Privacy policy

Data controller

The controller of the data you provide on this website and in the client workspace is:

Operator

Manuel Sampedro Pérez

Trade name

AnswerGravity

Address

Calle de Serrano, 61, 28006 Madrid, Spain

Tax ID

49573698G

Email

hola@answergravity.com

What data we process

What you give us when you ask for a review, a diagnosis or a proposal, when you create or manage an account and when you write to us: name, work email, company, website, market and the message you choose to send.

If you use the client workspace, also your workspace data: questions, model answers, cited sources, public conversations found by listening, reports, drafts, activity records and technical connection and session data, such as the IP address we use to limit requests and protect sign-in.

If you sign in or create your account with Google or Apple, they give us your name, your email and that account’s identifier, and we keep them to recognise you when you come back. We do not receive your Google or Apple password or any other data from those accounts. If you choose to hide your email with Apple, we receive an Apple address that forwards our emails to you.

If you buy, your billing and payment data: name or company name, billing address, tax or VAT number, email, plan, amounts, taxes, payment status and invoices. If you start a free trial, Stripe also asks for a phone number. Your card details are handled by Stripe; AnswerGravity never sees or stores them.

Please leave out sensitive data and any personal data about others that is not needed.

What we use it for and on what basis

Answering your request and preparing a proposal: pre-contractual steps you ask for.

Providing the service you bought, authenticating your account, managing the subscription, payments and invoices, sending operational messages such as the reminder before a free trial ends, and keeping the evidence of measurements: performance of a contract.

Protecting the service, preventing fraud, offering one free trial per person and improving reliability: our legitimate interest.

Showing each client the public conversations about its category: the client’s legitimate interest and ours, as the next section explains.

Measuring how the site and the console are used and which steps lead to a purchase, as explained under “Cookies and audience measurement”: with PostHog, your consent in the European Economic Area, the United Kingdom and Switzerland and our legitimate interest elsewhere; with our own count and Cloudflare Web Analytics, our legitimate interest.

Issuing and keeping invoices and meeting other tax and legal obligations: legal obligation.

We do not send marketing without a valid basis, and you can refuse it at any time.

Data we collect from public sources

For measurements and listening, Bright Data collects on our behalf AI assistant answers and public search results, including forum threads on sites such as Reddit and Quora, for the questions and keywords each client chooses. For each thread we keep the title, the link, a text snippet, the community and its search position. This content is public and may include the username of whoever posted it or other details that person made public.

We use it only to show the client what is said in public about its category and where it makes sense to take part, based on the client’s legitimate interest and ours. We do not build profiles of people and we do not contact the authors. It is kept while the client keeps that brand in its workspace, and it is deleted with the brand or the workspace.

If you appear in that content, you can object to this processing or ask us to erase it by emailing hola@answergravity.com. Include the link to the content so we can find it.

Optional website analysis

When you ask us to analyse a website or discover competitors, we read its homepage and up to six linked public pages. We send Anthropic (or OpenAI, if Anthropic is unavailable) excerpts from those pages, the business name and the names and domains of competitors you already track to prepare a profile and sourced suggestions. We do not send your saved questions, Search Console data, reports or access credentials in this analysis. You can review, change or remove every suggestion before saving. We reuse the result within your workspace for 24 hours to avoid repeating the analysis. It is not a visibility measurement and does not guarantee that an AI will recommend your business.

The console assistant

When you write to the console assistant, we send Anthropic your message, the earlier messages of that conversation and the workspace data it looks up to answer, such as your questions, measurements, competitors, cited sources and listening conversations. We do not send it payment or access data. Answers are generated by AI and may contain mistakes: check them before acting on them. We keep conversations in your workspace so you can come back to them, and they are deleted with the workspace.

Google Search Console

When this integration becomes available, connecting it will be optional. If a workspace owner or admin connects it, Google will ask for read-only permission. We read the properties that Google account can access and, for the property you choose, searches from the last 28 days with final data, their impressions, clicks, click-through rate and average position. We cannot change your website or its Search Console data. Workspace members with access to every brand and without a read-only role can view this information.

