Privacy Policy
What personal data AIGROW collects, why, who receives it, how long we keep it and how to exercise your rights. It covers aigrow.gg, our console and API, our emails and the checker agencies embed on their own sites.
Last updated 27 October 2026.
In short
- PeakCore LLC runs AIGROW and decides how the personal data in this policy is used. When a business customer puts its own customers’ data into AIGROW, we process that data for the customer under our Data Processing Addendum.
- We collect what you give us, what your browser sends when you use the site, and what public sources and AI models say about businesses we measure.
- We use it to run the site and the services, take payments, send the emails you asked for, keep AIGROW secure and understand how the site is used.
- We do not sell personal data, share it for targeted advertising or use advertising trackers.
- Our analytics tool is PostHog. In Europe it runs only once you allow it in the cookie banner, and anywhere you can choose what we may use in the cookie settings, linked from the cookie policy.
- Personal data is processed in the United States and in Germany, with the safeguards the law recognises for transfers.
- Write to privacy@aigrow.gg to see, correct, export or delete your data. We answer within one month.
This summary helps you read the document; the full text below is what applies.
1. Who we are
AIGROW is operated by PeakCore LLC, a Wyoming limited liability company (filing number 2025-001758748), 30 N Gould St Ste R, Sheridan, WY 82801, United States. In this policy "we", "us" and "our" mean PeakCore LLC.
PeakCore LLC is the controller of the personal data described in this policy. That means we decide why and how it is used for the website, accounts, scans, sales, support, marketing and our research.
When we act for a business customer
Some customers put personal data about their own clients, customers or contacts into AIGROW. Examples are an agency’s client details and the leads its embedded checker collects, the facts saved on a monitor, Search Console data, and content given to the assistant, the blog engine or our API. For that data we are a processor: we handle it only on the customer’s instructions, under our Data Processing Addendum, and the customer’s own privacy notice explains how it is used.
If your data reached us through one of our customers, please contact that business first. If you write to us instead, we will pass your request on to it.
How to reach us about privacy
Write to privacy@aigrow.gg about anything in this policy. The same address is the contact point for individuals and supervisory authorities in the European Union, the European Economic Area (EEA), the United Kingdom and Switzerland.
2. What this policy covers
This policy covers personal data we handle through aigrow.gg in every language, the console and the API, the emails we send, the checker agencies embed on their own sites, our affiliate program, job applications and our research publications: the AI Visibility Index, the AI Source Map and our studies.
It does not cover sites and services run by others, even when we link to them or they open from our pages, such as Stripe’s checkout pages, Google’s sign-in pages or our profiles on social networks. Their own policies apply there.
The cookie policy describes in detail what we keep in your browser. Our Terms of Service govern your use of AIGROW. This policy informs you about how we handle personal data; it is not part of that contract.
3. The data we collect
What we collect depends on how you use AIGROW. The table lists each group of people we hold data about, what we hold and where it comes from.
