app hosting. HTTP request metadata.
• Railway (United States). Application worker and PostgreSQL database. All operational account data.
• Cloudflare, Inc. (United States / global edge). R2 object storage. Generated PDF reports, white-label logos.
• Upstash, Inc. (United States). Redis. Rate-limiting counters keyed to an IP address or account identifier.
• Resend, Inc. (United States). Transactional and digest email delivery. Recipient email address, message content, delivery status.
• Sentry (Functional Software, Inc.) (United States). Server-side error monitoring. Stack traces and request metadata. We set sendDefaultPii to false and make best efforts to keep customer email addresses out of error messages.

AI engines and research

• OpenAI, L.L.C. (United States). ChatGPT engine, Copilot-emulation synthesis, prompt/competitor research. Prompt text, brand and competitor names.
• Anthropic, PBC (United States). Claude engine, competitor discovery, source sentiment. Prompt text, brand and competitor names.
• Google LLC (United States). Gemini engine. Prompt text.
• Perplexity AI, Inc. (United States). Perplexity engine. Prompt text.
• SerpApi, LLC (United States). Google AI Overviews retrieval; Bing results for Copilot emulation. Prompt text, country and language.
• xAI Corp. (United States). Weekly social pulse summaries (optional feature). Brand and competitor names.
• X Corp. (United States). Verification of publicly posted content cited in a social pulse. Public post identifiers.

Payments and mobile

• Stripe, Inc. (United States). Web subscription billing. Your email, subscription and payment status. Card details go directly to Stripe and never reach us.
• Apple Inc.(United States). App Store in-app purchases. Handled entirely by Apple under Apple's privacy policy. We receive an anonymised transaction identifier.
• RevenueCat, Inc. (United States). Validating App Store receipts and renewal events. Numeric account identifier, product identifier, subscription status.
• Expo (650 Industries, Inc.) (United States). iOS push notification delivery. Device push token, notification title and body.

Website only

• Google LLC (Google Analytics)(United States). Aggregate traffic measurement on geotally.ai — off by default, set only if you accept analytics cookies. Pseudonymous usage statistics.
• DuckDuckGo(United States). Favicon images for the source domains shown on citation cards. Your browser requests the icon directly; we send no account data. The domain of a cited source, and your browser's IP address as part of that request.

We will notify you by email at least 30 days before adding a sub-processor that materially expands the categories of data processed. You may object; if we cannot accommodate the objection, you may cancel and receive a pro-rated refund of unused fees.

Cookies and tracking

In the web app (app.geotally.ai) we set exactly one cookie: bdgt_session. It holds a signed JSON Web Token that keeps you logged in. It is HttpOnly and Secure, cannot be read by JavaScript, expires after 7 days, and is shared with no third party. It is strictly necessary, so it does not require prior consent under Article 5(3) of the ePrivacy Directive.

There is no analytics in the web app and none in the iOS app.

On the marketing website (geotally.ai) we use Google Analytics to count visits. It is off by defaultunder Google Consent Mode v2 and runs only if you press “Accept” in the cookie banner. You can withdraw consent at any time using the “Cookie settings” link in the footer. Full details are in our Cookie Notice.

We set no advertising cookies, no remarketing pixels, and no social-network tracking pixels. The iOS app contains no advertising SDK, no analytics SDK, and no advertising identifier, and it does not ask for App Tracking Transparency permission because it performs no tracking as Apple defines it.

The iOS app

The Geotally iOS app stores your session token in the device keychain (iOS Secure Enclave-backed secure storage). If you allow notifications, we store your device's push token so we can send you product notifications — a run finishing, a report being ready, a cost-cap warning. We send no marketing or advertising push notifications. You can turn notifications off at any time in iOS Settings, and revoking permission stops delivery.

Subscriptions bought in the app are processed by Apple. We never receive your payment details. See our Terms of Service for the subscription terms.

How long we keep data

• Account record, team members, brands, prompts, runs, AI responses, mentions, citations, snapshots, report records, publishing connections, support tickets, push tokens: for as long as your account is open. Deleted from our primary database immediately when you delete the brand or the account.
• Report PDF files in object storage: deleted within 35 days of the brand or account being deleted.
• Security audit log: tiered by severity: routine events 30 days, warning events 180 days, security-critical events 365 days. When you delete your account these rows are detached from your account identifier but the recorded IP address and user-agent persist until the period above expires.
• Encrypted database backups: 35-day rolling window. We do not selectively edit backups, so deleted records are fully gone from backups within 35 days.
• Email delivery logs (Resend): 90 days.
• Error logs (Sentry): 90 days.
• Billing and tax records: as required by applicable tax and accounting law, typically 7 years. These are retained even after account deletion.

