Privacy Policy

Last updated: August 2026

Introduction

Organicus AI ("we", "us", "our") operates the organicus.ai platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Who is responsible for your data

AI PRODUCTS LTDA, CNPJ 63.045.700/0001-12, with registered address at Rua Ângelo Dias, 220 – Sala 109, Centro, Blumenau/SC, CEP 89010-020, Brasil, is the data controller (controlador) for the processing described in this policy, under the Brazilian General Data Protection Law (LGPD, Law No. 13.709/2018) and, where it applies, the GDPR. For anything in this policy, write to privacy@organicus.ai.

Information We Collect

Account Data

When you create an account, we collect your name, email address, and authentication credentials (managed via Supabase Auth, including Google OAuth).

Usage Data

We automatically collect information about how you interact with our platform, including pages visited, features used, audit history, and device/browser information.

Website Data from Audits

When you run an audit, we crawl and analyze your website's publicly available pages, including HTML content, meta tags, structured data, performance metrics, and AI accessibility signals.

How We Use Your Information

We use the information we collect to provide and improve our AEO audit and AI visibility analysis services, generate your Organicus Score, produce roadmaps and AutoFix suggestions, power the AI Agent assistant, send service-related communications, and comply with legal obligations.

Data Sharing & Third Parties

We share data with the following third-party service providers, solely to operate and improve our platform:

  • Stripe — Payment processing and subscription management.
  • Supabase — Database hosting, authentication, and file storage.
  • OpenAI — AI-powered audit analysis, content generation, and AI Agent functionality.
  • Anthropic — AI-powered analysis and the Claude answer engine we measure your brand in.
  • Google — Sign-in, and Search Console / Analytics data for the projects you connect.
  • Vercel — Application hosting and serverless functions.
  • Sentry — Error monitoring and performance tracking.
  • PostHog — Product analytics and usage insights.
  • Meta Platforms — Ad measurement. On the site, the Pixel (loaded only if you accept analytics cookies). And, from our server, the record that an analysis was started — sent when you arrive from a click on one of our Instagram or Facebook ads, or when you have accepted analytics cookies. That record carries: the identifier of that click, your IP address, your browser, the page you were on, the domain you asked us to analyse and, if you gave us an email yourself, a hashed copy of it — never the address in clear. Plus WhatsApp Business, when you choose to message us there.

We do not sell your personal information to third parties.

Google User Data & Limited Use

Organicus AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access Google Search Console and Google Analytics (GA4) data only for the properties you explicitly connect, and use it solely to display analytics and AEO insights inside your dashboard. We do not sell this data, use it for advertising, or transfer it to third parties except as needed to provide the service or as required by law.

How We Protect Your Data

We protect all personal data we process — and in particular sensitive data such as Google user data obtained through Google APIs — with the following technical and organizational measures:

  • Encryption in transit — All data exchanged between your browser, our servers, and third-party APIs (including Google APIs) is encrypted with TLS (HTTPS).
  • Encryption at rest — Our databases and file storage are encrypted at rest using AES-256. OAuth access and refresh tokens for connected Google accounts are additionally encrypted at the application layer with AES-256-GCM before being stored.
  • Access controls — Google user data is processed only by the application components that need it to deliver the features you request. Human access is restricted to authorized personnel on a need-to-know basis, and only for support, security, or legal-compliance purposes, consistent with Google's Limited Use requirements.
  • Data minimization — We request only the minimum OAuth scopes required, and store only the data needed to display your analytics and AEO insights in your dashboard.
  • Monitoring & incident response — We continuously monitor our systems for errors and suspicious activity. If a security breach affects your personal data, we will notify you and the competent authorities without undue delay, as required by applicable law (including GDPR).
  • Revocation & deletion — You can disconnect a Google integration at any time from your dashboard; doing so deletes the stored OAuth tokens and the associated Google data from our systems. You can also revoke Organicus AI's access at any time in your Google Account security settings (myaccount.google.com/permissions). When you delete your account, we delete your personal data from our production systems. Records we are legally required to keep (billing and tax records) are retained for the statutory period and then deleted.

Data Retention

We retain your account data for as long as your account is active. Audit data and analysis results are retained for the duration of your subscription. You may request deletion of your data at any time by contacting us.

Free-analysis reports, the contact details left with them, and conversations you start with us on WhatsApp are kept for 12 months after your last interaction with us and then deleted or anonymised — unless you become a customer, in which case the account rules above apply.

Some records survive account deletion because the law requires us to keep them: billing and tax records for the statutory periods under Brazilian tax and consumer law, and application access logs for the period set by the Marco Civil da Internet. We keep them only for as long as required and use them for nothing else.

Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

  • Access — Request a copy of the personal data we hold about you.
  • Deletion — Request that we delete your personal data.
  • Portability — Request your data in a structured, machine-readable format.
  • Correction — Request correction of inaccurate personal data.
  • Objection — Object to certain processing of your personal data.
  • Revoke consent — Withdraw consent you have given, at any time. Processing that rests on another legal basis is not affected.
  • Complain to the authority — Petition the Brazilian National Data Protection Authority (ANPD), or the supervisory authority of your jurisdiction, if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@organicus.ai.

Cookies

We use essential cookies for authentication and session management. We also use analytics cookies (PostHog and Meta's Pixel, which writes the _fbp and _fbc cookies), loaded only after you accept. You can control cookie preferences in your browser settings and withdraw your consent at any time in your account's privacy settings.

Contact Information

If you have questions about this Privacy Policy or our data practices, contact us at privacy@organicus.ai.

← Back to home