| Category | Examples | Where it comes from |
|---|---|---|
| Visitors to the site | IP address, browser and device type, language, the pages you view and in what order, the page your visit began on, the site that linked you, campaign tags in the link, whether an ad click brought you, page performance measures, and on devices without a touch screen your clicks and, if you allow session recordings, a replay of how the page changed while you used it. | Your browser, our servers, Cloudflare and PostHog. |
| People who run a scan or use a free tool | The website, business name, category, place and questions you enter, the result, your IP address, and your email address and language if you ask to keep the report. Most free tools work in your browser and keep what you type on your device. | You, the public pages of the site you check, public reference sources and the answers of the AI models we ask. |
| Account holders | Email address; name and profile picture if you sign in with Google; sign-in method; language; settings and email choices; how you first found us; the sites, questions, markets, rivals and business facts you save on monitors; Google Analytics traffic totals you upload; assistant conversations, memories and documents; blog engine settings and the Search Console key you connect; course progress; API keys and API usage records. | You, Google if you choose to sign in with it, and our systems as you use the services. |
| Buyers | Name, email address, billing address, what you bought, amounts and payment status, the website and business the order is for (for an agency’s white-label order, its client’s business name and website), your brief and our messages about the work. If you start a card trial where one is offered, Stripe’s card fingerprint, so that each card gets one trial. | You and Stripe. Stripe handles your card details; we receive identifiers and payment status, never your full card number. |
| Visitors who use a checker an agency embeds | The website checked, the reading, and the email address you give if you ask for the reading by email. | You, through the agency’s site. We send you the reading and pass your email address, website and reading to the agency. We do not store your address in our database. |
| Affiliates and the people they refer | Your referral code; clicks on your links (a one-way hash of the visitor’s IP address, the browser type and the landing page); the email address of each referred buyer, their payments and your commissions; your payout method and details: a PayPal email address, a bank account holder, account number or IBAN and routing or SWIFT code, or a crypto wallet address and network. | You, the browsers of people who follow your links, and Stripe. |
| Job applicants | Name, email address, the links you share, what you tell us about yourself, the role, your statement that you are over 18, and the status of your application. | You. |
| People who write to us | Name, email address, company, topic, subject, message, language and our replies. | You. |
| People who give a testimonial | The name and role you choose to show, your words, a photo or video if you add one, and your consent to publish them. | You. |
| Newsletter and edition subscribers | Email address, language, where you signed up, when you confirmed and when you stopped, and the business names you follow on Index pages. | You. |
| People and businesses in our research | Business names as AI models give them, which can include a person’s name when a business trades under it, with the category and place, how often each name appears in answers, and the public pages the answers cite. | The answers of AI models to our questions, and public websites. |
Public reference sources means services such as Wikidata, the Internet Archive and domain registration records, which some of our tools query about a domain or business name.
We do not ask for special categories of personal data, such as data about health, religion or political opinions. Please do not send them to us through our forms or the assistant. If you give us personal data about someone else, for example a colleague or a client, make sure you are allowed to.
4. How we use it and our legal bases
We use personal data only for the purposes below. For each one the table gives the legal basis under Article 6 of the GDPR and the UK GDPR. Where we rely on legitimate interests, it names the interest, and you can object as the section on your rights explains.
| Purpose | Data used | Legal basis |
|---|---|---|
| Run the website and its free tools, and show you what you ask for, such as a scan result | Technical data and what you enter | Contract (Article 6(1)(b)) when you ask for a tool or a scan; otherwise our legitimate interest in offering a working, free website. |
| Create and run your account and sign you in | Account data | Contract. |
| Deliver what you buy, take payment, issue API credit, and manage subscriptions, cancellations and refunds | Buyer and account data | Contract. |
| Run monitors, reports, the assistant, the blog engine and the API | Account data and what you give each service | Contract. |
| Send service emails, and a few emails that help you use what you signed up for | Email address, language, account and order data | Contract; for the help emails, our legitimate interest in helping you get value from what you asked for, with a one-click way out. |
| Send emails with offers, and the edition emails of the Index and the Source Map | Email address, language and your choices | Consent (Article 6(1)(a)). |
| Answer messages and support requests | Contact data and messages | Our legitimate interest in answering people who write to us; contract where the message concerns your purchase. |
