Who is responsible for the data
The controller of personal data relating to accounts and AURA GEO operation is Richards Kuslapovs, an individual in Latvia. For questions about processing and your rights, email kuslapov@gmail.com.
When an owner installs a tracker on their website or provides other people’s data to a project, they determine the purposes of that use and are responsible for informing their visitors and obtaining the necessary permissions.
What data is processed
- Account: email, name and profile image received when signing in through Google, session data and account ID. X sign-in is being configured. A password used for password sign-in is checked by Supabase Auth and is not returned to the project or MCP.
- Project: domain, business description, topics, questions, competitors, tasks, public-page audit results, drafts and published content versions.
- Observations: AI answers, source links, method, model, check time, agent reports, changed files, diffs and checks performed.
- Access and connections: selected projects, permissions, key expiry and usage, external service permissions, activity logs and connection responses.
- Enquiries: email and information you send to support.
GEO research reads public pages of the specified website, respecting robots.txt, and saves discovered headings, descriptions, questions and links. Generated questions and priorities are not observed customer queries; query volumes inside ChatGPT, Gemini and other AI services are not measured.
Why this data is needed
Account, project and selected-operation data is needed to provide the requested service: sign-in, work storage, audits, publication and displaying results. The legal basis for processing the account owner’s data for these activities is performance of a contract or steps taken at their request before entering into a contract (GDPR Article 6(1)(b)).
Security checks, abuse restrictions, access logs and handling enquiries are needed to protect the service and users; the basis is the legitimate interest in operating the service securely (Article 6(1)(f)). Where separate processing requires consent, it is requested separately and may be withdrawn. Mandatory public authority requests are handled within applicable legal requirements.
The workspace cannot be opened without sign-in data. Separate Google/Bing connections and MCP write permissions are enabled at the owner’s choice. Declining an additional connection does not block access to the public knowledge base.
Who receives data
Supabase is used for authentication, server functions and data storage; Netlify hosts the website and handles web requests. Their infrastructure receives technical data necessary to serve requests. The Manrope font loads through Google Fonts, so the browser contacts Google servers. Messages to the listed support address are delivered through Gmail (Google). Infrastructure logs are separate from AURA GEO analytics tables.
The MCP client you connect receives results from authorized tools for the selected projects. This data becomes part of your client’s and its AI provider’s processing; review their own terms and retention settings. AURA GEO does not automatically receive all your conversations in ChatGPT or other AI services.
Google Search Console and site verification are connected separately: AURA GEO can add a property, prepare a verification file, check ownership, submit a sitemap and read search data and URL status within the permissions granted. Bing is connected using a separate owner key. Credentials for these connections are stored encrypted on the server and are not returned to the workspace. You can disconnect an integration in the source settings; previously saved results remain in the project.
With IndexNow, the selected URLs and verification key are sent to a service supporting the protocol. Published pages, sitemaps and verification files are public and can be read by search engines and other visitors.
The providers used may process technical data outside the EEA. Their processing and international transfer terms are published by Supabase, Netlify and by your chosen AI client provider. For questions about a specific connection and data recipients, contact the publisher.
Tracker and technical data
The owner-installed tracker receives a sanitized page path, referral source category, time and events for selected goals. URL parameters, fragments and the full referrer address are not stored. The tracker does not use cookies, persistent visitor identifiers or fingerprinting; IP addresses are not recorded in analytics tables. A random event ID is used for deduplication.
Primary tracker events are retained for 7, 14 or 30 days — the owner chooses the period in analytics; the default retention period is 30 days. Shortening the period deletes older events for that tracker. Separate GEO page view and referral events in /answers/ are retained for 30 days. Counts refer to events, not unique people. Browser goals and server-confirmed events are displayed separately. An optional server adapter sends observations of crawler requests; a User-Agent alone does not confirm that a request belongs to a provider.
For sign-in and the return from OAuth, the browser stores session data and technical connection state. This is separate from the referral tracker. Servers and hosting process network addresses when receiving requests, even when those addresses are not recorded in analytics tables.
Agent, publication and retention
You choose projects, individual MCP permissions and autopilot rules. The agent may create a project, save results, prepare and publish content on a verified website only within its permissions. Permission to change a task’s status does not grant access to the website or repository. Permissions can be revoked in the connected agents section; removing published content requires a separate action.
An AURA GEO key is displayed only when created. The service stores its hash, permissions, allowed projects, expiry and usage time. The log contains operations and their results without the full key value. The MCP client reports its own name — check the return address and whether you trust the application.
Account data is needed while the account is in use; project materials and history are retained until the project or the relevant records are deleted. Research, previously saved answers and published versions are not automatically deleted when an individual connection is disabled. Account deletion requests are sent to support. Infrastructure providers manage technical logs and backups under their own rules; deleting a project from the working database does not mean immediate deletion of all backups or external copies of a page.
Daily research updates are enabled and disabled separately: the schedule, run dates and statuses are stored. This updates public pages and prompt keywords; it is not background polling of AI chats. AI answers are saved manually or by a connected agent with the method and check time.
Your rights and contact
Where provided for by the GDPR, you may request access to and a copy of your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest. Consent may be withdrawn without affecting the lawfulness of processing before withdrawal.
Email kuslapov@gmail.com with the subject “AURA GEO Data.” Include the account email and the nature of your request; proportionate identity verification may be required to protect the data. A response will be provided within the time limits established by applicable law. The project and associated records can be deleted in workspace settings.
You may lodge a complaint with Datu valsts inspekcija — Latvia’s data protection authority — or the competent supervisory authority where you live, work or where the alleged infringement occurred.
The current version’s date appears at the top. Substantial changes to processing methods will be reflected on this page. Contact support