Privacy Notice
for geo-tool.com and the GEO Tool application · Date: 30 September 2026 · Version 1.8
| Controller | track by track GmbH, Schliemannstraße 23, 10437 Berlin, Deutschland |
| Privacy contact | datenschutz@geo-tool.com |
| Telephone | +49 30 21923869 |
| Note | This English version is a convenience translation of the German privacy notice. |
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is track by track GmbH, Schliemannstraße 23, 10437 Berlin, Deutschland.
Email: datenschutz@geo-tool.com · Telephone: +49 30 21923869. Managing director: Tobias Sander. Register court: Amtsgericht Berlin-Charlottenburg, HRB 129805 B. VAT ID: DE814954842.
2. Data protection officer
We have currently not appointed a data protection officer because, according to our current assessment, the statutory requirements are not met. If this changes, this Privacy Notice will be updated. You can contact us regarding privacy matters at datenschutz@geo-tool.com.
3. General principles
We process personal data only to the extent necessary to provide the website, application, contract performance, security, communication, billing, analytics services or to comply with legal obligations, or where consent has been given.
Legal bases include Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract or pre-contractual measures), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests).
We delete personal data once the respective purpose ceases to apply and no statutory retention duties, evidence interests or legitimate security interests prevent deletion.
4. Website provision and server log files
When you access our website, technically necessary information is processed, including IP address, date and time of access, requested page/file, data volume, referrer URL, browser type and version, operating system and technical status messages.
The purposes are technical delivery, stability, error analysis, abuse prevention and security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and functional provision of the website and application.
Hosting and infrastructure may be provided through service providers such as Vercel, Hetzner and Neon. The actual production stack is documented in section 14 and, where applicable, in the DPA.
5. Cookies, local storage and consent management
We use technically necessary cookies and similar technologies required for website operation, login functions, security, session management or functions explicitly requested by the user. The legal basis for storing or accessing information on the device is Section 25(2) no. 2 TDDDG; subsequent processing of personal data is based on Article 6(1)(f) GDPR or Article 6(1)(b) GDPR.
Non-essential cookies, tracking, marketing or analytics technologies are used only with consent where consent is legally required. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent may be withdrawn at any time with future effect.
For campaign attribution, UTM parameters or comparable URL parameters may be stored in the browser's session storage and generally deleted when the browser tab is closed.
6. Contact, demos, free GEO analysis and report delivery
If you contact us by form, email, telephone, calendar booking or via a free GEO analysis, we process the data you provide, including name, email address, company, role, telephone number, message, domain, brand, search terms, prompts, report data and technical metadata.
The purposes are handling the request, performing the requested analysis, sending the report, preparing and following up meetings, abuse prevention and documentation. Legal bases are Article 6(1)(b) GDPR for pre-contractual or contract-related requests and Article 6(1)(f) GDPR for other communication and legitimate internal follow-up.
We may display request or lead data internally in communication and coordination tools such as Slack where required for fast handling. We limit content to what is necessary.
Promotional newsletters or marketing emails are sent only where consent exists or where a statutory existing-customer rule applies. You can object to promotional communications at any time.
**Waitlist.** If you join a waitlist (for example for the closed beta or for new CMS integrations), we process your email address, the language of the page and the time of sign-up. You may optionally tell us which system your website runs on, the size of your company and your role. We use this information solely to invite you when the respective offering launches and to decide which integrations we build first. The legal basis is your consent under Art. 6(1)(a) GDPR. Sign-up uses a double opt-in procedure: after submitting, you receive an email with a confirmation link; the sign-up only takes effect once you confirm. As proof of consent we store the times of sign-up and confirmation. If you do not confirm, we delete the entry 14 days after the last confirmation email. You can withdraw your consent at any time with effect for the future, for example by replying to our email or via the contact details in section 1. We delete the data after you withdraw consent, and at the latest twelve months after the invitation. Entries that never received an invitation are deleted at the latest 24 months after sign-up. We are notified internally about confirmed entries (see above); the confirmation email and the invitation are sent via our email service provider (section 14).
