Privacy Policy

Last updated: 9 September 2026 · Version 5

This Privacy Policy explains how Geosed processes personal data when you use our website, free initial check or Geosed platform, open an account, contact us or participate in the partner programme. It applies under the Swiss Federal Act on Data Protection and, where applicable, the General Data Protection Regulation (GDPR).

1. Controller

You may use the same email address for privacy requests and to exercise your rights.

2. Data we process

• Website and log data: IP address, time, requested address, status code, referrer, browser and device details, and security events.
• Account and organisation data: name, email address, business, role, language, password hash, sessions, and verification or reset status.
• Project and measurement data: domains, industry, region, competitors, questions, selected AI services, responses, sources, measurement times, costs and usage.
• Website checks: publicly available content and technical properties of the website you provide, and the resulting findings.
• Support data: subject, messages, attachments, status and correspondence.
• Contract and billing data: plan, subscription status, invoice and transaction references. Stripe processes full payment details directly when a payment is made.
• Add-ons and consulting requests: booked add-ons, and the details you provide in the request form for a GEO Consulting Audit describing the desired scope.
• Partner data: referral code, click time, attribution, commissions and payouts.
• API credentials: customer-provided API keys are stored in encrypted form and used only for the selected service.

3. Purposes and legal bases

4. AI measurements and website checks

For a measurement, we send the question you define and the business context required for the evaluation to the selected AI provider. Depending on the feature, publicly available text from the specified website may also be processed. Responses and sources are stored and evaluated in Geosed. Do not include confidential or sensitive personal data in questions, project names or website content unless this is necessary and legally permitted.

Geosed does not use this processing to make decisions that produce legal or similarly significant effects on a person.

5. Recipients and service providers

We use the following categories and providers in particular:

• Hosting and database: Hostinger; the Geosed production server is located in Frankfurt, Germany.
• Offsite backups: Hetzner Online GmbH (Storage Box) for encrypted daily database backups, located in Falkenstein, Germany.
• Transactional email: Resend (Plus Five Five, Inc.) for registration, email verification and password reset messages.
• Payments: Stripe when paid transactions are enabled and used.
• AI services: OpenAI, Perplexity, Anthropic (Claude) and Google (Gemini), only when the relevant service is used for a feature or measurement.
• Location lookup: OpenStreetMap Nominatim for a location search initiated in the free initial check.
• Web analytics: Google Analytics 4 subject to your consent and the description in section 8.

Providers receive only the data required for their task. Where they act as processors, we contractually require appropriate data protection and security. Where Geosed processes personal data for business customers, our Data Processing Agreement and its sub-processor list apply. Data may also be disclosed to authorities, courts or advisers where required by law or necessary to establish or defend legal claims.

6. International transfers

The main server is in Germany. Some providers, particularly for email, payments, analytics and AI, may process data in Switzerland, the European Economic Area, the United States or other countries. Where a country is not recognised as providing adequate protection, we rely in particular on recognised standard contractual clauses and supplementary safeguards, or another legally permitted transfer mechanism. Providers may use their own subprocessors.

7. Retention

• Account, organisation, project and measurement data: during the contract and generally for up to 30 days after account deletion or contract termination; longer only where legal duties or ongoing claims require it.
• Backups: overwritten or deleted within the documented regular backup cycle; protected and unavailable for productive use until then.
• Support requests: up to 24 months after closure.
• Contract, accounting and transaction records: 10 years where statutory retention duties apply.
• Google Analytics event data: no more than 14 months.
• Login session: up to 30 days; password reset link: 1 hour; email verification link: 7 days.
• Consent cookie: 180 days; referral attribution cookie: 90 days.

We then delete or anonymise the data, subject to shorter periods, an earlier valid deletion request, and legally required longer periods.

8. Cookies and similar technologies

Necessary cookies

gp_session keeps you signed in (up to 30 days). gp_consent stores your cookie choice (180 days). These cookies are required for login, security or recording your choice.

Referral attribution

With your consent, gp_ref may store the referral code and click time for 90 days. It does not use fingerprinting and is not set without consent.

Google Analytics 4

With your consent, we use Google Analytics 4 from Google Ireland Limited to measure page views, approximate origin, device type and use of our website. Without your consent to usage analytics, the Google Analytics code is not loaded and no analytics request is sent to Google. After consent, Google Analytics may set the _ga and _ga_<measurement-ID> cookies for up to two years. Google states that it uses IP addresses to derive approximate location data and does not log or store them. Advertising storage, Google signals and personalised advertising remain disabled.

You can select analytics and referral attribution separately. Consent is voluntary. You may withdraw or change it for the future using the button below. Optional cookies are deleted and the choice is reopened. See Google's Privacy Policy for more information.

9. Data security

We use technical and organisational safeguards including encrypted transmission, password hashing, encrypted API keys, access restrictions and tenant separation. No process can provide absolute security.

10. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction or a copy of your data, object to processing and withdraw consent at any time for the future. These rights may be subject to legal requirements and exceptions. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, where the GDPR applies, a competent European data protection authority.

Signed-in customers can submit requests securely under Settings – Privacy & Account. Alternatively, email info@geosed.com. We may request information needed to verify your identity securely. We generally answer access requests within 30 days; if this is not possible, we will explain the reason and provide a new response date within that period.

11. Required information

Information marked as required in a form is needed to open an account or provide the requested service. Without it, we cannot provide the relevant feature. Optional information and consent are voluntary.

12. Changes

We may update this Policy when features, providers or legal requirements change. The version published on this page applies. We will provide appropriate notice of material changes.