⚠ Draft — not GDPR-reviewed. This describes what SearchBot
actually stores today, read from its own source code rather than assumed,
but it has not received a data-protection legal review and must not be
published as a final policy. [[PLACEHOLDER]]
marks a decision still pending.
1. Who controls this data
[[LEGAL BUSINESS NAME]],
[[LEGAL BUSINESS ADDRESS]]. Contact:
[[LEGAL CONTACT EMAIL]].
2. What SearchBot stores about you
Account data: e-mail address, a hashed password
(never the password itself), your account's chosen theme and
language.
Authentication data: session tokens, stored as
one-way hashes; short-lived verification and password-reset tokens.
Research data you create: saved analyses, watchlists,
research questions you declare and their results, alert rules and the
alert events they produce.
Billing metadata, only if you pay: which plan, which
billing period, which currency and country, whether payment is by card
or BLIK, when your access is paid through, and a record of each
successful or failed payment event's type, amount and date.
SearchBot does not store your card number, its security code,
or a BLIK code - those are handled by the payment provider's
own systems, and SearchBot receives only a confirmation that a payment
succeeded or failed.
AI connection credentials, only if you connect an
external AI client (Claude, ChatGPT, or another compatible client):
an authorization grant record and which permissions you approved -
never the AI provider's own account details.
Operational logs: request records used to operate and
secure the service, with passwords, tokens and payment details
redacted before they are ever written.
Product usage events: a small, closed set of facts
about actions you took while signed in - that you logged in, viewed
pricing, started a checkout, ran a research request, used the
research chat assistant, created a watchlist or an alert, viewed
intraday data, or connected an AI client - each recorded with a
timestamp and, where relevant, a short label such as which payment
method or which timeframe. This never includes the text of a
research question you typed, a research chat message, an instrument
you researched, your research's parameters or results, your
watchlist's contents, or anything from a request body, an API key or
a session token. These records are used only to operate the
product (for example, to see that a feature is working) and are kept
for at most 90 days before automatic deletion; they are never used to
decide what you are allowed to do or whether you have paid.
3. What SearchBot does not do
SearchBot does not sell your data. It does not share your data with
advertisers, because it carries no advertising or analytics-tracking
system, and it integrates no third-party analytics provider of any kind
(no Google Analytics, Meta Pixel, Hotjar, or similar) - the small amount
of usage data described above is recorded and stored entirely within
SearchBot's own systems and never leaves them. Data leaves SearchBot's
systems only to the payment provider (to process a payment) and, if you
choose to connect one, to your own AI client acting under the
permissions you granted it.
SearchBot also counts, in aggregate only, how many times its public
pages (the homepage and the research blog) were requested, broken down by
date, page and language, and by the bare domain name of the site that
referred a visitor (for example "chatgpt.com," never a full link or
search query). This counts page requests, not people: SearchBot has no
way to tell whether ten requests came from one visitor or ten, because it
stores no visitor identifier, no cookie, no device fingerprint, and no IP
address for this purpose - so it is never described as a count of
"visitors."
4. Cookies
SearchBot uses only the cookies necessary to keep you signed in and to
protect requests from forgery (a session cookie and a matching security
token). It does not use tracking or advertising cookies, and the
aggregate public-page counting described above added none - no new
cookie exists to consent to, and no cookie consent banner is shown for
the same reason it was not needed before: there is nothing optional to
consent to.
5. How long data is kept
[[PLACEHOLDER — retention periods for
account data, research data and billing records, pending an accounting
and legal decision on how long a payment record must be kept]].
Deleting your account removes your portal data (saved analyses,
watchlists, alerts, current billing status). Research you declared is
detached from your account rather than deleted, because it is real,
reproducible research history; a payment ledger entry is likewise kept as
an accounting record, with your account reference removed, so a
transaction remains reconcilable without being tied back to a
since-deleted account.
6. Exporting your data
You may request an export of your account's portal data. It does not
include your declared research (a separate, larger dataset) or payment
card details (SearchBot never held them).