Log inSign up

Legal

Privacy Policy

Last updated: October 2026

1. Who we are

Laup.ai is operated from Norway. For questions about your data, contact us at hello@laup.ai

2. What data we collect

  • Account data: email address, hashed password (argon2 - we never store your password in plain text), display name and phone number (optional).
  • Scan results: AI readiness scores, schema analysis, sitemap analysis, robots.txt analysis, content visibility results, and AI-generated assessments - all tied to the domain you scanned, not to you personally.
  • Product analytics: anonymous page views and event data (e.g. scans started, exports, sign-up clicks) captured cookielessly via PostHog. Inside the Laup.ai app, events are linked to your account ID so we can debug issues and improve the service. No cookies or device identifiers are stored on your device for analytics, no fingerprinting, and our analytics does no advertising tracking. An approximate country (only) is derived from your IP address on our own server and attached to analytics events as a two-letter country code; the raw IP address itself is never sent to or stored by our analytics provider.
  • Error reports: when an unexpected error occurs in your browser while using Laup.ai, we capture the error message, stack trace, and the page URL via PostHog to debug and fix the bug. No form contents, no request bodies, no personal identifiers beyond your account ID.
  • Usage data: IP addresses in server logs, login timestamps, scan timestamps.
  • Where you came from: if your first visit arrived from a link with campaign parameters (utm_source and similar) or from another website, we keep that source, the landing page and the time in your browser's local storage, and store it with your account or free check when you submit one. It stays with us and is used solely to learn which channels bring us customers. Clear your browser's site data to remove it.
  • Meta ad measurement: if you arrive from one of our Facebook or Instagram ads and then submit a free check, verify a new account or start a trial, we tell Meta that the ad worked, so we can see which ads bring us customers. For that one event we send Meta a hashed (SHA-256) version of your email address, your IP address, your browser's user agent string and the click ID Meta appended to the ad link (fbclid), which we keep in your browser's local storage for 7 days. No Meta pixel runs on our pages, no cookies are set, and nothing is sent unless you submit one of those forms.
  • Acceptance record: timestamp of when you accepted these terms.

2a. Free AI Visibility Check

The free AI Visibility Check is open to anyone, without an account. When you run one we collect and process:

  • The website address you enter and the email address you give us, so we can run the check and send you the result.
  • Your network address (IP), used only to rate-limit abuse of the free check. IPv4 addresses are stored as-is; IPv6 addresses are reduced to their /64 network before storage.
  • The result itself: the questions we generated, the AI engines' answers, and the report we build from them. The result describes the website checked, but the check record links it to the email address and network address above.

To produce the check we send the public content of the website you enter, and the generated questions, to the AI engines listed under third-party processors below (OpenAI, Microsoft Azure OpenAI, and Google). We do not send them your email address. The report is reachable by anyone holding its private link, so treat that link as confidential. The legal basis is your request for the service (and our legitimate interest in preventing abuse). We may send you one follow-up about your report. The report email also offers a follow-up conversation; we contact you about it only if you ask us to, by pressing the confirmation button yourself. There is no newsletter. Check records are kept until you ask us to delete them. You can ask us to delete a free check at any time at hello@laup.ai; on deletion we remove your email, network address and the URL you entered, and the report link stops working.

2b. AI assistants you connect to Laup

You can connect an AI assistant such as ChatGPT or Claude to your Laup account, or give your own tool a personal access token, so the assistant can read your Laup data and, if you allow it, work on your action plan. Laup does this through an open standard (the Model Context Protocol). The connection is a choice you make per assistant, and you can revoke it at any time under Settings, Connect.

  • What we store: a connection token for that assistant (we store only a hash of it), which account and, optionally, which domain it covers, the access you approved (read only, or read and update), and a log of each call: the tool used, the time, and the outcome. The log is kept for security and audit and does not contain the data returned.
  • What the assistant can read: the same data you see in Laup for the domains the connection covers: AI visibility and competitor names, the tracked buying questions, the AI answers we captured for them, the websites and search queries the engines used, the technical readiness scan, and the action board, including card titles and descriptions, the discussion comments on cards, and the display names of teammates who moved a card or commented.
  • What the assistant can change, only if you approved read and update access: move a card to another status, create a card, and post a comment. Every change is recorded with the assistant's name, so your team can see what was done by an assistant and undo it in the app. Assistants cannot delete your data, change your account, or run new measurements.
  • Where the data goes: what the assistant requests is sent to the provider you connected (for example OpenAI for ChatGPT, or Anthropic for Claude) and is then handled under your agreement with that provider, including its policies on retention and model training. Laup does not control what the provider does with it once it has left our service.
  • Legal basis: contract (Art. 6(1)(b)), since you initiate and approve each connection, and legitimate interest (Art. 6(1)(f)) for the call log.

