Skip to main content
Tasadr
العربية
Sign inTry it free

Privacy policy

Last updated: 12 November 2026

The controller of the personal data described here is the provider of Tasadr (تصدَّر), based in the European Union, reachable at support@tasadr.ai. The provider's full legal details appear on every invoice and are available on request at the same address. Because the controller is established in the European Union, the EU General Data Protection Regulation (GDPR) applies to this processing for every customer, wherever they are. Saudi Arabia's Personal Data Protection Law (PDPL) also applies to the data of people who live in the Kingdom, and this policy explains your rights under both. There is no data protection officer: a message to the address above reaches the person who decides. Most of what you enter in Tasadr is business data, such as sites, questions and results; this policy covers the personal data within it, such as your name, your email address and your phone number.

  1. 1What we collect

    We collect what the service needs in order to work, and nothing we have no use for:

    • Account data: your name, your email address and the interface language you chose; your password, held only as a hash by our authentication provider; and the times your account was created, last signed in and last active. If you sign up with Google, the name, email address and profile picture Google sends us. For every new account we also record how it signed up, and the country indicated by its IP address at sign-up.
    • When you invite someone to your account's team: the email address you enter, the role you give, who invited them and when, and a fingerprint of the invitation's link, never the link itself. We use that address to recognise the person when they join and, once invitation emails are switched on, to send them the invitation; we delete the invitation when it is accepted or revoked, or after it expires. Once a person joins, we keep the accounts they belong to, their role in each and when they joined, and we record who added or removed a member or changed their role. Every member of an account sees its data and the name, email address, role and last activity of its other members; a member's place in an account is deleted when they leave or are removed, or when either account is deleted.
    • What you enter: the sites you track and their domains, the country, language and dialect of each, an optional description, the competitors you watch, and the questions you add or accept from our suggestions. Your business information, if you enter it: name, address, city, phone number, WhatsApp number, opening hours, services and their prices, profile links and logo; for each of its other branches, its name, city, address, phone and WhatsApp numbers and opening hours; its email addresses; and the year it was founded. If you enter the value of one customer to your business, we keep it with your business information, in the currency you entered it in, and use it only to show it beside the opportunity value, for comparison. For Business clients, the agency name and logo shown on reports. When you add a site, our reader, TasadrBot, following what your site's robots.txt allows, reads its home page to check that it is a working site that does not send its visitors to another, and, to fill in what you would otherwise type yourself, its contact and about pages when the home page links to them. From what these pages state, or from what Google's results show of your site when we cannot read them, a language model writes a one-line description of your site, and we fill in the empty fields of your business information, such as its name, phone and WhatsApp numbers, address, city, opening hours and logo, for you to review and change; a field you have filled in is never replaced. We keep that description and the business information found with the site, and delete them with it, and nothing else of what it read; with the site we keep when you confirmed it is your site or a client's you work for.
    • When you prove you own a site: the verification token for your account and that site, the way you chose to prove it and when, and a record of the checks and their results. If your account's confirmed email address is on the site's own domain, we count that as proof you own it. We use them to protect your site from being taken by another account in the free trial, and no account sees anything of another's data. They stay while your account does; failed checks are deleted after 90 days, and the proof's record outlives the account as section 7 explains. We check the proof again the same way from time to time; if it cannot be confirmed, it lapses, and any account may then prove it owns the site.
    • What measurement produces: for each question and each engine, whether your site was mentioned or cited, the passage of the answer around the mention, the domains and links the engine cited instead and their rank, the scores and history computed from all of it, and the questions we find your competitors lead. For each question, a short search keyword we write from its text, which you can change, and the monthly Google searches and cost per click Google Ads reports for that keyword in your site's market, from which we estimate the value of the questions you do not lead. For each question you track, its buying stage (learning about the topic, comparing options, or ready to choose or buy), which a language model reads from the question's text and which you can change; the model never overwrites your choice. What we draw from the engines' answers about your site and about your questions.
    • For the “Shopping Answers” and “AI Ads Monitor” pages: the products, stores, prices, ratings and ads that the AI engines' answers and Google's results show for the buying questions of your sites, the sites those answers rely on, your own public product pages, and the ads your site and the sites you follow or look up run on Google in your sites' countries, with their format, dates, countries, picture and the advertiser's name as Google publishes it, to show them to you and open the right tasks in your action plan.
    • For the “Product Tracker” page: our reader, TasadrBot, reads your site's sitemaps and its home page, and your public product pages, following what your site's robots.txt allows, and we keep what each page states about its product, meaning its name, brand, model, part number, barcode, stock code, category, price, discount, currency, availability, image link, rating and number of reviews; the products you choose to follow; and your answer when we ask whether a product in an answer is yours; and we show you your products' images from your site when you open the page. We send your products' names to a language model to name each product's kind, and keep that kind with the product. We ask AI engines and Google about your products and the buying questions around them, and from their answers we keep the stores they recommend, with their prices and links, and the Google Shopping product identifiers and the words ChatGPT searched with. From Google Shopping we also keep each listed product's title, price before discount, rating and number of ratings, and, for each seller, the shipping cost, the total price, availability, the product's condition, new or used, and the store's rating and number of ratings; and from Google's results for your product's name, the sites' titles, links and positions, your page's position, and the sites the AI Overview there cites. We keep all of this to show it to you and compare your products with what the answers recommend.