7. GEO analysis, AI models, search services and external APIs
The core function of GEO Tool is to analyse how websites, brands, products or content appear in generative AI systems, AI-supported search services, answer engines and search results. Required inputs such as domains, brands, search terms, prompts, URLs and technical analysis parameters are transmitted to suitable interfaces and service providers.
Please do not enter special categories of personal data under Article 9 GDPR, confidential personal content, credentials, payment data or sensitive confidential information into analysis fields unless expressly agreed and safeguarded.
Depending on configuration, services such as OpenRouter for model routing, a specialised provider of search and AI answer data and additional AI or search providers may be used. Via OpenRouter we only use models from Anthropic, OpenAI, Google and xAI (Grok, each USA) and open models of the Qwen (Alibaba), DeepSeek and GLM (Z.ai) families. The open models do not run at their developers but at independent hosting providers that OpenRouter selects per request. Every request to OpenRouter is sent with the routing setting "data_collection: deny": only provider endpoints that neither store inputs nor use them for training are used (zero retention). Hosting providers based in China and the developers' own APIs from China are technically excluded on every request.
For automated assessments we additionally use a specialised decision model of an AI provider based in the USA. It does not generate text; it answers narrowly defined check questions. For this we transmit: (a) the wording of measured AI answers together with your brand or company name, to double-check the detected brand mention, (b) individual sentences of a draft, to flag sweeping claims and own commitments, and (c) the domain, public page title and URL paths of websites that AI systems cite as sources, to classify the kind of source. Account, contact and payment data are not transmitted.
The legal basis is Article 6(1)(b) GDPR where processing is necessary for the requested analysis or contract performance, and Article 6(1)(f) GDPR for our legitimate interest in providing, improving, securing and quality-assuring the core functionality. Where consent is required, processing is based on Article 6(1)(a) GDPR.
8. User account, contract processing and billing
For paid functions, we process account, contract and usage data, including name, business contact details, company, login and authentication data, roles/permissions, plan, bookings, invoice data, usage scope, support requests and technical logs.
Purposes are contract performance, user management, access control, billing, support, security, abuse prevention and evidence. Legal bases are Article 6(1)(b) GDPR, Article 6(1)(c) GDPR for statutory retention duties, and Article 6(1)(f) GDPR for security and abuse prevention.
Payments may be processed through payment providers such as Stripe. Payment card data is generally processed directly by the payment provider and not stored by us permanently. Depending on the processing, Stripe may also act as an independent controller.
9. Google user data (Search Console and Analytics)
You may optionally connect your own Google account to GEO Tool in order to analyse performance data for your own website from Google Search Console and Google Analytics 4 inside your workspace. The connection is voluntary; every other feature works without it. Access is granted through Google's OAuth flow - your Google password is never transmitted to us.
We request read-only access under the following scopes and nothing else:
- https://www.googleapis.com/auth/webmasters.readonly - performance data for the Search Console properties you have verified, in particular search queries, impressions, clicks, positions and URLs;
- https://www.googleapis.com/auth/analytics.readonly - reporting data for the Google Analytics 4 properties you make available, in particular aggregated session and traffic metrics.
We request no write permissions and do not access Gmail, contacts, Google Drive or any other content of your Google account.
We process this data for one purpose only: to display evaluations of your search and AI visibility to you, inside your own GEO Tool workspace - for example real search queries, their development over time, and recommendations derived from them. We do not use this data for advertising, for creditworthiness assessments, or for selling or otherwise trading data.
The legal basis is Article 6(1)(b) GDPR (performance of a contract). Connecting your Google account is a contractual feature that you actively initiate, and the processing is necessary to provide exactly that feature to you. Google's own consent screen governs your authorisation towards Google and is unaffected by this.