3. Why we collect it

  • To provide the service: we need your email to authenticate you and your domain to run scans.
  • To serve the assistants you connect: a connection token lets an assistant you approved read your Laup data on your behalf; the call log lets us spot misuse and lets you see what a connection did.
  • To secure the service: IP logging helps detect abuse and unauthorized access.
  • To improve the service: aggregate, anonymized scan patterns help us improve our analysis accuracy.

4. Legal basis (GDPR)

Different processing activities rely on different legal bases. Accepting our Terms of Service at signup is acceptance of the contract — it is not blanket GDPR consent.

  • Contract (Art. 6(1)(b)): processing your account data, authenticating you, running scans you initiate, and storing scan results — all necessary to deliver the service you signed up for.
  • Legitimate interest (Art. 6(1)(f)): security logging, abuse prevention, error reports, and aggregate product analytics to operate, secure, and improve the service. You can object at any time — see §8.
  • Legal obligation (Art. 6(1)(c)): retaining records where required by law (e.g. tax, audit).
  • Consent (Art. 6(1)(a)): reserved for processing that is optional and not necessary to deliver the service (e.g. future opt-in features like session replay). We will ask separately and clearly when this applies.

5. Where your data is stored

All data is stored in Azure Norway East (Oslo region), within the EU/EEA. Your data does not leave the EEA for storage purposes.

6. Third-party processors

  • Microsoft Azure (hosting, database) - EU data center (Norway East).
  • Microsoft Azure OpenAI (LLM analysis) - scan data (publicly accessible website content) is sent to Azure OpenAI for analysis. Hosted in Sweden Central, within the EU/EEA. No personal user data (email, password) is sent to Azure OpenAI. Subject to Microsoft's data processing terms.
  • OpenAI, Google and Anthropic (AI engines) - for the free AI Visibility Check and for AI Visibility tracking we query OpenAI, Google and Anthropic's AI products, alongside Azure OpenAI, with the buying questions and the public website content, so we can record how each engine answers. No account data is sent. Subject to each provider's data processing terms.
  • AI assistants you connect (for example OpenAI's ChatGPT or Anthropic's Claude, see section 2b) - the data an assistant requests is sent to that provider at your request and handled under your agreement with the provider. Nothing is sent unless you connected the assistant and it asks.
  • Meta Platforms Ireland Ltd (ad measurement) - receives the conversion events described in section 2 (Meta ad measurement) through Meta's Conversions API, only after you submit a free check, verify an account or start a trial. Subject to Meta's Business Tools Terms.
  • PostHog (product analytics) - PostHog Inc. (US-incorporated). All event data is processed and stored in PostHog Cloud EU (Frankfurt, Germany); transfer of the controller relationship to a US-incorporated entity is covered by the EU Standard Contractual Clauses (SCCs) in PostHog's DPA. Used in cookieless mode for anonymous traffic and identified-only mode for signed-in users; no third-party advertising trackers, no cross-site tracking. Full DPA, sub-processor list, and SCCs at posthog.com/dpa.

7. Data retention

  • Account data: kept until you delete your account.
  • Scan results: kept as long as your account exists.
  • Server logs: retained for up to 90 days for security purposes.
  • Assistant connections: a token granted to an assistant expires and renews while the connection is in use, and is removed when you revoke the connection; a personal access token lasts until you revoke it. The call log for a connection is retained for up to 90 days.
  • Free AI Visibility Checks: kept until you request deletion (see section 2a), after which the identifying data (email, network address, entered URL) is removed and the report link stops working.

8. Your rights

Under GDPR, you have the right to:

  • Access: request a copy of your personal data.
  • Correction: update inaccurate data via your profile page.
  • Deletion: delete your account and all personal data via your profile page. This immediately anonymizes your data.
  • Data portability: request your data in a machine-readable format.
  • Withdraw consent: you can withdraw consent at any time by deleting your account.
  • Object to analytics: you can opt out of PostHog product analytics at any time by emailing us at hello@laup.ai. Analytics runs on legitimate interest and is not required to deliver the service.

To exercise any of these rights, use the self-service options in your profile or contact us at hello@laup.ai

9. Cookies

Strictly necessary cookies. When you sign in, we set a single httpOnly authentication cookie (JWT) that is strictly necessary for the service to function. JavaScript cannot access it.

No tracking cookies. Our analytics provider (PostHog, see §6) runs in cookieless mode - no identifiers are stored on your device, no advertising or cross-site tracking cookies are used. The only things kept in your browser's local storage are the campaign source and the Meta click ID described in section 2: both first-party, both used only when you submit a form, and both removed by clearing site data.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the email address associated with your account. The "last updated" date at the top will always reflect the most recent version.

11. Contact

For data protection inquiries, contact us at hello@laup.ai