Privacy Policy

Last updated: October 2026

1. Who we are

AEO NIUEXA is provided by Niuexa, the data controller for the personal data described here. For any privacy question or request, contact support@niuexa.ai.

2. Information We Collect

• Account information: your email address, name and optional company name, and your password, which we store only as a bcrypt hash.
• What you analyze: the URLs you submit, the public page content we fetch to analyze them (text, HTML, screenshots and performance data), scores, recommendations and reports.
• AI Visibility: the brands, competitors and prompts you track, the answers AI engines return for them, the sources they cite, and any briefs, articles and social posts you generate.
• Chat: the questions you ask the AI assistant about a report.
• Credits and payments: your credit balance and every credit transaction; for each purchase, the package, amount, PayPal order and capture IDs, the payer email PayPal returns, the IP address the order was placed from, and when you agreed to immediate delivery of the credits. PayPal handles your card or bank details; we never see them.
• Technical data: IP address, browser type and access times, used for security, rate limiting and server logs. API keys and OAuth tokens are stored only as hashes.
• Connected AI assistants: when you connect AEO NIUEXA to ChatGPT, Claude or another MCP client, we receive only the requests that assistant sends to our tools (for example a URL to scan or a brand to look up), which we handle like the same request made on our website. We do not receive your conversation with the assistant; its provider handles that under its own privacy policy. You can disconnect an assistant at any time under Profile → Connected apps.

3. How We Use Your Information and Why

• To provide the Service you signed up for (contract): running analyses and AI Visibility checks, generating content, processing credit purchases and sending service emails such as password resets and receipts.
• To keep the Service secure and working (legitimate interest): preventing abuse and fraud, rate limiting, handling refunds and payment disputes, and fixing errors.
• Anything optional (consent): where we ask for your consent, you can withdraw it at any time.

4. Data Storage and Security

Your data is stored on secure servers with encrypted connections (SSL/TLS). Passwords are hashed using bcrypt. Password reset tokens, API keys and OAuth tokens are stored as SHA-256 hashes. We use session-based authentication with secure, HTTP-only cookies.

5. Data Sharing and Subprocessors

We do not sell your personal information. We share data only with the providers that run parts of the Service for us, and only what each one needs:

• OpenAI — content scoring, recommendations, the AI assistant, content generation, and ChatGPT answers for AI Visibility checks.
• Anthropic — Claude answers for AI Visibility checks.
• Google — Gemini answers for AI Visibility checks, PageSpeed Insights for performance scores, and Google Fonts, which your browser loads on our pages.
• Perplexity — Perplexity answers for AI Visibility checks.
• Serper — Google search and AI Overview results for AI Visibility checks.
• Firecrawl — fetching and mapping the pages you ask us to analyze.
• PayPal — processing credit purchases.
• Resend — sending account and payment emails.
• Render — hosting the application and its database in the United States.
• Cloudflare — network delivery and protection, and the bot check on sign-up when it is enabled.
• Content delivery networks — jsDelivr and unpkg (script libraries), Plotly (charts) and Fontshare (fonts), which your browser loads directly on some pages.

We may also share data where needed to protect our rights, for example to prevent fraud.

6. Transfers Outside the EU

Most of these providers are based in, or process data in, the United States, and the Service itself is hosted there. Data you give us is therefore transferred to the United States. We rely on the safeguards these providers offer under the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

7. Auto-Fix and Your Website Visitors

When you install the Auto-Fix script on your website, it reports which fixes it applied, on which page path, as daily counts. Query strings, fragments and browser details are not stored. For this visitor data you are the controller and we act as your processor, under the Auto-Fix terms in our Terms of Service. You are responsible for telling your visitors about it in your own privacy notice.

8. Data Retention

• Account data is kept while your account is open.
• Analyses: scores, recommendations and reports are kept while your account is open. The raw page data behind them (fetched content, detailed check output and PageSpeed data) is kept only for the 3 most recent analyses of each page.
• Auto-Fix: visitor reports are kept as daily counts. Older per-visit records are deleted after 90 days.
• Usage limits: we keep daily counts of how often you use features that have a daily limit.
• AI assistant: chat conversations are held in memory and expire after 4 hours.
• Password reset links expire after 1 hour.
• Payment orders and credit transactions are kept after you delete your account, linked to the anonymized account.

9. Your Rights

Under the GDPR you have the right to access your data, to have it rectified, to erasure, to restrict or object to its processing, and to data portability. Where processing is based on consent, you can withdraw it at any time.

• You can update your profile at any time in Account settings.
• You can export your data, or delete your account, yourself in Account settings. Deleting your account removes your sites, analyses, AI Visibility data and chats and anonymizes your account; payment records are kept as described above.
• For any other request, contact support@niuexa.ai.
• You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

10. Cookies

We use only essential cookies: a session cookie that keeps you signed in (it expires after 4 hours), an optional "remember me" cookie (30 days) and a security token that protects forms. We do not use advertising or third-party tracking cookies. The fonts and libraries listed in section 5 are loaded from their providers, which receive your IP address when your browser requests them.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or a notice on the Service.

12. Contact

For privacy-related inquiries, contact us at support@niuexa.ai.