    • Your alert and report settings: the alerts you choose and how far a number must move before you are told, the scheduled report you choose for each site, and, if you add one, the address of the incoming webhook you create in Slack, which we keep encrypted. With each alert sent by email or to Slack we keep the kinds of alerts it carried and a fingerprint of each that names no question and no competitor, so that an alert already sent to you is never sent again.
    • For the engines' searches and your social profiles: when we read the AI engines' answers to your questions, we keep the searches an engine shows it ran before answering, as it wrote them, with the language of each. We read the public links on your site's home page and the profile links in your business profile, and save the social profiles they point to as yours, which you can change or remove in Settings. We keep these profiles, meaning the platform, the account name and its link, to match them with the links the answers cite and to show you how often the answers cite your profiles and other accounts.
    • What comparisons and drafts produce: the competitor page and your page that were compared, their titles, the signals compared, and the summary, tasks and ready-to-publish drafts a language model wrote from them and from your business information. This includes the brief for a new page that we write for a buying question your site is not cited for, from your business information, from the copy of your page that we keep, and from the analysis of the pages cited for that question; we keep it while the site is tracked and delete it with the site.
    • Google Search Console data, only if you connect it: the email address of the Google account you connect, the properties you have verified, your site's top search queries with their impressions, clicks and average position over the last 90 days and over the last 28 days, the countries those impressions came from, your site's daily clicks, impressions and average position in Google Search over the last 12 weeks, which we add up by week, the daily clicks of your site and of its pages over the 8 weeks before and the 8 weeks after each edit we verify, your site's total clicks in each month your monthly report shows, the pages Google showed for each of your top search queries with their clicks, impressions and average position, the clicks, impressions and average position of your site's pages over the last 90 days, and whether Google has indexed your key pages and when it last crawled them; and the OAuth access and refresh tokens that let us read them.
    • Google Analytics data, only if you connect it: the email address of the Google account you connect; the names of the Google Analytics properties that account can read and, for each of up to 60 of them, the web addresses its data streams measure, which we read only to find the property that measures your site; for that property, its name, its time zone, its currency and the names of its key events; over the last 28 days and over each month your monthly report shows, your site's totals of visits, key events and sales from every source and, for the visits that started in an AI engine, their number by source and medium, how many had a key event, which key events and how many times each, and the sales recorded from them; over the last 12 weeks, day by day and added up into weeks, the number of visits that started in an AI engine, by source and medium, of visits that came from a search engine, by source, and your site's total visits from every source; over the last 4 weeks and the 4 weeks before them, for the visits from Google Search and the visits that started in an AI engine, their number by source and medium, how many were engaged visits, how many had a key event, and the sales and purchases recorded from them; over the 29 days before and the 29 days after each edit we verified, or 15 on the Business plan and 9 during the trial, the number of visits from Google Search and from AI engines that entered your site through the pages we checked for your tasks and through your home page, by page, source and medium, how many of them had a key event, the sales recorded from them, and the number of all your site's visits from Google Search and from AI engines, by source and medium; and the OAuth tokens that let us read them: the access and refresh tokens Search Console uses when the two share one connection or, when Google Analytics has a connection of its own, its own refresh token. We read totals and counts only: no data about individual visitors or their location or device, and of the pages they viewed only the page a visit entered your site through, for the pages we checked for your tasks and your home page alone. This is data from your own Google Analytics property; it has nothing to do with the Google Analytics tag on our own pages, which section 5 describes.
    • Cloudflare data, when you connect it for the site: daily aggregate counts of your site's requests and visits, of the AI crawlers that read its pages, and of visits arriving from AI engines and from Google; the Cloudflare zone, account and plan names; and the two connection tokens that let us read them. We read nothing about any individual visitor and change nothing in your Cloudflare account. We use them to show them in your dashboard, keep them for at most 90 days while the connection stands, and delete them with both tokens when you disconnect, remove the site or delete your account.
    • Billing data: your Stripe customer and subscription identifiers, the plan, the billing interval, the date the paid period ends, and the payment history. The name and billing address you enter on the payment page, and your VAT registration number if you enter one, are held by Stripe and appear on your invoice. Your card details are collected and held by Stripe and never reach our servers. If you reached us through an ad and accepted advertising cookies, we keep the ad click identifier (such as gclid or fbclid) with your subscription data at Stripe, so that we know which ad the subscription came from, and we remove it from the payment data when you delete your account.
    • Operational records: server and function logs, rate-limit counters, cookieless page statistics, the bot check that confirms at sign-up and sign-in that a person is making the request, and a log of the administrative actions our team takes on your account, such as changing a plan or extending a trial; and a short record of which dashboard pages your account opened and which tools it tried, and how many times each, so that we can help you during your trial and improve the product; we share it with no one else.