We use this data to suggest questions you can review, edit and import. Suggestions are prepared in your browser without sending them to an AI model. We do not store the list of searches or their metrics in our database: only the questions you choose to add. Once you add them to tracking, those questions are sent to the selected measurement services and assistants to obtain their answers, like other questions in your workspace.

We store the permission that keeps the connection active in encrypted form, together with who connected it and when. You can disconnect it in Settings, “API & MCP”: we delete the stored permission and ask Google to revoke access. You can also remove it from your Google Account connections. Disconnecting does not delete questions you have already imported; you can manage them in Prompts or request erasure as described under “Your rights”.

The connection relies on your authorization and is used only for the feature you request. We do not sell this data or use it for advertising. The use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Who else is involved

These providers process data on our behalf, as processors, and only to provide their service to us. Stripe also processes some data as an independent controller, to prevent payment fraud and meet its own legal obligations, under its privacy policy. We do not sell personal data or share it with third parties for their own purposes, unless the law requires it.

Railway

Hosting of the website, the application and its background processes.

Cloudflare

Hosting the collector and storing the aggregate counters, and the traffic statistics of Cloudflare Web Analytics, described under Cookies and audience measurement.

Neon

The application’s database, hosted in the European Union (Frankfurt).

PostHog

Product analytics for the site and the console, with the data hosted in the European Union (Frankfurt), described under Cookies and audience measurement.

Resend

Sending the application’s emails, such as verification codes, notices and reminders.

Spaceship (Spacemail)

Email for the answergravity.com domain: it receives the messages you send us.

Google (Gmail)

The operator’s mailbox, which receives notices of new requests and replies to our emails.

Google (Calendar y Meet)

Booking the 15-minute call: it receives your name, your email and the time you choose, and sends the invitation with the Google Meet link.

Google and Apple

Signing in with your Google or Apple account, if you choose to. Each provides it as a controller, under its own privacy policy.

Stripe

Card payments, subscriptions, tax calculation, invoices, the customer portal and fraud prevention.

Bright Data

Collection of AI assistant answers and public search and forum results for measurements and listening.

Anthropic

Claude models: analysing public pages to prepare a business profile and suggest competitors and questions, preparing text drafts, the console assistant’s answers and, when active, measuring Claude’s answers.

OpenAI

The same analysis and drafting features as a fallback, when Claude is unavailable or its spending limit is reached.

Transfers outside the European Economic Area

Neon keeps the database, and PostHog the analytics data, in the European Union. Railway, Resend, Spaceship, Google, Apple, Stripe, Cloudflare, PostHog, Anthropic and OpenAI are US companies or part of groups based there, and Bright Data is based in Israel, so they may process data outside the European Economic Area. When they do, the safeguards required by the GDPR apply: an adequacy decision of the European Commission, such as the one for Israel or the EU-US Data Privacy Framework for companies certified under it, or standard contractual clauses approved by the Commission. You can ask us which safeguard applies to each provider.

How long we keep it

Requests, for as long as needed to answer you and follow up on the proposal.

Account data, while the account is active and afterwards for as long as needed for claims, security or legal obligations. By default, measurement evidence is kept for 365 days and reports and audit records for 730 days, unless the workspace sets another permitted period or a legal hold applies. Sessions expire after 30 days.

Invoices and billing data, for the periods Spanish tax and commercial law requires, generally four to six years.

PostHog analytics data, as explained under “Cookies and audience measurement”.

Free trial fingerprints, twelve months.

Your rights

You can ask for access, rectification, erasure, restriction, objection and portability, and withdraw consent without affecting earlier processing, by emailing hola@answergravity.com. We will ask for reasonable information to verify your identity before answering.

If you disagree with our answer, you can complain to the Spanish Data Protection Agency.

