Privacy Notice

This Privacy Notice is maintained by Hol Group SAS (operating GEO-AI, in partnership with La Corte de los Búhos) to explain how we handle personal data.

Data controller

Hol Group SAS acts as the data controller for personal data processed through GEO-AI. You can reach us at geo.ai@lacortedelosbuhos.com.

Categories of personal data we collect

• Account information: name, email, workspace and company name, login credentials.
• Product data: prompts, brands, competitors, and configurations you choose to monitor.
• Usage and telemetry: pages visited, features used, device identifiers, IP address, logs.
• Support communications: messages you send us.
• Billing data: handled by our Merchant of Record (see "Data sharing" below).

Purposes and legal basis (GDPR)

• Providing the service (running audits, monitoring, reports) — performance of a contract.
• Billing and subscription management — performance of a contract and legal obligation.
• Security, fraud prevention, and service integrity — legitimate interests.
• Product improvement and analytics — legitimate interests.
• Customer support — performance of a contract.
• Marketing communications — consent, which you can withdraw at any time.

Data sharing and recipients

We share personal data only with the following categories of recipients:

• Paddle.com Market Limited ("Paddle") — our Merchant of Record. Paddle processes all payments, subscription billing, tax compliance, invoicing, and refunds on our behalf, and acts as a recipient of personal data necessary for those purposes. See Paddle's privacy policy at paddle.com/legal/privacy.
• Large language model providers we query on your behalf to produce reports (OpenAI, Anthropic, Google, Perplexity, xAI). Your configured prompts are sent to these providers.
• Hosting and infrastructure subprocessors for database, storage, edge runtime, and email delivery.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

International transfers

Some recipients are located outside the EEA/UK. Where this is the case, transfers are protected by appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

Retention

We retain account and report data for the lifetime of your account, plus a short period afterwards for legal, accounting, and security purposes. You can request deletion at any time.

Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest on our managed cloud backend, role-based access controls, row-level security in our database, secrets stored in a managed secret store, and least-privilege access for staff. No system is perfectly secure; we work to continuously improve our controls.

Your rights

Subject to applicable law (including GDPR for EEA/UK residents), you have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data, and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority. To exercise any right, email geo.ai@lacortedelosbuhos.com. We respond within one month.

Cookies

We use strictly necessary cookies for authentication and session management. We do not use advertising cookies.