    • Advertising and analytics data, in two parts. Without cookies, on the basis of our legitimate interest (Article 6(1)(f)): the four campaign words in the link that brought you to us (utm_source, utm_medium, utm_campaign and utm_content), so that we know which of our campaigns bring accounts. The site's links carry them from page to page without storing anything on your device: they travel only in the addresses of our own site, and are kept with your account if you sign up with your email address. Google does not receive them when you sign in or sign up with Google. They never reach an ad platform, unless you accept advertising cookies: the ad tags then read the address of the page you are on, as section 5 explains, and that address may include them. They include no ad click identifier, no IP address and no browser details, and you can ask us to delete them at any time. With your consent in the cookie banner or in the sign-up form: the campaign and the ad click that brought you to us (such as utm_source, gclid, fbclid or ttclid), kept with your account when you sign up, and, if you accept advertising cookies, the IP address and browser you signed up or paid from. Section 5 has the detail.
    • Correspondence: what you send our support by email, and what we exchange with you on WhatsApp about your account.
    • When you use Market Radar, we keep the domains you look up and how many lookups you made this month, to apply your plan's allowance. We never share them with any other customer.
    • When you follow a competitor, we may read its public pages for the Tasadr Index; on your account we keep only how many of these reads your follows used in the last 30 days, to apply your plan's limit, and no other customer can see that you follow it.
    • When AI Readiness checks a site you track, our reader, TasadrBot, reads the site's public files as a search engine's crawler would, and obeys its robots.txt: robots.txt, the home page and your key pages (the pages the engines cite, those of your open tasks, then pages from your sitemap), the sitemap itself, and llms.txt if there is one. We keep what it read: your robots.txt as published, comments included; each page's address, the addresses it redirects through, its status, its robots tags and the parts of its response headers that decide indexing or name your hosting network; whether it has text before JavaScript runs, and its size. We use them to show you the result, to open its tasks and to check them. We keep the latest full check and the latest read for as long as you track the site, whether or not your plan is running, and earlier checks and reads for as long as they are needed for comparison. A reading an open task points to stays until the task is closed, and the two latest readings that hold a copy of your robots.txt stay for as long as you track the site. All of it is deleted when you remove the site or your account.
    • When Site signals checks a site you track, our crawler, TasadrBot, reads its home page, its robots.txt and sitemap, and up to nine more of its key pages, from the sitemap or from the home page's links. We search Wikidata for an item that names your site as its official website, or that carries your business's name, and a public service measures those pages on a phone. We keep the latest result of each check: the name, phone numbers, address, logo and profile links your home page and its structured data give, with part of its text (its address, footer and opening lines) in which we look for your city; the names we searched by; the facts of the Wikidata item that names your site, such as its labels, description, address, phone numbers, founding date, industry and accounts, and up to three other items that carry your business's name; each page's address and title, the structured data it carries and lacks and its errors, and the ready markup we wrote from facts found on the page or in your business information; and each page's speed measures, with what to fix first. We keep them for as long as you track the site, check again when you open the page, and delete them when you remove the site or your account.
    • When you use the rank tracker, we keep the keywords you add for each site, up to your plan's number, and every reading of each keyword on Google's results page in your site's market: when it was taken, your site's position among the first 30 results or that it was not among them, the page of your site that holds that position, whether Google showed an AI Overview there and whether it cited your site, and what the reading cost; a reading the provider failed is kept with its time and cost alone. We keep the readings for 400 days; removing a keyword deletes it with its readings, and removing the site or your account deletes them all. For link strength, we keep the domain rank and the number of linking domains of your site and of up to five of your competitors (the sites the engines cite most in your questions, and the competitors you watch), as the search results provider counts them, with the list of those competitors, in our hosting provider's cache for 30 days, and erase them when you delete your account.
    • When you open your Google Maps profile, we look your business up on Google Maps in your site's market, by the name you type, or else the one your business information, your site or its domain gives, with the city in your business information, and our crawler, TasadrBot, reads your home page and, when it links to one, your contact page. We keep up to 20 of the listings the search returns, each with its name, address, city, phone number, website, categories, rating and number of reviews, opening hours, whether its owner has claimed it and its Google Maps link; and what your pages give of your business's name, phone numbers and other numbers of a phone number's length, address, city and opening hours, and whether they carry LocalBusiness structured data; both in our hosting provider's cache, to compare them with your business information. Both are erased when you ask us to check again, remove the site or delete your account. When one of the listings is your business, we also keep its phone number, website, address, city and opening hours, to compare what AI engines say about your business with your own information, until the listing is read again or you remove the site or delete your account.
    • When "This week", your notifications and the pages the engines cite beside your competitors, in Rankings and links, check the public pages the AI engines cite in their answers to your questions, our crawler, TasadrBot, reads those pages to see whether they name your competitors or your site, and we keep the visible text of each page and the sites it links to in our hosting provider's cache for seven days at most. We send those pages nothing about you or your account.
    • In the free AI crawler check on our site, when you enter a domain we read that site's public home page, robots.txt, sitemap and llms.txt as our crawler, TasadrBot, and nothing on any other site. We keep the result, with the domain, in our hosting provider's cache and show it to anyone who checks the same site for up to six hours; after that the site is read again. To keep any site from being read too often, we count the checks of each domain, and yours by your IP address as a keyed fingerprint rather than the address itself; these counters are deleted after a day and an hour. The check needs no account, and we keep nothing else from it.