Storage and security: The refresh token required to retrieve the data is stored encrypted with AES-256-GCM in our database operated by Neon in Frankfurt, Germany (AWS region eu-central-1, EU). Short-lived access tokens are used transiently for each retrieval and are not stored. Imported performance data - as a rule the most recent 90 days - is associated with your workspace and likewise stored in the EU. Application processing runs in the Vercel region Frankfurt (fra1).
Retention: We keep the tokens and the imported data for as long as the connection exists. If you disconnect the integration in your workspace, we delete the stored token and the imported Google data within 7 days. If you delete your account, tokens and imported data are deleted immediately together with the workspace. Residual copies in backups are overwritten after no more than 30 days.
Disclosure: We do not pass Google user data on to third parties and do not sell it. We use sub-processors only where required to operate the service - currently Vercel (hosting and compute, Frankfurt region) and Neon (database, Frankfurt) - in each case under data processing agreements pursuant to Article 28 GDPR. Google user data is not transferred to analytics providers or advertising services. There is one exception, and only you can trigger it: if you explicitly adopt a search query from your Search Console as a measurement question for the AI visibility measurement, the text of that query is sent to the AI systems being measured as part of the measurement you requested - impression, click and other metrics are never transmitted.
Limited Use: GEO Tool's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy
AI and model training: We do not use Google user data to develop, train or improve general-purpose AI or machine-learning models. Outside the measurement you explicitly trigger as described above, we do not transmit it to generative AI models either.
Revoking access: You can end our access at any time - in GEO Tool via "Disconnect Google" in your workspace (available even without an active paid plan), and independently of that in your Google account at https://myaccount.google.com/permissions. Revocation does not affect the lawfulness of processing carried out before it.
For privacy requests concerning Google user data, contact datenschutz@geo-tool.com.
10. Email delivery and system messages
We may use email service providers for transactional emails, reports, login, security, product and service messages. Processed data includes email address, name, email content, delivery status and technical delivery metadata. Legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
11. Web analytics
Where we use audience measurement, we primarily use privacy-friendly tools such as Plausible Analytics, where possible without cookies and without personal profiling. The legal basis is Article 6(1)(f) GDPR where the specific configuration does not require consent. Consent-based analytics or marketing services are used only after consent.
12. Retention periods
| Data category | Typical retention / criteria |
|---|---|
| Server logs | Generally short-term for security and error analysis; longer retention only for security incidents or evidence interests. |
| Contact and demo requests | Until the request is completed and thereafter according to statutory limitation/evidence periods; marketing communication until objection/withdrawal. |
| Free analysis and report data | As long as necessary for report provision, follow-up, abuse prevention and product analysis; deletion/anonymisation after purpose expires. |
| Account, contract and billing data | During the contract term; thereafter according to statutory retention periods, especially commercial and tax law, usually 6 or 10 years. |
| Customer inputs and analysis results | According to plan, contract purpose, account settings and DPA; after termination deletion or anonymisation unless retention obligations apply. |
| Google user data (Search Console, Analytics) | As long as the connection exists; deletion within 7 days after disconnecting, immediately upon account deletion; backup copies overwritten after no more than 30 days (section 9). |
13. Recipients and categories of recipients
We disclose personal data only where necessary for providing the website, application, analysis, communication, billing, security, legal enforcement or statutory obligations.
Recipients may include hosting, database, security, AI/LLM, search data, proxy, email, payment, analytics, CRM, communication, legal, tax and IT service providers. Where they process personal data on our behalf, we conclude data processing agreements.
14. Service providers and third-country aspects
The following overview must be verified against the actual production stack and kept up to date. It does not replace the detailed subprocessor list in the DPA where processing on behalf of Customers occurs.