| Measure how the site is used and improve it | Analytics data | In Europe, your consent (Article 6(1)(a)) to analytics, and to session recordings for replays, asked in the cookie banner and withdrawn in the cookie settings. Elsewhere, our legitimate interest in knowing which pages and features work, with the opt-out in the same settings. The key steps our servers report rest on our legitimate interest everywhere. |
| Learn which channels bring visitors and customers | Entry page, first-touch note, referral code | For the entry page and the first-touch note in Europe, your consent (Article 6(1)(a)) to marketing attribution. Otherwise, and for the referral code, our legitimate interest in measuring our marketing. |
| Run the affiliate program and pay commissions | Affiliate and referral data, payout details | Contract with the affiliate; our legitimate interest in crediting referred sales correctly and preventing fraud. |
| Send an agency checker’s reading to its visitor and the lead to the agency | Checker data | We act for the agency, which is responsible for the legal basis. We send you the reading because you ask for it. |
| Publish a scan result as a public page | The scan result | Consent, given when you choose to publish it. |
| Publish testimonials | Testimonial data | Consent; contract for the credit we give for a testimonial. |
| Review job applications | Applicant data | Steps you ask us to take before a contract; our legitimate interest in recruiting. |
| Research and publish the AI Visibility Index, the AI Source Map and our studies | Research data | Our legitimate interest, and the public’s, in research on how AI models describe and recommend businesses. |
| Keep AIGROW secure and prevent spam, fraud and abuse | IP address, captcha results, request data, account and order data | Our legitimate interest in protecting AIGROW, its users and our systems. |
| Keep records, meet legal duties and handle disputes | Order, billing, affiliate and correspondence records | Legal obligation (Article 6(1)(c)); our legitimate interest in establishing, exercising or defending legal claims. |
| Reorganise, finance or sell our business | Any of the above, as needed | Our legitimate interest in running and transferring our business. |
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect what we did before it.
No law requires you to give us personal data. Some services cannot work without it: an account needs an email address, and a purchase needs payment details.
5. What goes to AI models
AIGROW measures and works with AI models, so some of what you give us is sent to them. This is what goes where.
- Scans, monitors and the Index. We send the business name, website, category, place and questions to AI models, through OpenRouter or through our own API infrastructure. We do not send your email address or account details with them. In paid monitors and the Index the models may search the web, which passes the questions to the search provider our AI routing service uses.
- The assistant. Your messages, your project details, the memories the assistant keeps and the relevant passages of documents you upload are sent through OpenRouter to the model that answers. Documents are split and indexed on our own servers. Conversations stay in your account so you can return to them.
- The blog engine. Your site details, your topics and the Search Console figures it works from are sent to AI models to plan, write and improve articles.
- Our API endpoint. When you call a model through our API, your prompts and the responses pass through our endpoint and our upstream infrastructure provider to and from the provider of the model you call, in transit. We store usage records only: token counts, model, cost, status and latency. We never store the content of prompts or responses.
The providers that receive this content handle it under their own terms for API customers. We do not use your content to train AI models.
AI answers can be wrong. If a model says something inaccurate about you or your business, we cannot change the model. We can correct or remove what we publish ourselves, such as an Index page, when you show us that it is inaccurate.
6. Analytics
We use PostHog, on its United States cloud, to understand how people use the site. It runs only on the live site.
- On every device it records the pages you view, when you leave a page, and performance measures such as how fast a page loads and responds.
- On devices without a touch screen it also records clicks and similar interactions, and, if you allow session recordings, makes session replays: a reconstruction of how the page changed while you used it, which we watch to find problems.
- On touch screens it does neither.
- It does not run on private report pages or invoice pages, and it drops any event that mentions a private report link.
- It keeps a profile tied to a person only after you sign in, and then uses your account ID, not your email address.
- Our servers also report a few key steps to PostHog: an account created, a first reading, a scan started, an email left on a scan, a checkout opened, completed or expired, and a plan changed. They are linked to the same browser ID.
What travels with each request
Every request your browser makes to our API can carry three short items. The first is the first page of your current visit. The second is a note of how this browser first found us: the campaign tags of the link, a referral tag, the name of the site that linked you, whether a Google or Microsoft ad click brought you (only that fact, not the click’s identifier) and when. The third is your PostHog browser ID. The first two travel only while you allow marketing attribution, the third only while you allow analytics. We save the first-touch note with your account, a kept scan or a checkout, so we know which channels bring customers.