Your rights

Depending on where you live you may have the right to access, correct, delete, restrict, object to, or export your personal data, to withdraw consent, and to lodge a complaint with your data-protection authority.

Two of these are self-serve and immediate. You do not need to email anyone.

• Export. Go to Account › Danger zone › Export my data in the web app. You get a JSON file containing your account record, brands, prompts, the last 12 months of runs and their AI responses, mentions, citations, weekly snapshots, report records, and digest send history. Your password hash and full licence key are excluded for security.
• Delete your account. Go to Account › Danger zone › Delete account in the web app. You confirm with your password, and your account and everything linked to it are permanently deleted. There is no undo.Deleting your account does not automatically cancel a subscription — cancel first (see the Terms of Service), or contact us and we will make sure billing stops.

You can also delete any individual brand from the dashboard at any time, which removes its prompts, runs, snapshots, and reports.

For anything else — access requests, correction, restriction, objection, or if you cannot reach the account settings — email support@geotally.ai from the address on your account. We acknowledge within 5 business days and respond fully within the 30 days required by GDPR Article 12(3). If a request is complex we may extend by up to two further months and will tell you why.

Withdraw consent for the weekly digest at any time via the unsubscribe link in the email or in Account › Preferences.

Notice for California residents

In the last 12 months we collected these categories of personal information under the CCPA/CPRA: identifiers (name, email address, account identifier, IP address, device push token); commercial information (subscription tier and status, transaction identifiers); internet or network activity (login events, request paths, user-agent strings); other information you provide (brand names, prompt text, support ticket content); and inferences (brand-visibility and sentiment scores derived from AI engine responses).

We collect it for the purposes described above and disclose it only to the sub-processors listed above, for those purposes.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16.

You have the right to know, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising them. Use the self-serve export and delete controls described above, or email support@geotally.ai. We will verify your request against the email address on your account. You may use an authorised agent; we will ask for proof of authorisation.

International transfers

Our infrastructure is hosted in the United States. When personal data leaves the EEA, Switzerland, or the UK we rely on:

• the European Commission's 2021 Standard Contractual Clauses (Decision (EU) 2021/914, Module Two, controller-to-processor), supplemented by transfer impact assessments where required by EDPB Recommendation 01/2020;
• the UK ICO's International Data Transfer Addendum for transfers from the UK; and
• the EU–US, UK Extension, and Swiss–US Data Privacy Framework where the relevant sub-processor holds a valid certification.

Copies of the clauses are annexed to our Data Processing Agreement and available on request.

Security

All traffic is encrypted in transit with TLS 1.2 or better. Passwords are stored only as bcrypt hashes. Two-factor secrets and WordPress application passwords are encrypted at rest with AES-256-GCM. Database volumes and backups are encrypted at rest. Sessions can be revoked instantly server-side, and changing your password or disabling two-factor authentication invalidates existing sessions. Access to production systems is restricted to BestDid staff using multi-factor authentication. Accounts are protected by rate limiting on sign-in, password reset, and passkey authentication.

No system is perfectly secure. If you believe your account has been compromised, email support@geotally.ai immediately.

Automated processing

Geotally uses third-party large language models to retrieve and summarise answers to prompts you author, and applies automated extraction to identify brand mentions, recommendations, citations, and sentiment.

These outputs are estimates for marketing analysis, not facts and not guarantees. Geotally does not make automated decisions producing legal or similarly significant effects concerning you within the meaning of GDPR Article 22. You remain in control of every business decision you make with the information.

Children

Geotally is a business tool for adults. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email support@geotally.ai and we will delete it.

Changes to this policy

We may update this policy. If we make a material change we will email the address on your account and post the updated policy here with a new effective date. Where a change requires your consent, we will ask for it before it takes effect.

Contact

Questions about this policy, or about your data:

BestDid Technology, LLC — support@geotally.ai

You also have the right to lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk).