Last updated: 5 July 2026

Privacy Policy

1. Who we are

aiListing.io is operated by Chris Lund Schober, a self-employed individual (autónomo) registered in Madrid, Spain, under NIE X4614669H ("aiListing", "we", "us"). This document is the data controller notice required under the EU General Data Protection Regulation (GDPR) and, where applicable, the Spanish Ley Orgánica 3/2018 (LOPDGDD). For any data protection question or to exercise the rights below, contact [email protected].

2. What data we collect

• Account data — email address, password (stored as a salted hash, never in plain text), name/company (optional), brand terms and vertical you configure.
• Audit data — the URLs you submit for an AI-visibility audit (your own site and any competitor sites you add), and the resulting scores/findings.
• Monitoring data — the query sets you configure to track how ChatGPT, Claude, Gemini and Perplexity respond, and the results returned.
• Billing data — your plan, subscription status, and amounts paid. Card details are entered directly into Stripe's own checkout and never touch our servers or database; we store Stripe's customer/subscription reference IDs, not card numbers.
• Service request data — if you submit a Done-For-You implementation request: contact email, e-commerce platform, catalog size, and any notes you provide.
• Technical data — cookies (see §7), and IP address, used transiently for abuse/rate-limit protection on the free audit tool. IP addresses are not stored against your account.

3. Why we process it (lawful basis)

• Performance of a contract (Art. 6(1)(b)) — creating your account, running audits and monitoring, processing payments, fulfilling service requests, and sending transactional emails (welcome message, service-request confirmations, billing receipts via Stripe).
• Consent (Art. 6(1)(a)) — marketing/product emails (opt-in checkbox at signup or in Settings) and non-essential cookies (see §7). You can withdraw either at any time, as easily as you gave it.
• Legitimate interest (Art. 6(1)(f)) — rate-limiting and abuse prevention on the free audit tool, and aggregate, non-identifying product-usage statistics computed from our own data (we do not use third-party analytics or tracking scripts).

4. Who we share it with

We use a small number of subprocessors, each only for the specific purpose below. We don't sell or rent personal data, and we don't use it to train any AI model.

• Stripe — payment processing.
• OpenRouter — routes your configured monitoring queries to the underlying AI providers (OpenAI, Anthropic, Google, Perplexity) so we can report how each one responds. Your query text is sent to whichever provider(s) you've enabled monitoring for.
• RunCloud / Vultr — server management and hosting infrastructure.
• Cloudflare — content delivery and DNS.
• Zoho Mail — sending transactional and (where you've consented) product emails.

5. International transfers

Some subprocessors above (notably the AI providers reached via OpenRouter) are based outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA, we rely on the safeguards those providers make available under their own standard terms (such as Standard Contractual Clauses). Query text sent for monitoring is limited to what you've configured to track — we do not send full customer records to these providers.

6. How long we keep it

Account, audit, and monitoring data is kept for as long as your account is active, and deleted or anonymized promptly if you delete your account from Settings (see §8). Financial records (subscriptions, invoicing-equivalent data) are retained for longer where Spanish tax and commercial law require it, independent of an account-deletion request, but are disassociated from your name/email at that point. Anonymous audit reports (run without an account) remain accessible at their unique link indefinitely unless you ask us to remove one.

7. Cookies

The cookie banner shown on your first visit lets you accept or reject the consent-gated cookies above; rejecting means the currency toggle won't persist between visits (it falls back to a browser-language guess) and signups won't carry channel attribution. You can change your choice any time by clearing the ail_cookie_consent cookie in your browser.

8. Your rights

Under GDPR you have the right to access, rectify, delete, restrict, or export your personal data, and to object to processing based on legitimate interest. Most of this is self-serve:

• Access / export — everything we hold about you is visible in your dashboard, settings, and billing pages.
• Rectification — update your name, brand terms, and email preferences from /settings.
• Erasure — delete your account and personal data from /settings at any time; see §6 for the narrow financial-record exception.
• Anything else (restriction, portability, objection) — email [email protected] and we'll handle it directly.

You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), or your own country's equivalent supervisory authority if you're outside Spain.

9. Age

aiListing is intended for business use by people old enough to enter a binding contract (18+ under Spanish law). We don't knowingly collect data from children.

10. Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, for significant changes, notify active account holders by email.

11. Contact

[email protected] — Chris Lund Schober, Madrid, Spain.