Cookies and audience measurement

We only use first-party cookies: those needed to keep your session and prevent forged requests, and one functional cookie, ag_internal, which is only created if you open an address on the site with ?internal=1. It marks visits and test purchases by the AnswerGravity team as internal traffic, to keep them apart in our analytics; it holds no identifier (its value is always 1), lasts one year and is deleted when you open any page with ?internal=0. On its own it neither loads PostHog nor sends it anything. There are no advertising or analytics cookies, except those Google may set if you load its calendar on the call page, as explained at the end of this section. None of the three audience measurements described here uses cookies.

To administer and improve the site, we keep our own count of public page requests and of the outcome of request form submissions. We keep only daily UTC counters for each public page or page group: these statistics do not store visitor identifiers, IP addresses, devices, location, URL parameters, referrers or form content. This count does not record personal journeys or link counters to accounts or payments. The basis for this processing is our legitimate interest in understanding use and failures of public pages through measurement limited to totals.

Cloudflare hosts the collector and counters on our behalf. When receiving requests it processes connection data needed to provide the infrastructure, including the IP address; that data is not added to our counters. Its Customer Data Processing Addendum sets out the terms of that processing. Processing outside the European Economic Area is possible, subject to the safeguards described in the transfers section.

We also measure site traffic with Cloudflare Web Analytics, a service of Cloudflare, Inc. A small script on the site’s pages, except shared reports and invitations, whose address carries a private code, sends Cloudflare the page URL, the referring page, the browser and device type and the approximate country, which Cloudflare derives from the connection. It does not use cookies or build personal profiles, and we only see this data in aggregate, never individual visits. Its purpose is to measure site traffic. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in knowing how much and how the site is used. Cloudflare acts as our processor under its Customer Data Processing Addendum. Transfers to the United States are covered by the EU-US Data Privacy Framework, under which Cloudflare is certified, and by the standard contractual clauses approved by the European Commission.

Finally, we use PostHog, a service of PostHog, Inc. with the data hosted in the European Union (Frankfurt, eu.posthog.com), to understand how the site and the console are used and which steps lead people to try the free check, create an account and subscribe to a plan. If you visit us from the European Economic Area, the United Kingdom or Switzerland, we load it only if you accept it in the “Your privacy” notice: until then your browser neither downloads its script nor sends it anything. From other countries it loads when the page opens, unless you reject it under “Privacy preferences”. The script records the pages you visit and when you leave them, clicks on buttons and links, with their text, the outcome of those steps (for example, that you started or finished the free check, with the domain checked and its score, that you created an account and how, or the plan you looked at or chose on your way to payment) and technical data about your browser: browser type and version, operating system, device type, screen size, language and referring page. PostHog receives the connection’s IP address, derives your approximate location (country and city) from it and discards it without storing it. Before sending each address we strip its parameters, except campaign ones and those of the chosen plan, and we mask any email that appears in a text. We do not identify you: even if you sign in or create an account, PostHog does not receive your account identifier, your email or your name, and it creates no profile of you. It uses no cookies and not your browser’s local storage, except a marker of your choice if you change it under “Privacy preferences”, removed when you move to another page. When it is on (in the European Economic Area, the United Kingdom and Switzerland, only after you accept it), it keeps a random visitor identifier and a session identifier in that tab’s session storage (sessionStorage), to link the pages you visit in it; they disappear when you close the tab, so each new visit starts as anonymous, and we delete them if you reject or withdraw your consent. It does not record your session. Our server also sends PostHog, without any data that identifies the buyer, a notice of each first plan purchase (plan, billing interval, amount, taxes and whether it starts with a free trial).

With PostHog on, four kinds of diagnostic data are also sent. Heatmaps ($$heatmap) collect, every five seconds while the page is in view and when you leave it, and per page address, where you click (including repeated clicks and clicks that do nothing), the points where the mouse pointer stops and whether the element was fixed on screen. Dead clicks ($dead_click) are clicks after which nothing on the page changes for about two and a half seconds; on touch screens, swipes that move nothing are counted too ($dead_swipe, at most ten each time the page loads). They carry the same element details as other clicks, with its text, and how long there was no response, and swipes their direction and length. Performance ($web_vitals) measures how long the page takes to show its first content and its main element, how much the content shifts while loading and how long it takes to react when you tap or click something (FCP, LCP, CLS and INP); for LCP and INP it adds which element or image it was, the type of interaction and the breakdown of those times. Errors ($exception) are the JavaScript failures the page does not handle (unhandled errors and rejected promises, not the messages in the browser’s console or those of its extensions), with their type, their message and the files, functions and lines of code where they happened; at most ten in a row of each type are sent, then one every ten seconds. An error’s message is put together by the code that fails and, in the console too, it may repeat something from the page where it happens: as with every other event, we strip the parameters from its addresses and mask any email in it. None of this data collects what you type into fields or records the screen.

