Privacy Policy

1. Who we are

Laup.ai is operated from Norway. For questions about your data, contact us at hello@laup.ai

2. What data we collect

• Account data: email address, hashed password (argon2 - we never store your password in plain text), display name and phone number (optional).
• Scan results: AI readiness scores, schema analysis, sitemap analysis, robots.txt analysis, content visibility results, and AI-generated assessments - all tied to the domain you scanned, not to you personally.
• Product analytics: anonymous page views and event data (e.g. scans started, exports, sign-up clicks) captured cookielessly via PostHog. Inside the Laup.ai app, events are linked to your account ID so we can debug issues and improve the service. No cookies or device identifiers are stored on your device, no fingerprinting, no advertising tracking. An approximate country (only) is derived from your IP address on our own server and attached to analytics events as a two-letter country code; the raw IP address itself is never sent to or stored by our analytics provider.
• Error reports: when an unexpected error occurs in your browser while using Laup.ai, we capture the error message, stack trace, and the page URL via PostHog to debug and fix the bug. No form contents, no request bodies, no personal identifiers beyond your account ID.
• Usage data: IP addresses in server logs, login timestamps, scan timestamps.
• Acceptance record: timestamp of when you accepted these terms.

2a. Free AI Visibility Check

The free AI Visibility Check is open to anyone, without an account. When you run one we collect and process:

• The website address you enter and the email address you give us, so we can run the check and send you the result.
• Your network address (IP), used only to rate-limit abuse of the free check. IPv4 addresses are stored as-is; IPv6 addresses are reduced to their /64 network before storage.
• The result itself: the questions we generated, the AI engines' answers, and the report we build from them. The result describes the website checked, but the check record links it to the email address and network address above.

To produce the check we send the public content of the website you enter, and the generated questions, to the AI engines listed under third-party processors below (OpenAI, Microsoft Azure OpenAI, and Google). We do not send them your email address. The report is reachable by anyone holding its private link, so treat that link as confidential. The legal basis is your request for the service (and our legitimate interest in preventing abuse). We may send you one follow-up about your report. The report email also offers a follow-up conversation; we contact you about it only if you ask us to, by pressing the confirmation button yourself. There is no newsletter. Check records are kept until you ask us to delete them. You can ask us to delete a free check at any time at hello@laup.ai; on deletion we remove your email, network address and the URL you entered, and the report link stops working.

3. Why we collect it

• To provide the service: we need your email to authenticate you and your domain to run scans.
• To secure the service: IP logging helps detect abuse and unauthorized access.
• To improve the service: aggregate, anonymized scan patterns help us improve our analysis accuracy.

4. Legal basis (GDPR)

Different processing activities rely on different legal bases. Accepting our Terms of Service at signup is acceptance of the contract — it is not blanket GDPR consent.

• Contract (Art. 6(1)(b)): processing your account data, authenticating you, running scans you initiate, and storing scan results — all necessary to deliver the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): security logging, abuse prevention, error reports, and aggregate product analytics to operate, secure, and improve the service. You can object at any time — see §8.
• Legal obligation (Art. 6(1)(c)): retaining records where required by law (e.g. tax, audit).
• Consent (Art. 6(1)(a)): reserved for processing that is optional and not necessary to deliver the service (e.g. future opt-in features like session replay). We will ask separately and clearly when this applies.

5. Where your data is stored

All data is stored in Azure Norway East (Oslo region), within the EU/EEA. Your data does not leave the EEA for storage purposes.

6. Third-party processors

• Microsoft Azure (hosting, database) - EU data center (Norway East).
• Microsoft Azure OpenAI (LLM analysis) - scan data (publicly accessible website content) is sent to Azure OpenAI for analysis. Hosted in Sweden Central, within the EU/EEA. No personal user data (email, password) is sent to Azure OpenAI. Subject to Microsoft's data processing terms.
• OpenAI and Google (AI engines, free visibility check only) - for the free AI Visibility Check we also query OpenAI and Google's AI search products with the public website content and generated questions, so the report can show how those engines answer. No account data is sent. Subject to each provider's data processing terms.
• PostHog (product analytics) - PostHog Inc. (US-incorporated). All event data is processed and stored in PostHog Cloud EU (Frankfurt, Germany); transfer of the controller relationship to a US-incorporated entity is covered by the EU Standard Contractual Clauses (SCCs) in PostHog's DPA. Used in cookieless mode for anonymous traffic and identified-only mode for signed-in users; no third-party advertising trackers, no cross-site tracking. Full DPA, sub-processor list, and SCCs at posthog.com/dpa.

7. Data retention

• Account data: kept until you delete your account.
• Scan results: kept as long as your account exists.
• Server logs: retained for up to 90 days for security purposes.
• Free AI Visibility Checks: kept until you request deletion (see section 2a), after which the identifying data (email, network address, entered URL) is removed and the report link stops working.

8. Your rights

Under GDPR, you have the right to:

• Access: request a copy of your personal data.
• Correction: update inaccurate data via your profile page.
• Deletion: delete your account and all personal data via your profile page. This immediately anonymizes your data.
• Data portability: request your data in a machine-readable format.
• Withdraw consent: you can withdraw consent at any time by deleting your account.
• Object to analytics: you can opt out of PostHog product analytics at any time by emailing us at hello@laup.ai. Analytics runs on legitimate interest and is not required to deliver the service.

To exercise any of these rights, use the self-service options in your profile or contact us at hello@laup.ai

9. Cookies

Strictly necessary cookies. When you sign in, we set a single httpOnly authentication cookie (JWT) that is strictly necessary for the service to function. JavaScript cannot access it.

No tracking cookies. Our analytics provider (PostHog, see §6) runs in cookieless mode - no identifiers are stored on your device, no advertising or cross-site tracking cookies are used. Because no information is stored on or read from your device, the Norwegian Electronic Communications Act does not require a cookie consent banner.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the email address associated with your account. The "last updated" date at the top will always reflect the most recent version.

11. Contact

For data protection inquiries, contact us at hello@laup.ai