This Privacy Policy explains how IvaBot collects, uses, stores and protects personal data when you use the IvaBot website, application and related services.
The data controller is Galyna Arikh, acting as an individual, based in Romania.
Contact for any privacy question, request or complaint: [email protected]
We aim to respond within 30 days.
Provided by you at registration, or by Google when you sign in with a Google account:
IvaBot does not receive, see or store card details. All payments are processed by Stripe, which collects the cardholder name, billing address and card number directly.
What we store in our own database is limited to identifiers that let us match a payment to your account: your Stripe customer ID, the ID of your last checkout session, and the ID of your last refund.
The content the tools produce for you belongs to you.
IvaBot retrieves search results, keyword metrics and ranking signals from DataForSEO, and queries ChatGPT, Perplexity and Google AI to check AI visibility.
This data is stored, not merely displayed. Each run is saved to your account with its date, so that you can compare results over time and reopen an earlier report. Section 7 explains how long it is kept.
| Purpose | Legal basis |
|---|---|
| Creating your account and authenticating you | Performance of a contract |
| Running the tools and delivering their results | Performance of a contract |
| Tracking credits, processing payments and issuing refunds | Performance of a contract |
| Keeping your saved reports available so you can compare runs | Performance of a contract |
| Recording errors and monitoring the service so faults can be found and fixed | Legitimate interest in a working, secure service |
| Preventing fraud and abuse of the payment flow | Legitimate interest, and Stripe's own legal obligations |
| Understanding how visitors use the site, through analytics and session recordings | Your consent |
| Keeping accounting records | Legal obligation, once it applies to the controller |
We do not sell personal data.
We do not use your personal data to train AI models. Prompts sent to OpenAI and to the AI engines checked by the AI Readiness tool are processed only to generate a response, under those providers' API terms, which exclude use for training.
| Processor | What it handles | Where |
|---|---|---|
| Supabase | Authentication, database, server functions | EU / US |
| Stripe | Payments, cards, fraud prevention | EU / US |
| Webflow | Website hosting, page delivery, server logs | US |
| GitHub | Delivery of application script files | US |
| Sign-in with Google, Google Analytics | US | |
| Microsoft | Clarity analytics and session recordings | US |
| OpenAI | Generating audit text, briefs and articles | US |
| DataForSEO | Search results, keyword metrics, backlinks, AI engine queries | EU |
| Make | Workflow automation between the above | EU |
Each processor handles data under its own privacy terms and under a data processing agreement. We share no more than each one needs to perform its function.
Some of the processors above store or process data outside the European Economic Area, mainly in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, or on the EU-US Data Privacy Framework where the processor is certified under it.
We group cookies into two categories.
These are set without consent, because the service cannot work without them.
| Cookie or storage | Set by | Purpose | Duration |
|---|---|---|---|
| Authentication session | Supabase | Keeps you signed in and linked to your own data | Until you sign out or the session expires |
| Local application state | IvaBot | Holds your tracked pages and prompts in your browser between visits | Until you clear your browser storage |
| Payment and fraud prevention | Stripe | Completes checkout and detects fraudulent payments | Set by Stripe, up to 1 year |
These are set only after you accept them in the cookie banner.
| Cookie or storage | Set by | Purpose | Duration |
|---|---|---|---|
| Google Analytics | Counts visits and shows which pages are used | Up to 2 years | |
| Microsoft Clarity | Microsoft | Records how pages are used, including mouse movement, clicks, scrolling and session replays | Up to 1 year |
Session recordings capture how you move around a page. They do not capture what you type into password fields.
You can change or withdraw your choice at any time through the cookie settings link in the site footer. Withdrawing consent stops further collection; it does not undo collection that already happened.
Under the GDPR you may at any time:
Write to [email protected] to exercise any of these. We may ask you to confirm your identity before acting on a request that concerns sensitive changes or deletion.
You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at www.dataprotection.ro, or with the authority in your own country of residence.
We protect your data with encrypted connections (HTTPS), payment handling delegated entirely to Stripe, row-level security policies on database tables so that each account reads only its own rows, restricted access to production data, and regular review of the code that touches personal data.
No system is completely secure, and we cannot guarantee absolute security.
IvaBot is intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, write to [email protected] and we will delete it.
We update this policy when the service or the law changes. The date at the top always shows the current version. Where a change materially affects your rights, we will tell you by email before it takes effect.