Legal
Privacy Policy
Last updated 5 September 2026 · Privacy · Terms
Stareo watches how search engines and AI assistants see your website, then helps you fix what they find. To do that it needs some of your data. This page explains, in plain English, what we collect, why, who else touches it, and what you can do about it.
1. Who we are
Stareo (stareo.ai) is operated by Vortex Ventures Group(“Stareo”, “we”, “us”). We are the data controller for the personal information described in this policy. You can reach us at privacy@stareo.ai.
2. What we collect
Information you give us
- Account details: your name, email address and password (stored only as a secure hash), and the organisation you belong to.
- Workspace details: the website domain you add, your brand name, competitors you list, and the questions (prompts) you ask us to test against AI engines.
- Billing details: handled by Stripe. We store your plan and Stripe customer ID; we never see or store full card numbers.
- Support messages: anything you send us by email.
Information we collect about your website
- Crawl data: the public pages of the domain you add, their text, titles, links and structured data. We only crawl what any visitor could see.
- Audit results: the issues we find on those pages and the fixes we propose.
- Keyword rankings and search volatility: obtained from third-party SEO data providers.
Information from Google, only if you connect it
If you choose to connect Google, we ask for read-only access to Google Search Console and Google Analytics 4 for the properties you pick. We then pull:
- Search Console: queries, pages, clicks, impressions and average position.
- Analytics: sessions, engagement and traffic-source data per page, including visits that arrive from AI assistants.
- The email address of the Google account you connected, so you can see which account is linked.
We store an encrypted refresh token so we can keep pulling this data on your behalf. We never write to, publish to, or change anything in your Google account. You can disconnect at any time from the Integrations page, which deletes the token.
Information from AI engines
We send your test questions to AI engines (such as ChatGPT, Claude, Gemini, Perplexity, Grok, Copilot and Google AI Mode) and store their answers so we can measure whether your brand is mentioned or cited. These questions are about your market, not about you as a person.
Information we collect automatically
- Usage analytics: which pages of Stareo you visit and which features you use, via PostHog, so we can improve the product.
- Error reports: technical details of crashes, via Sentry.
- Cookies: a session cookie that keeps you signed in and an analytics cookie. We do not use advertising cookies.
3. Why we use it
- To run the service: crawl your site, find issues, propose and (with your approval) apply fixes, and measure results.
- To show you how AI engines and Google see your site.
- To bill you and keep your account secure.
- To email you about your account, your checks, and problems that need your attention. You can turn off non-essential alerts in Settings.
- To improve Stareo, using aggregated, de-identified usage data.
We do not sell personal information, and we do not use your data to train AI models.
4. Google user data: Limited Use disclosure
Stareo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In practice this means:
- We only use Google data to provide and improve the Stareo features you can see: traffic and ranking reports, issue prioritisation, and measuring the effect of fixes.
- We do not transfer Google data to anyone except the infrastructure providers listed below that we need to run the service, or when required by law.
- We do not use Google data for advertising, and we do not sell it.
- No human at Stareo reads your Google data unless you ask us to (for example, for support), it is needed for security, or the law requires it.
- We do not use Google data to build or train generalised AI or machine-learning models.
5. Who else touches your data
We use a small number of providers to run Stareo. Each only receives what it needs for its job and is bound by its own privacy terms.
| Provider | What for |
|---|---|
| Supabase | Database, authentication and file storage (hosted on AWS) |
| Vercel | Hosting the Stareo website and app |
| Trigger.dev | Running background jobs such as crawls and checks |
| Firecrawl, Scrapfly | Fetching the public pages of your website |
| OpenAI, Anthropic, Google, Perplexity, xAI, Microsoft | AI engines we query with your test questions and use to draft fixes |
| OpenRouter | Routing some AI requests |
| DataForSEO | Keyword ranking and search data |
| Stripe | Payments |
| Resend | Sending email |
| PostHog, Sentry | Product analytics and error reporting |
| GitHub, WordPress, your CMS | Only if you connect them, to apply fixes you approve |
Most of these providers are in the United States. By using Stareo you agree to your data being processed there.
6. How long we keep it
- Account and workspace data: while your account is active, then deleted within 30 days of you closing it.
- Google tokens: until you disconnect Google or close your account, whichever is first.
- Crawl data, audit results and AI answers: while the workspace exists. Older raw AI answers may be trimmed after 12 months; the summary metrics stay.
- Billing records: 7 years, as required by tax law.
- Backups: up to 30 days after deletion.
7. How we protect it
All traffic is encrypted in transit (HTTPS). Data is encrypted at rest by our hosting providers. Google refresh tokens and any site credentials you give us are additionally encrypted with a key held outside the database. Access inside Stareo is restricted by organisation membership and role. No system is perfectly secure; if we discover a breach that affects you, we will tell you promptly.
8. Your choices and rights
- See and export: you can export your issues and data from the app, or ask us for a copy.
- Correct: update your details in Settings, or ask us.
- Disconnect Google: Integrations page, one click. This deletes the stored token immediately.
- Delete: close your account in Settings or email us. We delete personal data within 30 days.
- Emails: turn off alert emails in Settings. We will still send essential account emails.
Vortex Ventures Group is based in the Philippines and handles personal information in line with the Philippine Data Privacy Act of 2012. If you are in Australia, you also have rights under the Privacy Act 1988 and the Australian Privacy Principles, including the right to complain to the Office of the Australian Information Commissioner. If you are in the UK or EU, you have the rights set out in the GDPR, including access, correction, erasure, portability and objection, and the right to complain to your local supervisory authority. To exercise any of these, email privacy@stareo.ai.
9. Children
Stareo is a business tool and is not intended for anyone under 18.
10. Changes
If we change this policy in a way that matters, we will email account owners and update the date at the top. Continued use after the change means you accept it.
11. Contact
Vortex Ventures Group · privacy@stareo.ai