Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password.
• Payment Information: If you subscribe to a paid plan, our payment processor, Stripe, collects and processes your billing information. We do not store full credit card numbers.
• Imported Data: Backlink data, domain information, and contact lists you import from SEMrush, Ahrefs, CSV files, or other sources.
• Outreach Content: Email templates, sequences, and drafts you create within the Service.
• API Credentials: API keys for third-party services you connect (stored encrypted).
• Sightivo-Provided Inboxes: Outreach is sent from a Sightivo-provided inbox. The outreach messages you send and the replies you receive are transmitted and stored through third-party email infrastructure providers acting as our processors. We store the message content, recipient addresses, and delivery events (sends, bounces, complaints, replies) needed to run outreach, show your inbox, and enforce the sending and reputation controls described in our Terms of Service.
• Communications: Information you provide when contacting support or providing feedback.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, time spent on the Service.
• Device Information: Browser type, operating system, device identifiers, IP address.
• Cookies: We use cookies and similar technologies for authentication, preferences, and analytics.
• Session Replay: We use session replay technology (currently LogRocket) to record your interactions with the Service — such as mouse movements, clicks, scrolling, page navigation, and console and network activity — to help us diagnose issues and improve usability. Sensitive input fields, such as passwords and payment details, are masked and are not captured.
• Log Data: Server logs including access times, pages viewed, and referring URLs.

1.3 Information from Third Parties

• SEO Platforms: When you connect SEMrush or Ahrefs, we receive backlink and domain data from those services.
• Google Search Console & Google Analytics: When you connect these accounts, we receive your site's search performance and traffic data (such as queries, clicks, impressions, sessions, and landing pages) on a read-only basis. We use it to measure the results of the work you do in Sightivo — whether rankings, clicks, and traffic move after a mention or link goes live — and to inform the recommendations we surface. Our use of this data follows the Google Limited Use requirements described in Section 14.
• Data Enrichment Providers: We may receive contact information (names, email addresses, job titles, social profiles) from third-party data providers to help you identify outreach contacts.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process backlink data and identify outreach opportunities
• Enrich contact information for your outreach campaigns
• Enable you to create and manage email sequences
• Send the outreach emails you compose and approve, and receive replies to them, through the email infrastructure provider that powers Sightivo sending inboxes
• Facilitate optional data export to third-party email tools
• Measure the results of your outreach using the Google Search Console and Google Analytics data you choose to connect
• Process payments and manage subscriptions
• Send transactional emails (account confirmations, password resets, billing)
• Send product updates and marketing communications (with your consent where required)
• Respond to support requests and inquiries
• Analyze usage patterns to improve the Service
• Detect, prevent, and address security issues or fraud
• Comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: With vendors who help us provide the Service (hosting, analytics, payment processing, email delivery, data enrichment). These providers are contractually required to protect your information.
• Third-Party Integrations: When you export data to Apollo, Instantly, or other tools, that data is shared with those services subject to their privacy policies.
• Legal Requirements: When required by law, court order, or government request, or to protect our rights, safety, or property.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• With Your Consent: When you explicitly authorize us to share information.

Key service providers and subprocessors we currently rely on include:

• Cloudflare: Website and application hosting, content delivery, and database infrastructure.
• Google (Tag Manager / Analytics): Website analytics and tag management.
• LogRocket: Product analytics and session replay to help us diagnose issues and improve the Service.
• SendGrid (Twilio): Transactional and notification email delivery.
• AgentMail: Email infrastructure for Sightivo-provided sending inboxes — delivery of the outreach emails you approve, and receipt of replies to them.
• Calendly: Scheduling demo and sales calls.
• Stripe: Billing and subscription payment processing (we do not store full card numbers).
• Data Enrichment Providers: Supplying contact information used to identify outreach contacts.

This list may change as our Service evolves. We maintain a current list of subprocessors and will provide it on request at [email protected].

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. After account deletion, we will delete or anonymize your data within 90 days, except where retention is required for legal compliance, dispute resolution, or fraud prevention. Backups may retain data for up to 180 days.

5. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest
• Secure password hashing
• Encrypted storage of API credentials
• Regular security assessments
• Access controls limiting employee access to data

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Portability: Request your data in a portable format.
• Objection: Object to certain processing of your personal information.
• Withdraw Consent: Where processing is based on consent, withdraw that consent.
• Marketing Opt-Out: Unsubscribe from marketing emails using the link in any marketing message.

To exercise these rights, contact us at [email protected]. We will respond within 30 days (or as required by applicable law).

7. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and core functionality.
• Analytics Cookies: Help us understand how visitors use the Service. We use Google Tag Manager and Google Analytics for this purpose.
• Session Replay: LogRocket sets identifiers to associate recorded sessions with your account and diagnose issues.
• Preference Cookies: Remember your settings and preferences.

Some of these cookies and technologies are set by the third-party providers listed in Section 3, and their use of the information they collect is governed by their own privacy policies. You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.

8. International Data Transfers

We are based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have different data protection laws. By using the Service, you consent to such transfers. Where required, we use appropriate safeguards such as Standard Contractual Clauses for transfers from the EU/EEA.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to opt out of the "sale" of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at [email protected].

12. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

• We process your data based on: (a) contract performance (to provide the Service), (b) legitimate interests (analytics, security, improvement), or (c) consent (marketing communications).
• You have rights to access, rectify, erase, restrict processing, data portability, and object to processing.
• You may lodge a complaint with your local data protection authority.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Google User Data and Limited Use

If you connect a Google account so that Sightivo can measure your results — that is, to import your search and traffic data from Google Search Console and Google Analytics — Sightivo's access to and use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We request only the minimum scopes necessary for the features you enable — read-only access to your Google Search Console and Google Analytics data. We do not request write access to either property, and connecting a Google account does not give Sightivo any access to your Gmail or to the messages in your inbox.
• We use Google user data solely to provide and improve the features you enable — reporting on how your search performance and traffic change over time, and generating recommendations from that data.
• We do not use Google user data for advertising, and we do not sell it.
• We do not transfer Google user data to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition, and only in ways consistent with the Limited Use requirements.
• We do not allow humans to read your Google user data unless we have your affirmative consent, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized.
• We store the OAuth tokens that authorize this access in encrypted form and delete them when you disconnect the property or close your account.

You can revoke Sightivo's access at any time from your account settings or through your Google Account permissions page.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Sightivo, Inc.
1150 Clay St, Suite 1303
Oakland, CA 94612
Email: [email protected]