Privacy
We collect as little as we can, we never sell it, and we use it only to run GEO Guru for you. This page says exactly what we keep, why, and for how long.
Last updated 10 November 2026
Draft for legal review. This text is not final and may change before GEO Guru launches. Values in square brackets are still to be filled in.
Who we are
GEO Guru (getgeoguru.com) is run by [Doodle legal entity name], [registered address] (“we”, “us”), part of Doodle. We decide how your personal data is used, so we are its controller under the EU and UK GDPR. Questions about privacy go to privacy@getgeoguru.com. Our representative in the EU and the UK: [EU and UK representative, if required].
What we collect and why
We have no passwords, no card numbers, no dates of birth and no ID documents. We don’t use advertising trackers, Google Analytics or a Facebook pixel.
| Data | Why | Legal basis (EU / UK GDPR) |
|---|---|---|
| Email address, optional name, Google account id (if you sign in with Google) | Your account and signing in | Contract |
| Session records: a hashed session token, a short browser hint, times | Keeping you signed in; “sign out everywhere” | Contract; security |
| Saved websites, reports, deep-check pages, issues and short evidence quotes | The service itself: reports, check-ups, history | Contract |
| Fix orders: the fixes you chose, the kickoff meeting time, the name and email of the person we meet, work notes and the result of the re-check | Doing the work you paid for, refunds, and settling disputes | Contract; legitimate interests |
| Business details you give us for a fix (name, address, phone, email, opening hours, a description of what you do) | Writing the structured data or text you ordered | Contract |
| Payment status and Stripe ids (customer, subscription, payment) | Turning the site pass and Unlimited on and off, receipts and refunds | Contract; legal obligation (tax records) |
| Report email: your address, the consent text you agreed to, the linked report | Sending the report you asked for, and occasional news | Consent (you can withdraw it at any time) |
| Plan reservations and enterprise requests | Replying to you | Legitimate interests |
| A salted, daily-changing hash of your IP address (never the address itself) | The free daily check limit and stopping abuse | Legitimate interests |
| Teammates' emails | Invites and team access | Contract |
Your IP address is never stored. For the daily limit we keep a one-way hash of your IP address mixed with a secret and the date, so hashes from different days can’t be linked. We delete it from reports after 48 hours. Our logs carry a request id, never your IP address or email.
What we look at on a website
When you check a website, our crawler GEOGuruBot reads its public pages the way a search engine does. It obeys robots.txt, runs no scripts, fills in no forms, never logs in and never reads private or internal addresses.We look for things that help or stop search engines and AI tools, nothing else:
- robots.txt: whether Google and AI crawlers (such as GPTBot, ClaudeBot and PerplexityBot) are allowed in, and where the sitemap is.
- The homepage as a crawler sees it, without JavaScript: the page title, description, main heading, language, canonical address, share preview tags, how many words explain what you do, and whether images have descriptions.
- Business details already published on the page: structured data (schema), and whether a phone number, email address or street address and an About page link are visible. These are your business’s public details, used only to tell you whether search and AI can find them.
- Technical health: whether the page loads, HTTPS, a mobile viewport, how fast the server answers, whether the page is blocked from Google (noindex), the sitemap and llms.txt.
We keep the results and short evidence quotes (at most a few hundred characters each), not copies of whole pages. We don’t collect your visitors’ data, cookies, form entries or anything behind a login. Deep checks of more pages are only for owners who have verified their site. A site owner can block us in robots.txt or ask us to stop checking their site: see our crawler page.
When our team fixes your website
- After you order fixes, we agree access with you at a kickoff meeting. We never ask for passwords by email or in a form, and we don’t store your website passwords in GEO Guru.
- Our team uses that access only to do the work in your order, changes only what the order covers, and doesn’t copy your customers’, users’ or orders’ data. Please remove our access when we’re done; we remind you.
- We keep short work notes (what we changed and when) with the order, so we can answer questions and handle refunds.
Browser extension
- What it sends: the address of the website in your open tab, only when you click “Check this site”, and, if you connected it to your account, its connection token. Nothing else: no browsing history, page content, form data, cookies or passwords.
- What stays in your browser: “What crawlers see” counts words on the open page and in the same page fetched again without JavaScript; both counts stay in the extension. The connection token is kept in the extension on that browser only.
- How long: a connection lasts 90 days from its last use; disconnect any time in the extension or in Settings. We keep only a hashed copy of the token. Reports are kept like other reports (below).