If your device is set to a European time zone, or to one we cannot place such as UTC, a banner asks for your consent, purpose by purpose, before PostHog loads or the first two items are kept, and we rely on that consent (Article 6(1)(a)). Elsewhere we rely on our legitimate interest in measuring and improving the site. You can withdraw your consent or turn any purpose off at any time in the cookie settings, opened from the cookie policy or the foot of our pages, or block it with your browser settings or an extension. Turning analytics off stops your requests carrying the browser ID, and turning marketing attribution off stops them carrying the other two items. Our servers still report the key steps listed above, linked to your account when you are signed in, but no longer to your browser ID. Those reports read nothing from your device, so they rest on our legitimate interest in knowing which steps work, in Europe too. We do not use advertising or retargeting trackers.
7. Emails
We send four kinds of email, through our email provider Resend.
- Service emails. Sign-in links (valid for 15 minutes), receipts and order confirmations, API credit codes, reports, monitor alerts and the weekly digest, replies to your messages, and notices about your account or our terms. They are part of the service you asked for.
- Help emails. After you create an account or keep a scan report, a few emails help you use it, such as a reminder of your free reading, the first fix of your report step by step and a new measurement after 30 days. Each one says why it arrived.
- Offers. Emails with offers or prices, including a reminder of a checkout you did not finish, go only to addresses that ticked a box asking for them. The box is never ticked for you.
- Edition emails. One email per new edition of the AI Visibility Index and the AI Source Map, only after you confirm your address by email.
Help emails, offers and edition emails carry a one-click unsubscribe link. Unsubscribing through a help email or an offer stops both kinds to that address. Stopping the edition emails also deletes the business names you followed.
Monitor alerts and the weekly digest have their own switch, in the console settings and in each of those emails. We keep sending the service emails you need, such as receipts and sign-in links, for as long as you use the service.
8. Who receives your data
We do not sell personal data. We share it only with the recipients below, for the purposes stated. Providers that process personal data for us may use it only to provide their service to us.
| Category | Who | What they receive and why |
|---|---|---|
| Hosting | Contabo, in Germany | Everything we store, on the servers that run AIGROW. |
| Site delivery and protection | Cloudflare | Requests to the site, including your IP address, to deliver pages and protect them against attacks. |
| Payments | Stripe | Checkout, card and billing details, subscriptions and refunds. Stripe also uses payment data for its own fraud prevention and legal duties, as its privacy policy explains. |
| Resend | Your email address and the content of the emails we send you. | |
| Spam and bot protection | hCaptcha | The data its widget collects on sign-in, scan, contact, careers and checker forms, to tell people from bots. |
| Analytics | PostHog | The analytics data described above. |
| Sign-in and Google services | If you sign in with Google, Google confirms who you are. Addresses you test with our speed and mobile tools go to Google’s public testing services. If you connect Search Console, we use your key to read your data from Google. | |
| AI models | OpenRouter, our upstream infrastructure provider and the providers of the AI models we use | What the section on AI models describes. |
| Web search for AI models | The search provider our AI routing service uses | Questions and business names, when a model searches the web. |
| Public reference sources | Wikidata, the Internet Archive and domain registration services | A domain or business name, when a tool looks it up. |
| Affiliate payouts | PayPal, banks or the blockchain network you choose | The amount and the details needed to pay you. A crypto payout is recorded publicly on its blockchain. |
| Agencies | The agency whose checker you use | Your email address, website and reading, when you ask for the reading by email. |
| The public | Anyone who visits the page | A scan result you choose to publish, a testimonial you agree to publish, and our research publications. |
| Advisers and authorities | Lawyers, accountants, auditors, courts, regulators and law enforcement | What they need, where the law requires it or to establish, exercise or defend legal claims. |
| A buyer of our business | A successor or buyer and its advisers | What they need for a merger, financing, acquisition or sale of assets, under confidentiality. This policy keeps applying to your data. |
The full current list of providers that process personal data for us is available on request from privacy@aigrow.gg.