The purpose is to improve the site and the product, to find what fails or is slow and to measure which steps lead to a purchase; we do not use it for advertising and we do not sell this data. The legal basis is your consent (Article 6(1)(a) GDPR) in the European Economic Area, the United Kingdom and Switzerland, and our legitimate interest (Article 6(1)(f) GDPR) in other countries and for the server’s purchase notice. PostHog acts as our processor under its Data Processing Agreement; it is a US company, so if it processes data outside the European Economic Area, the safeguards described in the transfers section apply. PostHog keeps events for our plan’s period, which is one year: after that they are no longer available to our queries, although PostHog does not guarantee to delete them at that point. As we do not link them to your account or your email, we cannot find those of a particular person. PostHog does not load on shared reports or invitations.

To know whether we must ask for your permission, our server looks up your IP address’s country in a local copy of the IPinfo Lite database, which we download every day; for this lookup we send your address to no one and we keep neither the address nor the country. If we cannot tell for certain, we show you the notice. The basis for this lookup is our legitimate interest in asking for consent where the law requires it. IP address data powered by IPinfo. IPinfo Lite data is used under the Creative Commons Attribution-ShareAlike 4.0 (CC BY-SA 4.0) licence.

We keep your choice in your browser’s local storage (consent_analytics), with its date and the notice’s version, for six months; after that, or if we change the notice or what PostHog measures, we ask you again. You can withdraw your consent at any time under “Privacy preferences”, at the foot of every page (in the console, in your account menu), without affecting earlier processing: PostHog stops sending data from that very page and is not loaded again while your choice holds.

We retain our own counters for the latest 90 UTC calendar days. You can object to our measurement, our own count and PostHog, and turn it off in this browser with the control at the end of this section, or by opening any page of the site with ?stats=off in the address; the control also lets you turn it back on. We store that exclusion preference in your browser’s local storage. We also send no count of our own and do not load PostHog if your browser signals Do Not Track (DNT) or Global Privacy Control (GPC). That control and those signals do not apply to Cloudflare Web Analytics, which does not act on them: if you do not want your visit measured, you can block scripts from static.cloudflareinsights.com in your browser. Exclusion affects future requests; it does not change earlier totals, which we do not associate with a person, or data PostHog has already received.

When you pay, you move to Stripe’s payment page, which uses its own cookies to process the payment and prevent fraud, under its policy.

The 15-minute call page can show Google’s booking calendar. It does not load until you press “See available times”: before that, the page requests nothing from Google. Once you press it, Google receives your IP address and browser details and may set its own cookies, such as NID, which its cookie policy says it uses to remember your preferences and also for advertising. Pressing the button is your consent to load it; you can delete those cookies from your browser. On a phone, and on a computer if you prefer, the calendar opens in a new tab, on Google’s website.

Your preference is kept in this browser only.

Automated decisions

AI features prepare evidence or drafts that a person reviews. We make no automated decisions with legal or similarly significant effects on anyone.

If you start a free trial, we keep for twelve months a fingerprint of your card, email, phone and connection address, computed with a secret key, to check automatically that you have not had another trial. The fingerprint does not contain that data in readable form and we use it for nothing else. If the check leaves you without a trial, you can still subscribe or write to us to review it. Stripe may also use automated systems to detect fraudulent payments.

Security and changes

We use workspace access controls, securely stored passwords, protected session cookies, defences against forged requests, request limits, encryption in transit and audit records. No system removes every risk. If we change anything material, we will publish it here with a new effective date.