AEO Toolkit
Legal

Privacy Policy

Effective 2026-10-30 · Last updated 2026-10-30

1. Who we are

AEO Toolkit is run by Advance Labs Inc., a federal corporation in Ontario, Canada, at 92-971 Adelaide St S, London, ON N6E 2H3. This policy covers the AEO Toolkit console at aeo.advancelabs.dev: the free audit tools, sign-in, and the dashboard. Our company site at advancelabs.dev has its own privacy policy.

Our privacy officer is Lucas Krawczak. Write to lucas@advancelabs.dev with any question or request about your information.

2. What we collect

We collect the following, and only to run the service.

  • Account details. Your email address. If you sign in with GitHub or Google, also the name and avatar that provider shares. We request no other permissions from them.
  • What you add to the dashboard. The domains (projects) you track, brand terms and competitors, and the customer questions you want checked.
  • Results we store for you. For each check: the AI engine, the answer details we keep (which businesses were named, whether you were cited or mentioned, rank, source URLs and short excerpts), and the time it ran. Also the results of audits of your public website.
  • Onboarding questions. If you ask a question before creating a project, we keep the question, the domain and the three engine answers so you can start tracking without paying for the check twice. These stay trackable for 24 hours, but the rows remain until you delete your data.
  • Usage records. Monthly counts of checks, suggestions and audits, used to apply plan limits and prevent abuse.
  • Technical data. IP address, browser type, pages visited and performance timings, collected by our hosting and analytics tools.
  • Messages you send us. If you use the contact form or email us, we keep what you send and your reply address.

The audit tools that do not need an account do not ask for one. We do not knowingly collect special categories of information, and you should not put personal information about other people into your tracked questions.

3. How we use it

  • To create and secure your account and send you sign-in links.
  • To run the checks and audits you ask for and show you the results over time.
  • To apply plan limits, keep the service within its monthly capacity, and prevent abuse.
  • To measure how the site performs and fix problems.
  • To answer your messages and, if you buy a plan, to bill you.
  • To meet legal obligations.

5. AI engines and your questions

To see what AI answer engines say, we send each tracked question to Perplexity, OpenAI and Google models with live web search, through the Vercel AI Gateway. Your question text is sent to them. When you ask for suggested questions, we also send your project name and domain so the suggestions fit your business. We do not send your email address, name or other account details.

These providers handle the text under their own API terms. We use API access, not their consumer apps. Answers come back to us and are stored in your account as described above.

The optional GA4 and Search Console chat tool works differently: you bring your own API key for a model provider you choose (for example Anthropic, OpenAI, Groq, Perplexity or the AI Gateway). Your key is sent with each request so we can call that provider for you, and your question and the reporting data you pulled go to that provider. We do not save the key in our database.

6. Who else handles your information

We do not sell your personal information. We share it only with the service providers below, who process it for us, and where the law requires it. This table lists what the service uses today.

  • SupabaseWhat forDatabase and sign-in (accounts, sessions).DataYour email address, name and avatar if your provider shares them, everything you save in the dashboard, usage counts.LocationUnited States or other regions where Supabase operates
  • VercelWhat forHosting, Web Analytics, Speed Insights, and the AI Gateway that carries engine checks.DataRequests to our servers (IP address, browser, pages visited, performance timings). Your checked questions pass through the AI Gateway.LocationUnited States and other regions where Vercel operates
  • Google AnalyticsWhat forMeasuring visits to our public marketing pages. Not loaded inside the signed-in dashboard or on the sign-in page.DataPages visited, referrer, approximate location from IP address, device and browser details, set against a random cookie identifier.LocationUnited States and other regions where Google operates
  • Perplexity, OpenAI, Google (AI engines)What forAnswer your customer questions with live web search so we can see who the engines name.DataThe question text. When you ask for question suggestions, also your project name and domain. For GPT and Gemini, the web searches they run go through Perplexity search. No account details are sent.LocationMostly United States
  • ResendWhat forDelivers sign-in emails (magic links).DataYour email address and the sign-in link.LocationUnited States
  • GitHub and Google (sign-in)What forOptional sign-in with GitHub or Google.DataWe receive your email address and basic profile (name, avatar). We ask for no other permissions.LocationUnited States and other regions where they operate
  • Google APIs (optional)What forThe optional GA4 and Search Console chat tool, if you connect it.DataRead-only access tokens, stored encrypted. We then read the reporting data you ask about.LocationUnited States and other regions where Google operates
  • Upstash RedisWhat forRate limiting, to stop abuse of the free tools.DataA short-lived request counter keyed to an identifier such as your IP address.LocationUnited States or other regions where Upstash operates
  • StripeWhat forPayments, if you buy a paid plan. Billing is not active today.DataBilling details you give Stripe at checkout. We do not see or store your full card number.LocationUnited States and other regions where Stripe operates

We may also disclose information in a sale or reorganization of the business, with the same protections, or to enforce our terms or protect people from harm.

7. Cookies and browser storage

  • Sign-in session cookies. Set by Supabase Auth to keep you signed in. They are strictly necessary; the dashboard does not work without them.
  • Connection cookies. If you use the GA4 and Search Console chat tool or authorize an MCP client, short-lived cookies carry the sign-in handshake (10 minutes), and the chat tool keeps a random identifier cookie for up to 30 days so it can find your encrypted connection.
  • Preferences in your browser. Your browser’s local storage remembers whether the sidebar is collapsed and whether sound is on. This stays on your device and is never sent to us.
  • Analytics. We use Vercel Web Analytics and Speed Insights to count visits and measure performance; Vercel states that Web Analytics does not use cookies. On our public marketing pages (not in the dashboard or on the sign-in page) we also use Google Analytics, which sets cookies named _ga and _ga_* for up to about two years to tell visits apart. You can block these in your browser or with Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

You can clear cookies and local storage in your browser at any time. Clearing the session cookie signs you out.

8. Where your information is stored

Our providers are mostly based in, or run servers in, the United States. Your information may therefore be stored and processed outside Canada, and may be accessible to courts and authorities in those countries under their laws. We rely on our providers’ contracts and security practices for protection, and we send them only what each job needs.

9. How long we keep it

  • Account and project data is kept until you delete it or ask us to.
  • Deleting a project in Settings deletes its prompts, runs, checks and audits with it.
  • Usage records are kept for billing and abuse prevention.
  • Onboarding questions and their answers are kept until you delete your account or ask us to remove them.
  • Messages you send us are kept as long as needed to deal with them.

After an account is closed we delete or anonymize its information within a reasonable period, except where we must keep records by law (for example billing records).

10. Your rights

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) you can:

  • ask what personal information we hold about you, and get a copy;
  • ask us to correct information that is wrong or incomplete;
  • withdraw your consent, subject to legal limits;
  • ask us to delete your account and its data.

You can delete a project yourself in Settings. To close your account or use any other right, email lucas@advancelabs.dev. We may need to confirm it is you, and we aim to respond within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

11. Security

Data is encrypted in transit. Google connection tokens are encrypted at rest. Database tables are locked so that the browser cannot read or write them directly, and our server checks that every request is for your own data. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner as the law requires.

12. Children

AEO Toolkit is not for anyone under 16, and we do not knowingly collect information from them. If you think a child has given us information, email lucas@advancelabs.dev and we will delete it.

13. Changes to this policy

We will update this page when our practices change and change the “Last updated” date. For material changes we will also tell signed-in users by email or in the app before they take effect.

14. Contact

Lucas Krawczak, Privacy Officer, Advance Labs Inc., 92-971 Adelaide St S, London, ON N6E 2H3, Canada. Email lucas@advancelabs.dev.