  2. 2Why we process it, and on what basis

    We process your account data, sites, questions, results and business information to provide the service and invoice it: that is performance of our contract, Article 6(1)(b) GDPR. We keep invoices and payment records because the law requires it, Article 6(1)(c). We also use the domains of the competitors you watch to choose public sites whose pages we read for the Tasadr Index, with nothing in it that links them to you or your account. That is our legitimate interest in a complete index, Article 6(1)(f). We process the address of someone you invite to your account's team to recognise them when they join: that is your legitimate interest, and ours, in letting your team work together, Article 6(1)(f).

    We process logs, usage counters, the bot check and the trial fingerprint to keep the service secure, to prevent abuse and the same trial being given twice, to fix faults and to improve the product. That is our legitimate interest, Article 6(1)(f), balanced against yours.

    We may contact you by email, or on WhatsApp at the number you entered in your business information, about your own account only: your trial, your subscription, and helping you with them. We do not send you general marketing offers on WhatsApp. You can ask us to stop at any time, by writing to support@tasadr.ai or by replying to the message, and we will.

    During your free trial we email you a short series about the trial itself: how to start, how to read your results, who is cited instead of you, your second measurement, once you prove the site is yours, and, the day before the trial ends, the plans with any offer running that day; and one email the day after it ends if you have not subscribed. We send at most one a day, and none once you subscribe. We send them on the basis of our legitimate interest in helping you use the trial you asked for, Article 6(1)(f). Each of them carries a link that stops them all in one click, with no sign-in, and your mail client's unsubscribe button does the same; you can also reply to any of them and ask us to stop. We keep a record of which of these emails we sent you, and of your request to stop them, for as long as the account exists. Stopping them does not affect the emails your account needs to work, such as address confirmations and sign-in links.

    If your account is on a paid plan, we email you your monthly report for each site you track. The email carries the month and the site, a summary of the report (your score and how it moved, the citations of your site gained and lost, the edits we verified and the competitor sites that moved up), your top three tasks for the next month with the text of the question each one concerns, and a button to the full report. We build it from the results of your own questions and your task list, and we never put in it a number we read from Google Search Console or Google Analytics. We send it from an address on our own domain, tasadr.ai, under the name Tasadr, and a reply to it reaches support@tasadr.ai. We send it on the basis of our legitimate interest in giving you the results of the measurements your subscription includes, Article 6(1)(f), and it carries no offer. Each email carries a link to a page with one button that stops it, with no sign-in, and your mail client's unsubscribe button does the same in one click; you can also reply to it and ask us to stop. We keep your request to stop it for as long as the account exists. Stopping it does not affect any other email.

    If your account is on a paid plan, you choose in Settings which alerts about your sites you receive and how far a number must move before you are told: a fall in your score, an engine that stopped citing your site, a competitor site that overtook you on your questions or gained share of the citations, a new competitor site in your place, and a question you worked on that moved ahead of the questions you did not work on. We bundle each site's alerts into one email, each with the market it concerns and the question it is about, and we send the same alerts to a Slack channel if you add the incoming webhook you create in your own Slack workspace. You also choose, for each site, the scheduled report you receive by email, or none. We build them from the results of your own questions and your task list and send them on the same basis as the report above, Article 6(1)(f), with no offer. Each email carries a link that stops it with no sign-in, as your mail client's unsubscribe button does; you can change or stop each of them in Settings, and removing the Slack address stops what we send to Slack.

    We read your Google Search Console and Google Analytics data when you connect them yourself, to provide the features of the service built on them, under Article 6(1)(b), and you can disconnect at any time. We use analytics or advertising cookies, and send the conversion reports described in section 5, only with your consent in the cookie banner or in the sign-up form. You can withdraw any consent at any time, without affecting what was lawful before.

    Under the Saudi PDPL the same processing rests on the corresponding bases: performance of our agreement with you, a legal obligation, legitimate interest, and your consent where we ask for it. We build no profiles about you, we take no automated decision that produces legal or similarly significant effects on you, we do not sell your data, and we never use what is in your account (your sites, questions and results) for advertising. We do not ask you for sensitive data, so please do not enter any in your questions or business information.

  3. 3Google Search Console and Google Analytics, and the Limited Use disclosure

    Connecting Search Console is optional, and the service measures without it. We ask for read-only access on the webmasters.readonly scope, and for your Google account's email address so we can show you which account is linked. We use what we read for 12 things and nothing else: to list the properties you have verified; to read your top search queries so we can suggest questions worth measuring and show you the query each suggestion was written around; to read which country your impressions come from, so a site is measured in the market it actually serves; to show your site's clicks and impressions in Google Search, added up by week, beside your Tasadr Score in your dashboard; to compare, in your monthly report and, page by page, in your dashboard, the clicks on the pages whose edits we verified with the clicks on your other pages over the same days; to show your site's total clicks for the month on the monthly report page and in the PDF and Excel files made from it, never in an email we send you; to show, on the monthly report page and in the PDF made from it, never in an email or an Excel file, your site's clicks and impressions in Google Search added up by week, its click-through rate and average position over the month's whole weeks, your top search queries and your site's top pages with their clicks, impressions, click-through rate and average position, and whether Google has indexed your key pages and when it last crawled them; to show your site's average position in Google Search in your dashboard; to compare your site's most-clicked search queries with the AI engines' citations of your site, in your dashboard; to show, for each of your top search queries, the page of your site Google sends its visitors to, how many other pages of yours it showed, and the measured question it matches, in your dashboard; to compare the pages of your site people reach from Google Search with the pages the AI engines cite, in your dashboard; and to read whether Google has indexed your key pages and when it last crawled them, through Google Search Console's URL Inspection, in your dashboard. These numbers and queries are not stored in our database: they are held in our hosting provider's cache, read again from Google when they age, the index state included, and erased when you disconnect Search Console or delete your account. We never write anything to your Google account. To phrase your top search queries as questions, we send up to 10 of them, with your site's market, through our AI-model routing provider to a Google Gemini model. Tasadr's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. That data is never sold, never transferred for advertising, never used to build advertising profiles, never included in any aggregated statistics we publish or show to anyone else, and never read by a person except with your consent in order to support you, for a security investigation, or where the law requires it. You can withdraw the connection at any time, inside the product or from your Google account's permissions page, and we then delete the tokens, unless you disconnect it inside the product while Google Analytics reads through the same connection, when we keep the refresh token for Google Analytics alone and read nothing from Search Console with it: suggestions from search data, the list of your verified properties, the reading of the country your impressions come from, your average position, the comparison of your most-clicked queries with the engines' citations, the pages of your top search queries, the comparison of your pages with the pages the engines cite, your key pages' index state, the clicks and impressions beside your score, each page's comparison in your dashboard, and the page comparison, the month's clicks and the other Search Console numbers in your monthly report stop, and measurement continues on the questions you have saved.