9. International transfers
PeakCore LLC is based in the United States and our servers are at a hosting provider in Germany. Personal data is processed in both countries.
When personal data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum and the Swiss amendments where they apply, or on the recipient’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it has one.
You can ask privacy@aigrow.gg for a copy of the safeguards that apply to your data.
10. How long we keep data
We keep personal data only as long as we need it for the purposes in this policy. How long depends on the kind of data, as the table sets out. When we no longer need it, we delete it or make it anonymous, unless the law requires us to keep it or we need it to establish, exercise or defend legal claims.
| Data | How long we keep it |
|---|---|
| Account data and what you save in the services | While your account is open. After you ask us to close it, as long as needed to finish open orders, settle payments and keep the records below. You can delete some content yourself at any time, such as a monitor, a connected blog site, a document or a memory of the assistant. |
| API usage records | As account data. Prompt and response content is never stored. |
| Orders, invoices, payments and commissions | As long as tax, accounting and commercial law requires. |
| Kept scans and scan reports | As long as needed to let you return to your report and follow it up, or until you ask us to delete them. A result you published stays public until you ask us to take it down. |
| Sign-in requests | A sign-in link works for 15 minutes. The record of the request, with its IP address, is kept as long as it is useful for security and abuse prevention. |
| Messages and support requests | As long as needed to handle the request and any follow-up, then as long as it is useful as a record of our correspondence. |
| Email choices | Your consent and any unsubscribe, for as long as we might email the address, so we can prove and respect your choice. |
| Edition subscriptions | Until you stop them. The names you followed are deleted when you do. We keep a record that the address stopped, so we do not email it again. |
| Analytics data | As long as it is useful for analysis, within the limits our analytics provider sets for our account. |
| Affiliate data | While you are an affiliate, then as long as needed to settle commissions, handle disputes and meet tax and accounting duties. Click data, as long as it is useful to report on your links and detect fraud. |
| Job applications | For the recruitment you applied to, then as long as needed to answer questions or claims about it. Ask us if you want yours deleted sooner. |
| Testimonials | While published and until you withdraw your consent. We keep the record of your consent as long as we might need to show it. |
| Research publications | Published editions and datasets are kept as a permanent research record. |
| Technical and security logs | As long as needed for security, troubleshooting and abuse prevention. |
11. Security
We protect personal data with measures that fit what we do. They include:
- Encryption in transit: the site, the account pages and the API are served over HTTPS.
- No passwords: you sign in with a link we email, valid for 15 minutes, or with Google.
- Payments on Stripe’s hosted pages, so card numbers never reach our systems.
- Search Console keys encrypted before we store them.
- Access to personal data limited to the people who need it for their work.
- A captcha and rate limits on the sign-in, scan, contact, careers and checker forms.
- Keeping less: no prompt or response content from the API, no agency checker leads in our database, only a one-way hash of the IP address behind an affiliate click, and only totals from the Google Analytics files you upload.
No system is completely secure. If a breach of your personal data is likely to result in a high risk to your rights, we will tell you as the law requires. Please report vulnerabilities to security@aigrow.gg. Our security page says more about how AIGROW works.
12. Your rights
If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the following rights, within the limits those laws set.
- Access. Ask whether we hold data about you and get a copy, with information about how we use it.
- Correction. Have inaccurate data corrected and incomplete data completed.
- Deletion. Have your data deleted, including your whole account, when there is no longer a reason to keep it.
- Restriction. Have us keep your data but stop using it, for example while you contest its accuracy.
- Portability. Receive the data you gave us, where we process it by contract or consent, in a commonly used machine-readable format, or have it sent to another provider where that is technically feasible.
- Objection. Object to processing based on our legitimate interests, as explained below.
- Withdrawal of consent. Withdraw consent at any time, without affecting what we did before.
- Complaint. Complain to a supervisory authority, in particular where you live or work or where you believe your rights were infringed.
