Privacy policy

Cosensible LLC is the controller for the data of your Answermark account (people, organization, billing, usage).

For the data we process on behalf of our customers — for example Search Console or analytics data of the sites they connect — Cosensible LLC acts as a processor under a data processing agreement (DPA) signed with each customer.

• Account: name, email address, password hash, language, two-factor authentication settings, role in each organization.
• Organization and billing: organization name, country, plan; payment is handled by Paddle, and we do not store card numbers.
• Usage and security: sign-ins, IP address, the audit log of actions, and consumption counters used for quotas.
• Data from the sites you connect: Search Console and GA4 metrics, imported in aggregate form, without visitor identifiers.
• Public data: pages of websites, search results and AI answers. They are public and not about identified people, but may incidentally contain names.

• To provide the service you subscribed to (contract).
• To secure accounts and detect abuse, including rate limiting and the audit log (legitimate interest and legal obligations).
• To bill you and meet tax obligations, through Paddle as merchant of record (contract and legal obligation).
• To improve impact estimates using aggregated, anonymised results by language, sector and action type (legitimate interest).

We use the following providers, each under a data processing agreement. This list is a draft and will be published in final form before launch.

• Hetzner — hosting of the application, database and file storage (European Union).
• Cloudflare — content delivery and protection against attacks.
• Anthropic, OpenAI, Google — AI models used for analysis and drafting.
• Perplexity — queried to measure your brand's visibility in its answers.
• DataForSEO — search results, keyword data and captures of AI answers.
• Paddle — payments, invoicing and taxes, as merchant of record.
• Sentry — application error monitoring.

When data leaves the European Union, transfers rely on the European Commission's standard contractual clauses.

• Account data: as long as the account is open.
• Full model inputs and outputs: 30 days, for debugging.
• Backups: encrypted, kept 30 days.
• Time series (positions, AI answers): 24 months online, then archived.
• Audit log: append-only, kept with the organization's account.

You can export your data and delete your account yourself from the app. Deletion takes effect within 30 days, backups included.

Depending on where you live, you also have rights of access, rectification, objection, restriction and portability, and the right to lodge a complaint with your data protection authority.

These mechanisms apply to the GDPR (European Union), the CCPA (California), the DPDP Act (India), the LGPD (Brazil) and Morocco's law 09-08; a legal review per region is in progress.

• Encryption in transit (TLS 1.2 minimum) and of connection secrets at rest (AES-256-GCM).
• Isolation between customer organizations enforced by the database itself, and tested at every build.
• Two-factor authentication available to everyone, required for owners and approvers on the Agency plan.
• Daily encrypted backups, with restoration tested every quarter.

The contact address of our privacy team will be published here before launch.