Privacy Policy

This policy explains what AttractOS collects, why, and how long we keep it. We keep as little as we can to run the service.

What we collect

• The domain and search intents you submit. These are the inputs to your scan.
• Your email address. Used only to send your report link and, if you ask, monitoring updates. We don't sell it or send marketing you didn't request.
• A hashed form of your IP address for rate-limiting and abuse prevention. We store a salted SHA-256 hash, not the raw IP.
• Public web content we fetch during the scan — your homepage and pages the assistants cite — and the raw responses from the assistant-search APIs we sample.

How long we keep it (retention)

• Raw fetched web content: 7 days.
• Raw model / assistant API responses: 90 days.
• Free reports: 30 days, then the link expires.
• Paid (deep audit) reports: 12 months, then the link expires.

Report links are unguessable, single-purpose tokens. Report pages are served no-store and noindex, are never sent as referrers, and are excluded from our own analytics. You can request a fresh link (which rotates the token and kills the old one) or ask us to delete your data early.

Payments

Deep-audit payments are processed by Stripe. We never see or store your full card details — Stripe handles that. We store the payment's session id and amount to fulfill and support your order.

Analytics and third parties

On our marketing pages we use privacy-respecting product analytics (self-hosted PostHog) and Google Analytics to understand traffic. Your report and status pages are excluded from analytics. Email is sent via our provider (Maileroo). We don't share your data with advertisers.

Your choices

To access, correct, or delete your data, or to get a fresh report link, email support@attractos.com. We'll verify you control the email on file before acting.