Privacy Policy

The free site readability scan (/scan). When you submit a URL, we fetch that page and check it for machine-readable signals — no account, no email required. We store the URL, its domain, the check results, and a hashed copy of your IP address (used only to enforce a daily rate limit against abuse — we never store the IP address itself). This record is deleted automatically after 12 months.

The request form (/request).If you ask us to onboard your practice, we collect the business name, your email, your website URL, and the town, state, and category you want tracked, plus a hashed IP address for the same abuse-prevention purpose. A person reads every submission by hand. If your request doesn't become a paying account, this record is deleted after 12 months. If it does, the relevant details carry forward into your customer account below and this record is no longer treated as non-customer data.

Customer accounts.Signing in uses WorkOS AuthKit, which handles authentication on our behalf. We store your email address, name (if provided), your organization and role within it, and login timestamps. Your account's measurement data, reports, and findings are stored under your organization and are never visible to any other customer — enforced at the database level with row-level security, not just application logic.

Signing in with Google.You can sign in using a Google account. Authentication is handled by WorkOS AuthKit; we never see or store your Google password. From your Google account we receive your email address and basic profile information (your name and profile photo) and use it only to identify you, create your account, and associate you with your organization. We do not use Google user data for advertising, do not sell it, and do not share it with third parties except the subprocessors listed elsewhere on this page. You can revoke access at any time from your Google account's permissions page. If you delete your ChatterChecks account, the identifiers we received from Google are deleted with it.

Payment.We never see or store your card details. Checkout and billing management happen entirely on Stripe's hosted pages; we only receive a subscription and customer reference ID from Stripe.

Security and audit logs. Actions taken on an account (sign-ins, seat changes, plan changes, report exports, admin actions) are recorded in an append-only audit log tied to a hashed IP address, kept for security and accountability purposes.

The core product asks AI assistants (ChatGPT, Claude, Gemini, Perplexity, and Grok) what they say about businesses in a given town and category, and reads the citations and business listing data (via Google's Places API) those assistants and listings return. That is public-facing business information about the businesses being measured — not personal data about you, our visitor, or about the assistants' end users. It is not in scope for the rest of this policy, which covers data about people who interact with chatterchecks.com and the ChatterChecks product directly.

We keep this short because we keep the list short. WorkOS AuthKit sets a session cookie so you stay signed in. Cloudflare Turnstile runs on the request form to tell humans from bots, which involves Cloudflare processing signals about your browser and connection under its own privacy terms. Stripe's hosted checkout and billing portal are subject to Stripe's own privacy policy. We do not run third-party advertising trackers, and we do not sell or rent any personal data to anyone, for any purpose.

• Site scan records: 12 months, then automatically deleted.
• Request form records that never become a customer: 12 months, then automatically deleted.
• Customer account and measurement data: retained for as long as your account is active, and for a reasonable period afterward to satisfy accounting and legal obligations, after which it is deleted on request or as part of routine cleanup.
• Audit log entries: retained as an append-only security record.

If you're in California, the CCPA gives you rights to know what personal information we hold about you, to request its deletion, and to request a copy of it. If you're in the EU/UK, the GDPR gives you similar rights of access, correction, deletion, and portability. We honor these rights for everyone who asks, regardless of where you live, because narrower would be arbitrary rather than protective.

To exercise any of these rights — access, correction, deletion, or export — email hello@chatterchecks.com from the address on the account (or the address you submitted). We're a small team; we'll respond and act on verified requests within 30 days.

Tenant data is isolated at the database level with Postgres row-level security, not only application code, so a missing access check fails closed rather than leaking across accounts. IP addresses are stored hashed, never in plain text. Payment data never touches our infrastructure. Report contents are never sent by email — only a notification that something changed, with a link back to your account — because a forwarded email or a compromised inbox shouldn't be able to leak a competitor comparison to a third party.

ChatterChecks is a business-to-business product for practice owners and staff. It is not directed at children, and we do not knowingly collect data from anyone under 16.

If we change what we collect or how we use it, we'll update this page and change the effective date above. We won't use data for a materially different purpose than the one it was collected for without telling you.

Greyrock Technologies LLC, doing business as ChatterChecks. hello@chatterchecks.com