- Never: no ads, no tracking, no analytics in the extension, and it doesn’t change the pages you visit. It asks only for the open tab when you click, storage for the token, and scripting for “What crawlers see”.
AI assistant apps
GEO Guru can be used from AI assistants such as ChatGPT and Claude (see the connector guide). When an assistant uses GEO Guru:
- What we receive: only the tool input: a website address, a check name or a platform name. We never receive your conversation, your prompts, the assistant’s memory, your files or who you are.
- What we keep: the check of that website is saved as a report, like a visitor check on our site, for 90 days, linked to no person. Our logs record the tool name, the assistant company (from its user agent, for a per-company rate limit) and the result code, never the address or the conversation.
- Never sold or shared, never used for advertising or profiling. Nothing is sold inside an assistant.
AI suggestions
For some fixes (for example a better page title or image alt text) we ask an AI model run by Cloudflare (Workers AI) for a suggestion. We send text from the public page of your site, not your account details. Suggestions are plain text shown to you or to our team; nothing is put on your website without your order and, for text we write, your approval.
Who helps us run GEO Guru
We never sell personal data. These service providers process it for us under their data processing terms:
| Provider | What for | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, databases and file storage, email sending, bot protection (Turnstile), AI suggestions (Workers AI), cookie-free page counts (Web Analytics) | Everything listed above, stored on Cloudflare's network |
| Stripe, Inc. and its affiliates | Checkout, card payments, receipts, the billing portal, refunds, fraud prevention | Your card and billing details go to Stripe directly; we receive only ids, payment status, your billing country and the last 4 digits of the card. Stripe also processes payment data under its own privacy policy |
| Google LLC | “Sign in with Google”, only if you choose it | Your Google account id, email and name, as Google shares them |
| Video call and calendar tools (such as Microsoft Teams or Google Meet) | The kickoff meeting for a fix order | The name, email and meeting time of the people in the meeting |
We may share data if the law requires it, or to protect people and the service from fraud or abuse. If GEO Guru is sold or merged, this policy continues to apply to your data and we will tell you first.
How long we keep data
| Data | Kept |
|---|---|
| Visitor reports (no account, AI assistant apps) | 90 days, then deleted; the link then says the report has expired |
| Account reports | While the site is saved: the last 24 checks per site |
| IP address hash | 48 hours |
| Report-email leads | Until you unsubscribe, or 24 months after the last email |
| Fix orders and work notes | 24 months after the order is finished (needed for refunds and disputes) |
| Sign-in codes | Deleted a day after they expire (they work for 10 minutes) |
| Sessions | 30 days after last use |
| Browser extension connections | 90 days after last use, or until you disconnect |
| PDF reports | 30 days |
| In-app notifications | 90 days |
| Plan reservations and enterprise requests | 24 months |
| Payment event records from Stripe | 12 months |
| Staff action log | 24 months |
| Deleted account | Personal data removed within 30 days; database backups roll off within a further 30 days |
We and Stripe keep payment records as tax law requires (usually 6 to 7 years). Fixes made on your website stay on your website: they are yours.
Your rights and choices
From Settings, without writing to anyone, you can see and download your data, correct it, turn off emails, and delete your account. Visitors who only gave an email use the unsubscribe link in any email.
Depending on where you live (for example the EU, the UK, or US states such as California) you also have the right to access, correct, delete or port your data, to object to or restrict some uses, and to withdraw consent. We don’t sell or “share” personal data for cross-context advertising, and we don’t make decisions about you by automated means that have legal effects. Write to privacy@getgeoguru.com; we answer within one month, or sooner where the law requires. You can also complain to your data protection authority (in the UK, the ICO).
Security
Sign-in uses one-time email codes or Google, never passwords. Session tokens and codes are stored only as hashes. Everything travels over HTTPS. Staff reach the admin tools only through a separate, access-controlled host, and every staff action is logged. If a breach affects your personal data, we tell you and the authorities as the law requires.
International transfers
Our providers may process data outside your country, including in the United States. Where EU or UK law requires it, transfers rely on adequacy decisions or the standard contractual clauses in their data processing terms.
Children
GEO Guru is a business tool and isn’t meant for children under 16. We don’t knowingly collect their data.
Changes and contact
If we change this policy in a way that matters, we’ll say so on this page and email account holders before it takes effect. Cookies are listed on the cookies page. Contact: privacy@getgeoguru.com, or [Doodle legal entity name], [registered address].