Your right to object. You can object at any time, on grounds relating to your situation, to processing based on our legitimate interests, including analytics, attribution and our research. We will then stop, unless we have compelling legitimate grounds that override your interests or we need the data for legal claims. You can object to direct marketing at any time, without giving a reason, and we will stop.
How to exercise them
Write to privacy@aigrow.gg, ideally from the email address linked to your account. Requests to delete your account or to receive a copy of your data go to the same address.
Before we act, we may ask for information to confirm your identity, and we ask for no more than we need. We answer within one month of receiving your request. If a request is complex or you send several, we may extend this by two further months and will tell you why within the first month.
Exercising your rights is free. If a request is manifestly unfounded or excessive, in particular because it repeats an earlier one, we may charge a reasonable fee or decline it, and will explain why. When we delete data, our reply names any records the law or a provider requires us to keep, and why.
United Kingdom. You can complain to the Information Commissioner’s Office.
Switzerland. You can complain to the Federal Data Protection and Information Commissioner.
France. You can also give us instructions about what should happen to your personal data after your death.
13. United States privacy rights
This section applies to residents of California and of other US states with comprehensive privacy laws, to the extent those laws apply to us. It adds to the rest of this policy, which describes our sources, purposes and retention.
What we collected in the last 12 months
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email address, IP address, account ID and browser ID | Hosting, site delivery, email, payment, analytics, captcha and AI providers |
| Customer records | Billing address; for affiliates, bank or PayPal payout details | Payment and payout providers |
| Commercial information | Products bought, orders, subscriptions and commissions | Payment providers |
| Internet or other network activity | Pages viewed, clicks, session replays on devices without a touch screen, the referring site and campaign tags | Analytics provider |
| Audio or visual information | A photo or video you add to a testimonial | Hosting provider; the public, if published |
| Professional or employment information | Your role and company, and what you send with a job application | Hosting and email providers |
| Sensitive personal information | Account access through sign-in links and session tokens | Hosting and email providers |
We use sensitive personal information only to provide the services and keep them secure, as these laws allow, and not to infer characteristics about you.
No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising or use it for targeted advertising. We have not done so in the last 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. Because we do neither, there is nothing to opt out of. We do not disclose personal information to third parties for their own direct marketing.
Your rights
- Know what personal information we collect, use and disclose, and get a copy of it.
- Have it deleted.
- Have inaccurate information corrected.
- Receive it in a portable format.
- Opt out of the sale or sharing of personal information, targeted advertising and profiling with legal or similarly significant effects. We do none of these.
- Limit the use of sensitive personal information. We use it only as described above.
To make a request, write to privacy@aigrow.gg. We verify your identity by matching what you tell us with what we hold, and we answer within the time your state’s law sets.
You may use an authorized agent. We may ask the agent for proof of your signed permission and ask you to confirm your identity with us directly, unless the agent holds a valid power of attorney.
If we decline your request, you may appeal by replying to our decision. If we turn down your appeal, you may contact your state’s attorney general.
We will not deny you service, charge you a different price or give you a different quality of service because you exercised these rights.
14. Children
AIGROW is built for businesses and professionals. You must be at least 18, or the age of majority where you live, to use it. The site is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to privacy@aigrow.gg and we will delete it.
15. Automated decisions
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Some routine checks run automatically, such as the captcha, rate limits on forms and the program rules that decide whether a referral earns a commission. If one of them affects you and you think it got it wrong, write to us and a person will review it. Scans and monitors describe how AI models answer about businesses; they do not assess people.
16. Changes to this policy
We update this policy when our services or the law change, and the date at the top shows the current version. If a change materially affects how we use personal data you have already given us, we will tell account holders by email or with a notice on the site before it takes effect. Where a change needs your consent, we will ask for it.
17. Contact
Privacy questions and requests: privacy@aigrow.gg. Security vulnerabilities: security@aigrow.gg. By post: PeakCore LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.