Privacy Policy
Effective Date: September 24, 2026 · Compliant with GDPR, ePrivacy Directive & CCPA/CPRA
Privacy Highlights (TL;DR)
- 1.We Never Sell Your Data: Your corporate email and audit inputs are never rented, bartered, or sold to data brokers or advertising networks.
- 2.No AI Model Training on User Data: Your confidential brand inputs are not ingested to train third-party foundation models.
- 3.User-Initiated Quota Token (No Ambient Trackers): We utilize only one encrypted, signed, first-party cookie (
open_geo_lead). It is generated strictly upon your voluntary email submission to authorize your unlocked trial probes and prevent automated abuse. Zero cross-site ad trackers. - 4.Full GDPR/CCPA Rights: Request complete data deletion or export at any time via support@geofn.com. Requests resolved within 48 hours.
- 5.OpenGEO Chrome Extension is 100% Local-First: The browser extension operates entirely within your local browser memory sandbox. Diagnostic queries to public protocol files (
/robots.txt,/llms.txt) are made directly from your client browser to the inspected domain and never transit through or get logged by GeoFN servers. Zero browsing history is collected or uploaded, and zero telemetry is embedded.
1. Information We Collect & Collection Methods
open-geo collects data only to provide accurate search engine diagnostic audits, prevent platform abuse, and deliver customer support:
A. Public Query Inputs
When you initiate an inspection, you provide a target domain (e.g. notion.so) and a commercial search query (e.g. best knowledge management software). These inputs are processed in real-time against public search engines.
B. Corporate Contact Information
When you elect to unlock deep audit probes, we collect your business email address. We perform client-side and server-side validation to filter temporary/disposable domains.
C. Automated Security Telemetry
Our Cloudflare edge network automatically logs client IP addresses, browser headers, and timestamp records strictly for DDoS protection, rate-limit enforcement, and bot mitigation.
2. How We Use Data & 24h Snapshot Cache
- Audit Execution: To query public search result interfaces (Google AI Overview, SERP listings) and extract neural entity citations and competitor visibility metrics.
- 24-Hour Snapshot Cache & Public Benchmark Data: Diagnostic audit results and public domain health scores are cached in edge key-value storage for up to 24 hours. This minimizes redundant energy consumption, reduces external API queries, and provides near-instantaneous benchmarking. These cached snapshots consist strictly of publicly observable web metadata (public SERP rankings, public robots.txt, and llms.txt configurations) and contain zero personal identifiers (PII), email addresses, or account credentials. Snapshots are indexed deterministically by the exact query triplet (domain, keyword, and country) and cannot be enumerated or browsed by unrelated parties. Users should only probe publicly resolvable web assets.
- Customer Communications & Data Retention: If you supply your email, we may send your diagnostic audit link, urgent security updates regarding AI crawler blockages, and direct responses to your support inquiries. Verified business email records associated with platform evaluations or trial audits are retained for operational abuse prevention, fraud mitigation, and customer service records for up to 24 months following your last active session, based on our legitimate interest in platform security and audit trace verification, after which they are permanently expunged from our operational systems. You may request immediate erasure at any time by contacting support@geofn.com.
3. Cookie Transparency & Anti-Abuse Tokens
We reject predatory third-party advertising trackers and invasive profiling. We do not set any cookies upon ambient page loading or casual browsing.