| Service / category | Purpose | Seat / processing location | Safeguards / notes |
|---|---|---|---|
| Vercel | Hosting, delivery, compute and edge infrastructure | USA / possible EU regions | Verify DPA/SCC/DPF status and concrete region per setup. |
| Neon | Postgres database, account, analysis and usage data | Project region by setup; internally indicated Frankfurt/EU | Confirm region and DPA/SCC before go-live. |
| Hetzner | Content engine, server/infrastructure | Germany/EU | Article 28 GDPR data processing agreement. |
| Provider of search and AI answer data | SERP, search and AI answer data | EU or third country as provider states | Data processing agreement; named in the subprocessor list of the DPA. |
| OpenRouter / model providers (Anthropic, OpenAI, Google, xAI; open models Qwen, DeepSeek, GLM via independent hosting providers) | Routing and querying generative AI models | USA and further countries depending on the hosting provider, not China | SCC/DPF; zero-retention routing ("data_collection: deny") and exclusion of China-based providers enforced on every request. |
| Provider of an AI decision model | Automated check questions: second check of brand mentions, fact check of draft sentences, classification of cited sources | USA | DPA/SCC, named in the subprocessor list of the DPA; transmitted are AI answer texts, draft sentences and public details of third-party websites, no account or payment data. |
| Geonode | Proxy/scraping infrastructure for website analysis | As provider states | Check DPA and scope; minimise personal data. |
| Slack | Internal notifications and coordination of requests/leads | USA/EU | Check DPA/SCC/DPF status; data minimisation. |
| Plausible | Audience measurement | EU, including Germany/Estonia as provider states | Prefer cookie-free, privacy-friendly configuration. |
| Stripe | Payment processing | EU/USA | Processing under Stripe documentation; role depends on processing. |
| Email service provider (Resend, Inc., USA - EU sending region) | Reports, system and service emails | USA / EU | EU Standard Contractual Clauses |
| Google (Search Console & Analytics APIs) | Retrieval of performance data from the user's Google account at the user's initiative | USA | Access only with user-granted OAuth authorisation (read-only); Limited Use; details in section 9. |
15. International data transfers
Personal data may be transferred to countries outside the EU/EEA, especially when using US-based hosting, AI, search, communication, payment or email services. Where no adequacy decision exists, transfers are based on appropriate safeguards under Article 46 GDPR, in particular EU Standard Contractual Clauses supplemented by technical and organisational measures. The EU-U.S. Data Privacy Framework may additionally be used for certified US providers.
We provide copies or information about relevant safeguards upon request where no confidentiality or security interests prevent this.
16. No automated individual decision-making
We do not make automated decisions within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you. GEO reports, scores and recommendations are analysis and decision-support tools and require human review.
17. Your rights
Subject to statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR), and withdrawal of consent with future effect (Article 7(3) GDPR).
To exercise your rights, contact datenschutz@geo-tool.com.
18. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
19. Embedded videos and podcasts (YouTube, Spotify)
On podcast, press and blog pages we embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and the podcast player from Spotify (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden). We use a two-click solution: when the page loads, only a preview image is shown. For YouTube videos this preview image is loaded from the image service i.ytimg.com (Google); your IP address is transmitted to Google in the process, but no cookies are set and no playback data is collected. The legal basis is our legitimate interest in presenting the content comprehensibly, Article 6(1)(f) GDPR. The player itself, and with it the connection to the video or audio servers of YouTube or Spotify, is established only when you actively start it by clicking "Video laden" or "Player laden". YouTube videos are loaded in privacy-enhanced mode via youtube-nocookie.com.
By clicking, you consent to the transfer of your IP address, device and browser information and playback usage data to the respective provider, and to the provider placing cookies or comparable technologies on your device. If you are logged in to Google or Spotify, the provider may link the playback to your account. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG; the consent applies to the respective playback and ends when you close the page. The providers may transfer data to the USA; this is based on EU standard contractual clauses and, where the respective provider is certified, the EU-U.S. Data Privacy Framework (see Section 15). Details: policies.google.com/privacy and spotify.com/legal/privacy-policy.
20. Updates
This Privacy Notice is effective as of 30 September 2026. It may need to be updated as our website, application, service providers, legal requirements or authority guidance develop. The current version is available at geo-tool.com/de/datenschutz.
track by track GmbH · Schliemannstraße 23, 10437 Berlin, Deutschland · datenschutz@geo-tool.com