Privacy Notice

for geo-tool.com and the GEO Tool application · Date: 26 August 2026 · Version 1.2

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is track by track GmbH, Schliemannstraße 23, 10437 Berlin, Deutschland.

Email: datenschutz@geo-tool.com · Telephone: +49 30 21923869. Managing director: Tobias Sander. Register court: Amtsgericht Berlin-Charlottenburg, HRB 129805 B. VAT ID: DE814954842.

2. Data protection officer

We have currently not appointed a data protection officer because, according to our current assessment, the statutory requirements are not met. If this changes, this Privacy Notice will be updated. You can contact us regarding privacy matters at datenschutz@geo-tool.com.

3. General principles

We process personal data only to the extent necessary to provide the website, application, contract performance, security, communication, billing, analytics services or to comply with legal obligations, or where consent has been given.

Legal bases include Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract or pre-contractual measures), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests).

We delete personal data once the respective purpose ceases to apply and no statutory retention duties, evidence interests or legitimate security interests prevent deletion.

4. Website provision and server log files

When you access our website, technically necessary information is processed, including IP address, date and time of access, requested page/file, data volume, referrer URL, browser type and version, operating system and technical status messages.

The purposes are technical delivery, stability, error analysis, abuse prevention and security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and functional provision of the website and application.

Hosting and infrastructure may be provided through service providers such as Vercel, Hetzner and Neon. The actual production stack is documented in section 14 and, where applicable, in the DPA.

5. Cookies, local storage and consent management

We use technically necessary cookies and similar technologies required for website operation, login functions, security, session management or functions explicitly requested by the user. The legal basis for storing or accessing information on the device is Section 25(2) no. 2 TDDDG; subsequent processing of personal data is based on Article 6(1)(f) GDPR or Article 6(1)(b) GDPR.

Non-essential cookies, tracking, marketing or analytics technologies are used only with consent where consent is legally required. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent may be withdrawn at any time with future effect.

For campaign attribution, UTM parameters or comparable URL parameters may be stored in the browser's session storage and generally deleted when the browser tab is closed.

6. Contact, demos, free GEO analysis and report delivery

If you contact us by form, email, telephone, calendar booking or via a free GEO analysis, we process the data you provide, including name, email address, company, role, telephone number, message, domain, brand, search terms, prompts, report data and technical metadata.

The purposes are handling the request, performing the requested analysis, sending the report, preparing and following up meetings, abuse prevention and documentation. Legal bases are Article 6(1)(b) GDPR for pre-contractual or contract-related requests and Article 6(1)(f) GDPR for other communication and legitimate internal follow-up.

We may display request or lead data internally in communication and coordination tools such as Slack where required for fast handling. We limit content to what is necessary.

Promotional newsletters or marketing emails are sent only where consent exists or where a statutory existing-customer rule applies. You can object to promotional communications at any time.

7. GEO analysis, AI models, search services and external APIs

The core function of GEO Tool is to analyse how websites, brands, products or content appear in generative AI systems, AI-supported search services, answer engines and search results. Required inputs such as domains, brands, search terms, prompts, URLs and technical analysis parameters are transmitted to suitable interfaces and service providers.

Please do not enter special categories of personal data under Article 9 GDPR, confidential personal content, credentials, payment data or sensitive confidential information into analysis fields unless expressly agreed and safeguarded.

Depending on configuration, services such as OpenRouter for model routing, DataForSEO for SERP and AI answer data and additional AI or search providers may be used. Model routing may involve further model providers depending on the selected model. For personal Customer data, only approved models, appropriate safeguards and, where available, no-training/zero-retention settings should be used.

The legal basis is Article 6(1)(b) GDPR where processing is necessary for the requested analysis or contract performance, and Article 6(1)(f) GDPR for our legitimate interest in providing, improving, securing and quality-assuring the core functionality. Where consent is required, processing is based on Article 6(1)(a) GDPR.

8. User account, contract processing and billing

For paid functions, we process account, contract and usage data, including name, business contact details, company, login and authentication data, roles/permissions, plan, bookings, invoice data, usage scope, support requests and technical logs.

Purposes are contract performance, user management, access control, billing, support, security, abuse prevention and evidence. Legal bases are Article 6(1)(b) GDPR, Article 6(1)(c) GDPR for statutory retention duties, and Article 6(1)(f) GDPR for security and abuse prevention.

Payments may be processed through payment providers such as Stripe. Payment card data is generally processed directly by the payment provider and not stored by us permanently. Depending on the processing, Stripe may also act as an independent controller.

9. Google user data (Search Console and Analytics)

You may optionally connect your own Google account to GEO Tool in order to analyse performance data for your own website from Google Search Console and Google Analytics 4 inside your workspace. The connection is voluntary; every other feature works without it. Access is granted through Google's OAuth flow — your Google password is never transmitted to us.

