Legal · last updated 27 August 2026
Privacy policy
This describes what BrandGauge collects, who else processes it, how long it is kept and how to have it removed. It covers the BrandGauge website and web application only.
Who is responsible
Ritmi, LLC, a Delaware limited liability company, operates BrandGauge and decides how the data described here is used.
For anything in this policy — access, correction, deletion, or an objection — write to privacy@brandgau.ge.
What we collect
Most of it is what you type in. The rest is what the measurement produces and what is needed to keep the service running and paid for.
| What you measure | The brand, business or domain you track, an optional location, the description of the business you enter, and the buyer questions used for the scan. |
|---|---|
| Measurement results | The answers the AI engines returned, the pages they cited, the model used, token counts, a cost estimate, latency, and whether your brand was recommended, mentioned or absent. |
| Email address | Only if you ask us to email a report or start a subscription. A scan can be run without one. |
| Session | An HttpOnly cookie holding a random token, so your report stays reachable for 30 days. The token is stored hashed. |
| Network address | Your IP address is used to apply free-scan limits and is stored only as a keyed hash. The address itself is not retained. |
| Product analytics | Page views, feature usage and masked session replays. Brand names, locations, questions, AI answers, email addresses and free-text comments are excluded by an allowlist and are never sent. |
| Feedback and requests | Any rating, reason, free-text comment, or optimisation request you submit, including the email address you give with it. |
| Proposals | If we send you a proposal page, we record when it is opened, how long each part of it is read, and whether you open your report or press a plan's payment button, so we can follow up. Neither the proposal's content nor its link is sent to analytics, and the page is never recorded in a session replay. |
| Errors | Crash and error reports, with request bodies, query strings, cookies, headers and local variables stripped before they leave the server. |
Why we use it
To run the measurement you asked for and show you the result; to keep your report reachable when you come back; to email reports and weekly updates if you asked for them; to take payment and manage a subscription; to stop abuse and stay inside a daily spending limit; to fix errors; and to understand which parts of the product are worth keeping.
We do not sell data, we do not use it for advertising, and we do not use your answers to train our own models.
What is sent to the AI engines
Running a scan sends your buyer questions to OpenAI, and on a paid plan also to Google and Perplexity. The questions are constructed so that they never contain the brand you are tracking — the engines are not told what is being measured, which is what makes the result meaningful. Matching happens afterwards, on our side, against the answer text.
Answers come back and are stored as evidence. A second, smaller model call classifies an answer only when your brand literally appears in it.
What we publish
Nothing. Your brand, your result, your questions and the answers behind them are yours alone, and no part of your measurement is published anywhere on this site.
A report becomes visible to someone else only when you share it yourself, using the link on the report. That link is signed and can be shared by you alone; it is not indexed and it is not listed anywhere.
Who else processes it
These providers process data on our behalf. Each is used for one purpose and receives only what that purpose needs.
| OpenAI | Runs the measurement, writes buyer questions, classifies answers and drafts the action plan. |
|---|---|
| Google (Gemini) | Runs the measurement on paid plans. |
| Perplexity | Runs the measurement on paid plans. |
| Stripe | Takes payment and manages subscriptions. Card details go straight to Stripe and never reach our servers; we hold only the customer and subscription identifiers. |
| PostHog | Product analytics and masked session replay, hosted in the United States. |
| Google Analytics | Aggregate traffic measurement: which channel, campaign and country a visit came from. It receives page paths only, never the brands, questions or answers on them. |
| Sentry | Error and performance monitoring, with scrubbing applied before events are sent. |
| Resend | Delivers report and notification emails. |
| Cloudflare | Turnstile bot protection on the first screen. |
Analytics, and how to turn it off
Product analytics, masked session replay and aggregate traffic measurement are on by default and start when you first open the site. We are telling you plainly rather than burying it: this is not prior consent, and if you would rather not be measured, turn it off.
Email privacy@brandgau.ge and we will switch it off for your account and suppress anything not yet delivered. What is captured is limited by a strict allowlist: no brand names, locations, questions, answers, email addresses or comment text ever reach it.
How long it is kept
The AI answers themselves — the full provider response, the answer text, the cited URLs and the matched spans — are deleted 12 months after the scan that produced them. The measurement survives: the percentage, the interval, the competitor ranking and the history stay, so a chart does not lose its past.
Your account, trackers and questions are kept while the account exists. Payment records are kept as long as tax and accounting rules require. Analytics events follow the retention set on our PostHog project.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to analytics, or ask us to stop processing. Write to privacy@brandgau.ge and we will act within 30 days.
Deleting your account removes your trackers, questions, scans and stored answers. Records we are legally required to keep, such as invoices, remain.
If you are in the EU or UK and think we have handled your data badly, you can complain to your national data protection authority.
Where it goes
Ritmi, LLC is registered in the United States, and the providers listed above run in the United States and elsewhere. Using BrandGauge therefore means your data is processed outside your own country.
For transfers out of the EU and UK we rely on the standard contractual clauses in our agreements with those providers.
Changes
If this policy changes in a way that affects what we do with your data, we will update the date at the top and, where the change is material and we have your address, tell you by email.