    Connecting Google Analytics is optional, and the service measures without it. We ask for read-only access on the analytics.readonly scope, and for your Google account's email address so we can show you which account is linked and tell whether it is the one linked to Search Console. You can connect Google Analytics on its own, or with a Google account other than your Search Console one; when you use the same Google account, Google adds this permission to the one you gave us for Search Console, and the two share one connection. We use what we read for 5 things and nothing else: to find which of your Google Analytics properties measures your site; to show, in your dashboard, the visits to your site over the last 28 days that started in an AI engine, those of them that had a key event, and the sales recorded from them, and, week by week over the last 12 weeks, the visits from AI engines next to the visits from search engines; to show the same numbers for the month on the monthly report page and in the PDF made from it, never in an email, an Excel file or a page you share; to show, in your dashboard, the visits to your site from Google Search and from AI engines over the last 4 weeks and the 4 weeks before them, how many of them were engaged visits, how many had a key event, and the sales and purchases recorded from them; and to compare, in your dashboard, the visits that entered your site from Google Search and from AI engines through each page whose edit we verified, over the days before and after the edit, with their key events and recorded sales, with the visits that entered through your other pages over the same days. Only you and the people you add to your account's team can see them, after signing in. We never write anything to your Google Analytics or your Google account, and apart from our hosting provider, which runs the site for us, we send nothing we read from Google Analytics to anyone, and no AI model receives any of it. These numbers are not stored in our database: they are held in our hosting provider's cache, read again from Google when they age, and erased when you disconnect Google Analytics or delete your account.

    Tasadr's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. That data is never sold, never transferred for advertising, never used to build advertising profiles, never used to train or improve any artificial-intelligence or machine-learning model, never included in any aggregated statistics we publish or show to anyone else, and never read by a person except with your consent in order to support you, for a security investigation, or where the law requires it. You can end the Google Analytics connection at any time, by disconnecting it in Settings or by removing Tasadr's permission from your Google account's permissions page, and its numbers stop showing in your dashboard and monthly report. When you disconnect it in Settings, we stop reading it immediately, erase its numbers from the cache and, when it has a connection of its own, delete its token; when it shares one with Search Console, the connection tokens stay while Search Console is connected. We do not withdraw Google Analytics' permission at Google when you disconnect it; you can remove Tasadr's permission from your Google account's permissions page. Disconnecting Search Console in Settings does not end Google Analytics: when the two share one connection, we keep the refresh token for Google Analytics alone and read nothing from Search Console with it, until you disconnect Google Analytics too. Google ends all the permissions one Google account gave us in one step, so removing the permission from your Google account's permissions page ends Google Analytics and Search Console together when both use that account, and all other connections to Tasadr made with it.

  4. 4Who processes your data for us, and where

    We share data only as far as running the service requires, with providers who process it on our instructions:

    • Our hosting provider: hosts the site and runs the serverless functions in its Dublin region, in Ireland, delivers the pages through its global network, and counts, without cookies, page views, which answer was given in the cookie banner or in the sign-up form, and the steps of starting a trial, by campaign, with no personal data.
    • Our database and sign-in provider: the database and authentication, in its Dublin region, in Ireland.
    • Our bot-check provider: checks, at sign-up, sign-in, sign-in link and password reset requests, at a request to resend the confirmation email, and at the free AI crawler check on our site, that a person is making the request, and receives your IP address and signals from your browser to do so.
    • Our AI model provider, in the United States: to run the service's features, it receives the text of your questions and your site's market; the addresses and public text of web pages, yours and other sites'; passages of the engines' answers to your questions; your site's domain and the business information you write in your account; and your search queries from Search Console, if you connect it. It never receives your name, your email address or any account identifier.
    • A search results provider: fetches Google and Bing results pages and the answers of Google AI Overviews, Google AI Mode, Copilot, ChatGPT and Gemini for your questions, and Google Shopping results for the buying questions of your sites and for your products, with the sellers that offer each product on Google Shopping, and Google's results for your products' names. It also fetches Google Ads' monthly searches and cost per click for the search keyword of each of your questions. We write the keywords from the text of your questions, never from the search queries we read from Search Console, and send it none of your Search Console numbers. For the rank tracker, it also reads where your site stands on Google's results page for each keyword you track, and, for link strength, the link figures of your site and of up to five of your competitors. When you open your Google Maps profile, it also searches Google Maps for your business by its name and city, in your site's market. It also fetches the ads your site and the sites you follow or look up run on Google in your sites' countries. When a site you add does not open for us or we cannot read it, it also fetches Google's results for its domain, so we can confirm the site exists and write a suggested description from them. From all of this it receives only the question text and the market, the search keywords of your questions, the keywords you track, your site's domain, the domains of the sites you follow or look up, your products' names and their Google Shopping identifiers, and the name and city we look your business up by; it never receives your name, your email address or any account identifier. It also receives the address of a public page of a competitor site when you ask for its analysis, together with your site's market.
    • Google: receives the Search Console and Google Analytics requests when you connect them, and confirms your identity when you sign in with Google. Its favicon service supplies the icons of the sites shown in your dashboard, and receives your IP address and those sites' domain names when your browser loads them. Its speed analysis service receives the addresses of the pages of your site that Site signals measures, ten at most.
    • Wikidata, the public database run by the Wikimedia Foundation, in the United States: when Site signals checks your site, it receives our searches for your site's domain and for up to three of your business's names, and handles them as it handles any search of its public service, under its own policies. It receives nothing that identifies you or your account.
    • Cloudflare: when you connect it, receives our read requests for your site's counts, with only the read permission you granted from your own account; we withdraw that permission when you disconnect.
    • Stripe and Link: Link, a Stripe company, sells the subscription as the merchant of record: it takes the payments, holds the card and billing details, issues the receipts and invoices, and handles the indirect tax. Link processes your payment details and your Link account as an independent controller, under its own privacy policy. Stripe also receives your account's email address, name and our account identifier.
    • Our email delivery provider: delivers our email: account emails that confirm an address, carry a sign-in link, reset a password or carry an account deletion code; the alerts about your sites and the scheduled reports described in section 2; the free trial's emails described in section 2; the monthly report email described in section 2; internal notices our team receives when an account signs up, pays or cancels; and operational alerts. We also use it to send internal alerts to our team about failed payments, refunds and bank disputes. An alert about a failed payment carries the account's email address, the amount, the plan and billing interval, the attempt number and when the next attempt is due; one about a refund or a dispute carries the account's email address, the amount, the plan, the reason Stripe gives for a dispute, whether we cancelled the subscription, and the next step. Each also carries the time and a link to the account in our admin area, and none carries your name or card details.
    • Slack, only if you add an incoming webhook: we send it the alerts you chose for your sites, with each site's domain, the questions the alerts concern and the domains of the competitor sites they name, to the channel you chose in your own Slack workspace. Slack receives them as your own provider, under your agreement with it, we send it nothing else, and removing the address in Settings stops what we send to it.
    • Google Analytics 4 and the ad platforms: as section 5 explains.
    • Our support chat provider, in the United States: runs the support chat on our site and in the dashboard, with an AI assistant that answers only from help content we approve. Nothing loads from it until you open the chat. From then on it receives what you write and any file you attach, your IP address, your browser and the page you are on. In the dashboard we also send it your account identifier, email address, name, interface language, plan and the date your account was created, signed by our server so that no one else can open the chat in your name. We do this to perform our contract with you when you are signed in, and on the basis of our legitimate interest in answering your questions when you are not. If a reply arrives after you leave, the provider may send it to your email address.
    • Our product analytics provider, in the European Union: measures how the dashboard is used and records usage sessions with every text and number masked, and runs only if you accept it in the cookie banner.

    Anyone can ask us at support@tasadr.ai for the names of the providers that process their data, and we send them. We may also disclose data where the law obliges us to, or to an entity that takes over the Tasadr business and is bound by this policy.

  5. 5Advertising and analytics, and what reaches the platforms

    We advertise to reach businesses that Tasadr can help, and we measure which of our ads bring people who create an account or subscribe. The cookies, the ad tags and the identifiers this section describes need your consent in the cookie banner or in the sign-up form: until you choose, no ad tag is loaded and nothing reaches the ad platforms, from your browser or from our server. The optional box in the sign-up form, if you tick it, gives the same consent as "Accept all" in the banner. The four campaign words described in section 1 do not need that consent: they are carried in the addresses of our own site, nothing is stored on your device to keep them, and we keep them on the basis of our legitimate interest.

    If you accept advertising cookies, the ad platforms load their tags in your browser on our public pages and the sign-in and sign-up pages, and once on the first screen after your account is created, to record the start of the trial. The platforms are Google (the Google Ads tag, through Google Ireland Limited), Meta (the Facebook and Instagram pixel, through Meta Platforms Ireland Limited) and TikTok (through TikTok Technology Limited). Our code passes neither your email address nor your name to these tags. The tags read what they ordinarily read from a browser, such as the page's address and the ad click's identifier, and may set cookies on their own domains under their own policies. If Google's "enhanced conversions" or Meta's "automatic advanced matching" is switched on in our ad accounts, the tag may read the email address you type on the sign-up page and send it hashed.