We request read-only access under the following scopes and nothing else:

• https://www.googleapis.com/auth/webmasters.readonly — performance data for the Search Console properties you have verified, in particular search queries, impressions, clicks, positions and URLs;
• https://www.googleapis.com/auth/analytics.readonly — reporting data for the Google Analytics 4 properties you make available, in particular aggregated session and traffic metrics.

We request no write permissions and do not access Gmail, contacts, Google Drive or any other content of your Google account.

We process this data for one purpose only: to display evaluations of your search and AI visibility to you, inside your own GEO Tool workspace — for example real search queries, their development over time, and recommendations derived from them. We do not use this data for advertising, for creditworthiness assessments, or for selling or otherwise trading data.

The legal basis is Article 6(1)(b) GDPR (performance of a contract). Connecting your Google account is a contractual feature that you actively initiate, and the processing is necessary to provide exactly that feature to you. Google's own consent screen governs your authorisation towards Google and is unaffected by this.

Storage and security: The refresh token required to retrieve the data is stored encrypted with AES-256-GCM in our database operated by Neon in Frankfurt, Germany (AWS region eu-central-1, EU). Short-lived access tokens are used transiently for each retrieval and are not stored. Imported performance data — as a rule the most recent 90 days — is associated with your workspace and likewise stored in the EU. Application processing runs in the Vercel region Frankfurt (fra1).

Retention: We keep the tokens and the imported data for as long as the connection exists. If you disconnect the integration in your workspace, we delete the stored token and the imported Google data within 7 days. If you delete your account, tokens and imported data are deleted immediately together with the workspace. Residual copies in backups are overwritten after no more than 30 days.

Disclosure: We do not pass Google user data on to third parties and do not sell it. We use sub-processors only where required to operate the service — currently Vercel (hosting and compute, Frankfurt region) and Neon (database, Frankfurt) — in each case under data processing agreements pursuant to Article 28 GDPR. Google user data is not transferred to analytics providers or advertising services. There is one exception, and only you can trigger it: if you explicitly adopt a search query from your Search Console as a measurement question for the AI visibility measurement, the text of that query is sent to the AI systems being measured as part of the measurement you requested — impression, click and other metrics are never transmitted.

Limited Use: GEO Tool's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

AI and model training: We do not use Google user data to develop, train or improve general-purpose AI or machine-learning models. Outside the measurement you explicitly trigger as described above, we do not transmit it to generative AI models either.

Revoking access: You can end our access at any time — in GEO Tool via "Disconnect Google" in your workspace (available even without an active paid plan), and independently of that in your Google account at https://myaccount.google.com/permissions. Revocation does not affect the lawfulness of processing carried out before it.

For privacy requests concerning Google user data, contact datenschutz@geo-tool.com.

10. Email delivery and system messages

We may use email service providers for transactional emails, reports, login, security, product and service messages. Processed data includes email address, name, email content, delivery status and technical delivery metadata. Legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

11. Web analytics

Where we use audience measurement, we primarily use privacy-friendly tools such as Plausible Analytics, where possible without cookies and without personal profiling. The legal basis is Article 6(1)(f) GDPR where the specific configuration does not require consent. Consent-based analytics or marketing services are used only after consent.

12. Retention periods

13. Recipients and categories of recipients

We disclose personal data only where necessary for providing the website, application, analysis, communication, billing, security, legal enforcement or statutory obligations.

Recipients may include hosting, database, security, AI/LLM, search data, proxy, email, payment, analytics, CRM, communication, legal, tax and IT service providers. Where they process personal data on our behalf, we conclude data processing agreements.

14. Service providers and third-country aspects

The following overview must be verified against the actual production stack and kept up to date. It does not replace the detailed subprocessor list in the DPA where processing on behalf of Customers occurs.

15. International data transfers

Personal data may be transferred to countries outside the EU/EEA, especially when using US-based hosting, AI, search, communication, payment or email services. Where no adequacy decision exists, transfers are based on appropriate safeguards under Article 46 GDPR, in particular EU Standard Contractual Clauses supplemented by technical and organisational measures. The EU-U.S. Data Privacy Framework may additionally be used for certified US providers.

We provide copies or information about relevant safeguards upon request where no confidentiality or security interests prevent this.

16. No automated individual decision-making

We do not make automated decisions within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you. GEO reports, scores and recommendations are analysis and decision-support tools and require human review.

17. Your rights

Subject to statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR), and withdrawal of consent with future effect (Article 7(3) GDPR).

To exercise your rights, contact datenschutz@geo-tool.com.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.

19. Updates

This Privacy Notice is effective as of 26 August 2026. It may need to be updated as our website, application, service providers, legal requirements or authority guidance develop. The current version is available at geo-tool.com/de/datenschutz.

track by track GmbH · Schliemannstraße 23, 10437 Berlin, Deutschland · datenschutz@geo-tool.com