Last updated: 5 September 2026 · Version 1.0
This policy explains what personal data Geosay collects when you use getgeosay.com or request an AI-visibility audit, why it is collected, how long it is kept, and what rights you have. It is written for the people who actually read it, so it is short. If anything is unclear, email sergei@getgeosay.com.
The data controller is:
Sergei Drozdov, trading as Geosay
Email: sergei@getgeosay.com
Geosay is operated by one person and is not established in the European Union. I offer the service to agencies in the EU, the UK and the US, so the EU General Data Protection Regulation (GDPR) and the UK GDPR apply to how I handle your data. Given the small scale and low-risk nature of the processing (occasional, no special-category data, no monitoring of individuals), I rely on the exemption in Article 27(2)(a) GDPR and have not appointed an EU or UK representative. If this changes, this section will be updated.
| Data | Where it comes from | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Your name (if given) and work email address | Audit request form, or an email you send me | To confirm the audit scope, run it, deliver the report and answer your questions | Art. 6(1)(b) — steps at your request before entering into a contract |
| Client brand or website, competitor names, market or country | Audit request form, follow-up emails | To choose the prompts and run the audit | Art. 6(1)(b) |
| The content of our correspondence | To respond to you and keep a record of what was agreed | Art. 6(1)(b); Art. 6(1)(f) — my legitimate interest in keeping records | |
| Your feedback about the audit and the product (a 25-minute call or written notes, if you agree to it) | You | To improve the audit and build the product | Art. 6(1)(a) — consent, which you can withdraw at any time |
| Follow-up about a paid, ongoing version of the reports | Me | One or two emails after the free audit; you can say no | Art. 6(1)(f) — legitimate interest in following up with an existing business contact. You can object at any time. |
| Basic technical data: IP address, browser type, pages requested | Automatically, by the hosting provider's server logs | To keep the site running and secure | Art. 6(1)(f) |
What I do not collect. I do not use advertising cookies, tracking pixels or third-party analytics. I do not buy, enrich or scrape personal data about you. I do not collect special-category data (health, political opinions, etc.) and I ask you not to send any.
About your client's data. The audit looks at what public AI assistants (ChatGPT, Perplexity, Google AI Mode) say about a brand. This is public, non-personal information about a company. I do not need, and ask you not to send, personal data about your client's staff or customers.
I do not sell or rent personal data, and I do not share it with anyone for their own marketing. To run the service I use a small number of service providers who process data on my behalf under their own data-processing terms:
| Provider | What for | Location / transfer safeguard |
|---|---|---|
| Framer B.V. | Website hosting | EU (Netherlands); global CDN |
| Tally B.V. | The audit request form | EU (Belgium) |
| Google LLC (Google Workspace) | Email and document storage | US; EU-US Data Privacy Framework and Standard Contractual Clauses |
Because I am not based in the EU, your data is also transferred to the country where I work. Netherlands. Where a transfer is not covered by an adequacy decision, I rely on the derogation for transfers necessary to perform a contract at your request (Art. 49(1)(b) GDPR) and, for service providers, on Standard Contractual Clauses.
I may also disclose data if the law requires it, or to protect my rights in a dispute.
If you ask me to delete your data earlier, I will, unless I am legally required to keep it.
If you are in the EU, the UK, or another place with similar law, you have the right to:
To exercise any of these, email sergei@getgeosay.com. I answer within 30 days, usually much faster, and I do not charge for it. I may ask you to confirm it is really you, from the email address you used with me.
Geosay does not meet the thresholds of the California Consumer Privacy Act (CCPA/CPRA) or similar state laws, but I follow the same principles anyway:
The site uses only the strictly necessary cookies set by the hosting and form providers to make the pages work. No consent banner is shown because no optional cookies are set. If I add analytics later, I will use a cookie-free tool or ask for your consent first, and update this section.
Data lives in the providers listed above, all of which use encryption in transit and at rest. Access is limited to me, protected by two-factor authentication. No system is perfectly secure; if a breach ever affects your data I will tell you and, where required, the relevant authority, within the timelines the law sets.
The service is for businesses. I do not knowingly collect data from anyone under 18.
When this policy changes, the date and version at the top will change, and if the change matters to you (new purposes, new providers outside the EU), I will email people who have an open audit request.
Questions, requests, or something you think is wrong here: sergei@getgeosay.com. — Sergei