    When you create an account or start a paid subscription, our server also tells Meta (through the Conversions API) and TikTok (through the Events API): the event, its time and its identifier, the amount of a payment, the ad click identifiers, your IP address and browser, and your email address and our account identifier, hashed with SHA-256. For Meta we also send your name and country, hashed the same way. Both also receive the address of the page and the identifier their own tag set in your browser (_fbp for Meta, _ttp for TikTok), and Meta the name of the plan. The purpose is to let the platform match the event to an account of its own without our sending this data in clear. The event's identifier is the one the tag in your browser sends with the same event, so that the platform counts it once. Our server sends nothing directly to Google Ads. The platforms use what they receive to count our ads' results and to choose better whom our ads are shown to, under their own privacy policies.

    If you accept analytics cookies, Google Analytics 4 sets its cookies on our public pages and receives from our server the account creation and the payment, with our account identifier, your IP address and your browser. We may link Google Analytics to our Google Ads account to count our ads' results. If you do not accept analytics cookies, Google Analytics does not load on our pages. You can change your choice at any time from "Cookie settings" at the foot of the site's pages and in your account menu.

  6. 6Transfers outside your country

    We process your data in the European Union first: the database and the serverless functions run in Dublin, Ireland. Several of the providers in section 4 are established in the United States, so some data is transferred outside the European Economic Area. Where a provider is certified under the EU-US Data Privacy Framework we rely on that adequacy decision, and where it is not we rely on the European Commission's Standard Contractual Clauses.

    If you are in Saudi Arabia, your data is processed outside the Kingdom because the service is run from the European Union. We rely on what the PDPL and its Regulation on Personal Data Transfer outside the Kingdom allow, including a transfer needed to perform our agreement with you. We limit each transfer to the minimum data each purpose needs, and protect it with the safeguards in this policy.

  7. 7How long we keep it

    Account data, sites, questions and business information are kept for as long as the account exists. If a trial ended without a subscription and you have not signed in for 12 months, we delete the account after emailing you 30 days before. The evidence behind a measurement, meaning the answers, what we draw from them about your site, the citations, and the products and ads we read for buying questions and for your site and the sites you follow or look up, is deleted automatically 180 days after it was measured. Competitor analyses are deleted after 90 days, and discovered questions you did not adopt after 90 days, except the ones you dismissed, which are kept until the site is removed. Records of finished measurement jobs are deleted after 30 days, rate-limit counters after a day and an hour, and each account's daily and monthly usage counters after 40 days. Scores and their history are kept for as long as the site is tracked, because they are the history you compare against. The search keywords of your questions and their Google Ads figures are kept while the site is tracked, and deleted with it. Your site's products as their pages state them, with the kind we name for each, the products you follow, your answers about matching products, and what we keep from the answers and results about your products are kept while the site is tracked, and deleted with it. The searches an engine shows it ran are deleted with the reading they were kept with, and your social profiles are kept while the site is tracked, and deleted with it. Your alert and report settings and the Slack address are kept while the account exists and deleted with it, the report chosen for a site is deleted with the site, and the record of the alerts sent keeps only their kinds and fingerprints. The buying stage of each question, with the time and cost of the call that sorted it, is kept under the question's text while the site is tracked, even after the question is removed, so that a question added back keeps its stage; it is deleted with the site or your account. What we draw from the answers about your questions is kept while the site is tracked, even after a question is removed, and is deleted with the site or your account. How long we keep the readings of AI Readiness, Site signals, the rank tracker, link strength, your Google Maps profile and the free AI crawler check, and the pages the engines cite that we read, is stated with each in section 1. The Google Search Console numbers shown in your dashboard and monthly report (the weekly totals, the average position, the page clicks, the month's clicks, the top queries, the pages of the queries and the pages' index state) are held in our hosting provider's cache only while Search Console is connected, and are erased when you disconnect it or delete the account. The Google Analytics numbers shown in your dashboard and monthly report are held in our hosting provider's cache only while Google Analytics is connected, and are erased when you disconnect it or delete the account. The OAuth tokens that let us read your Google data are kept only until you disconnect what they serve (Search Console, Google Analytics, or both when they share one connection), delete the account, or Google withdraws the grant, and we then delete them. The counts we read from your Cloudflare are kept for at most 90 days, and they and the OAuth tokens that let us read them only while Cloudflare is connected for the site: they are deleted when you disconnect it, when Cloudflare withdraws the permission, or when you remove the site or delete the account.

    Deleting a site deletes its questions, scores, citations, answers and competitor analyses outright, with no way back. A record that a measurement you started this month ran (the site, the time and its cost, without the questions) is kept until it is deleted at 30 days, so that removing a site does not hand back the month's allowance. A record that a request for Google Ads figures ran (the site, its market, the time and its cost, without the keywords) is kept until it is deleted at 30 days, so that removing a site does not hand back the month's requests. A record that a site's first measurement was given (the site and its date) is kept for as long as the account exists, so that deleting and re-adding the site does not give it its first analysis twice.

    You can delete the account yourself from Settings, under Account & security: we send a code to the account's email address, and once it is entered the account is deleted at once with its sites, questions, measurements, tasks, reports, share links and Google connection, any live paid subscription having been cancelled first so nothing more is charged. Support can still delete it for you on request at support@tasadr.ai.