Pursuant to the EU ePrivacy Directive (Directive 2002/58/EC, Art. 5(3)(b)) and GDPR, our platform deploys exactly one first-party authentication token strictly when a user voluntarily submits their email in the diagnostic modal to request unlocked trial credits. Under EDPB Guidelines 04/2012, this cookie is legally categorized as strictly necessary to fulfill the specific information society service explicitly requested by the user and to safeguard the edge infrastructure against automated credit abuse:
| Cookie Name | Security Flags | Duration & Trigger | Purpose & Classification |
|---|---|---|---|
| open_geo_lead | HttpOnly, Secure, SameSite=Lax | 30 Days (Triggered only upon explicit email submission) | User-Requested Authentication & Anti-Abuse: HMAC-SHA256 signed stateless token holding verified email entitlement to authorize 2 additional deep probe audits without requiring passwords. |
4. Sub-processors & Service Infrastructure
We partner with enterprise-grade infrastructure providers to deliver high-availability global edge computing:
| Provider | Role & Activity | Data Location |
|---|---|---|
| Cloudflare, Inc. | Edge computing (Workers, D1 SQL, KV), DDoS shielding, and Email Routing (support@geofn.com) | Global Anycast Edge |
| Third-party Search Engine Data & Web Index Providers | Aggregating public search engine result page (SERP) snapshots and zero-retention neural citation extraction. Zero user personal data (PII) is transmitted. | United States / Global (Stateless processing, zero personal data stored) |
| Stripe, Inc. | Payment gateway and subscription billing processing. Handled directly via PCI-DSS Level 1 compliant infrastructure. | United States / Global |
5. OpenGEO Chrome Extension — Privacy & Permissions Governance
This section specifically details our privacy architecture and technical data governance for the OpenGEO Chrome Extension (Manifest V3) distributed via the Chrome Web Store:
A. 100% Local-First Heuristic Processing
The OpenGEO extension executes all technical diagnostic engines (Robots AST parser, llmstxt.org v2 generator, and Schema.org JSON-LD generator) strictly within your local browser memory sandbox. No page content, DOM tree, meta tags, or generated code snippets are ever transmitted to GeoFN servers, third-party foundation models, or cloud analytics.
B. Zero Browsing History Tracking or Telemetry
OpenGEO does NOT track, record, log, or sell your web browsing history, visited domains, search queries, or form inputs. The extension operates in a completely passive, on-demand state: diagnostic scanning is triggered only when you deliberately invoke or interact with the OpenGEO Side Panel on an active page.
C. Manifest V3 Permissions Disclosure & Technical Justification
| Permission | Technical Scope & Exclusive Purpose |
|---|---|
| sidePanel | Renders the diagnostic interface side-by-side with your active webpage without obstructing page content. |
| activeTab | Grants temporary, user-initiated access to read the URL and host of the currently active tab when the extension side panel is invoked. |
| tabs | Monitors active tab switching events (onActivated, onUpdated) so the OpenGEO side panel can automatically synchronize and refresh diagnostic scope when you navigate to a new domain. No browsing history is recorded or stored. |
| scripting | Executes a read-only DOM inspection script in the active tab to extract meta tags, JSON-LD Schema entities, and OpenGraph headers. Operates entirely in local browser memory without altering page state. |
| storage | Maintains a volatile in-memory cache (5-minute TTL) in chrome.storage.session to eliminate redundant network fetches when navigating across the same domain. |
| host_permissions (http://*/*, https://*/*) | Permits querying public root protocol endpoints (/robots.txt, /llms.txt) directly from your client browser to the target domain without proxying through GeoFN servers. |
6. Data Protection & Security Standards
We implement industry standard physical, administrative, and technical safeguards:
- Encryption in Transit: All data transmitted between your browser and our edge network is enforced via TLS 1.3 / HTTPS with automated HSTS.
- Stateless Authentication: Sensitive email authorization is cryptographically signed with HMAC-SHA256, eliminating server-side session database exposure risks.
- Zero Open Ports: Underlying compute runs in isolated V8 sandboxes on the Cloudflare Workers runtime.
7. Your Privacy Rights (GDPR & CCPA/CPRA)
Regardless of your geographical location, we extend comprehensive data sovereignty rights:
- Right to Access & Portability: You may request a copy of the personal data associated with your email address.
- Right to Erasure ("Right to be Forgotten"): You may request immediate deletion of your email address and any associated audit history from our internal records.
- Right to Opt-Out of Sale: We do NOT sell, lease, or monetize your personal data. You are permanently opted out by default.
- Right to Non-Discrimination: We will never degrade service quality or alter pricing because you exercise your lawful privacy rights.
8. Age Limitations & Protection of Minors
open-geo is exclusively a professional developer utility designed for commercial and technical use by individuals aged 18 and older. In compliance with the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA/CPRA), and GDPR Article 8, we do not knowingly solicit, collect, process, or sell personal information from minors under sixteen (16) years of age.
9. Data Requests & Contact Information
To submit an erasure request, exercise your statutory privacy rights, or raise any data protection concerns, please contact our Privacy Team at:
Direct response SLA: Within 48 business hours