    Only what has a reason outlives the deletion: invoices and payments, at Stripe and with us, for 10 years as the applicable law requires; a record that the account was deleted and when, with the Stripe identifiers it was billed under and a keyed fingerprint of the email address rather than the address, kept for as long as the invoices so we can answer a question about the deletion; for an account that started the free trial, the trialled domain and a keyed fingerprint of the address, so the trial is not given twice; for an account that proved it owns a site, the record of that proof stays, so the site's trial cannot be handed over again; and the log of administrative actions our team took on the account, from which the email address is removed after 12 months. The record of where an account came from (including the ad click identifier kept with the payment data at Stripe), and of the conversions reported about it to the ad platforms, is deleted with the account.

    Support correspondence, by email and on WhatsApp, is kept for as long as the account exists and for 12 months after the last message or the account's deletion, whichever is later. Server logs are kept for at most 30 days, and user-level data in our own Google Analytics 4 property for at most 14 months. Backups may hold copies for at most 30 days and are then overwritten in their ordinary cycle. The model providers keep what they receive under their own policies.

  8. 8Cookies

    Some cookies are strictly necessary and are always set: the session cookies of our sign-in provider, whose names begin with sb- and end with -auth-token, which keep you signed in; locale, which remembers for one year whether you chose Arabic or English, to show the site in your language; gsc_oauth_state, gsc_oauth_return and gsc_oauth_flow, which live for 10 minutes while you connect Google, one protecting the exchange against forgery, one returning you to the page you started from and one telling which connection you started, Search Console or Google Analytics; cf_oauth, which lives for 10 minutes while you connect Cloudflare, protecting the exchange against forgery and returning you to the page you started from; rail_closed, which remembers for one year which groups of the dashboard's side menu you folded, so they stay as you left them; and tasadr_consent, which remembers for 6 months your answer to the cookie banner, or the consent you gave in the sign-up form.

    The support chat sets its cookies only when you open it, because you asked for it: the chat provider's three cookies, two of which last 9 months and the third a week, keep the conversation going and recognise your browser when you come back. When you sign out of the dashboard we end the chat session.

    Everything else is set only if you accept it in the banner or in the sign-up form, and you can change your answer at any time from "Cookie settings" at the foot of the site's pages and in your account menu. With analytics or advertising cookies, tasadr_attr (with a copy in your browser's local storage) remembers for 90 days the campaign and the ad click that brought you to us, and tasadr_eid, which lives for a day, and tasadr_fire, which lives for 10 minutes, carry one sign-up's identifier through the sign-in. With analytics cookies, Google Analytics 4 sets its _ga cookies, which last up to two years; without them it sets none. There are also the product analytics provider's cookies, whose names begin with ph_, which recognise your browser for one year and are set only if you accept them. With advertising cookies, the Google Ads tag sets its _gcl_ cookies and the Meta pixel its _fbp and _fbc cookies, each for up to 90 days, and the TikTok pixel its _ttp, _tt_enable_cookie and ttcsid cookies, for up to 13 months. When you refuse a kind after accepting it, we delete from your browser what we, and the tags on our domain, set of that kind. Our hosting provider's page statistics never set a cookie.

  9. 9Security, and breach notification

    Traffic is encrypted in transit with TLS. Every read and write is scoped on the server to the account that made the request, and ownership is checked on each one rather than trusted from the browser. Administrative access is limited to those who need it to run the service. Google and Cloudflare OAuth tokens are stored with restricted access and encrypted at rest. No system can promise absolute security. If a breach affects your personal data, we notify the competent data protection authority in the European Union within 72 hours where the GDPR requires it, and the Saudi Data and AI Authority (SDAIA) within 72 hours where the PDPL requires it, and we tell you without undue delay where the risk to you is high.

  10. 10Your rights, and how to use them

    If you are in Saudi Arabia, the PDPL gives you the right to be informed of the purpose and legal basis for collecting your data, to access your data and obtain a copy of it in a clear format, to ask for it to be corrected, completed or updated, to ask for it to be destroyed when it is no longer needed, and to withdraw your consent where processing rests on it.

    Wherever you are, the GDPR gives you the right to know whether we process data about you and to receive a copy (Article 15), to have it corrected (Article 16), to have it erased (Article 17), to have processing restricted (Article 18), to receive the data you gave us in a machine-readable form and have it sent on (Article 20), to object to processing that rests on our legitimate interest, including our contacting you (Article 21), and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22), which is a decision we do not take.

    To use any of these rights, write to support@tasadr.ai from the address on the account, and we answer within 30 days. We may ask for proof of identity before we hand over or delete data. You can delete your account yourself from Settings at any time. If you believe we have handled your data wrongly, you may complain to the competent data protection authority in the European Union, to the supervisory authority where you live or work, or, in Saudi Arabia, to SDAIA.

  11. 11Children, changes to this policy, and contact

    Tasadr is sold to businesses and is not for anybody under 18. We do not knowingly collect data about a child; if you believe a child has created an account, write to us and we will delete it. We may change this policy as the service changes. The date at the top is the date of the version you are reading, and we tell account holders by email or inside the platform at least 7 days before a material change takes effect. This version applies to new accounts from its publication date, and to existing accounts 7 days after their holders have been told by email or inside the platform. These pages are published in Arabic and in English; where the two differ, the English text prevails. For anything in this policy, write to support@tasadr.ai.