Privacy Policy

Last updated: 30 September 2026

This is a translation. In case of any discrepancy, the Danish version prevails.

Geoa (geoa.app) is operated by AddonNordic ApS (Danish company reg. no./CVR 46495985, Aalborg, Denmark). Contact: hello@geoa.app.

This privacy policy covers the geoa.app website and Geoa's services (GEO score, AI visibility analysis, content generation). If you use our Shopify/WordPress app, the separate App Privacy Policy applies.

Data we collect

When you visit geoa.app

Plausible Analytics — we use Plausible, a cookie-free analytics tool that collects no personal data. No cookies, no cross-site tracking, no fingerprinting. We only see: pages visited, referral source, device type, country at region level.
Microsoft Clarity — behavioural analytics (session recordings and heatmaps) showing us how the site is used so we can improve it. Clarity loads only after your statistics consent in the cookie banner; without consent it never loads. Text input and sensitive content are masked by default in recordings. In the Geoa app (dashboard) itself, Clarity runs in cookieless mode and sets no cookies. The processor is Microsoft; data may be processed in the US under the EU-U.S. Data Privacy Framework. Read more in Microsoft's privacy statement.

When you test your GEO score

Your domain — analysed publicly (your website's HTML, metadata, structure). Data is stored linked to your domain.
Your email — if you choose to receive the report and weekly updates.

When you create an account / become a customer

Name, email, domain — to deliver the service.
Payment details — processed by our payment partner (Stripe). We do not store card data.
Analysis data — GEO scores, citation results and content improvements linked to your account.

How we use data

To deliver and improve the GEO/AEO analysis service
To send you your GEO score report and related updates (if you opt in)
To generate and deliver content (blog posts, LinkedIn posts)
To comply with our legal obligations

We do not sell your data. We do not use your data to train general AI models.

Third parties / sub-processors

We use subprocessors for hosting, database, email, payments, AI analysis and search data. The full list — with purpose, what each one receives, where it is processed and on what transfer basis — is in Annex B of the data processing agreement and on the Trust Center. The list is wired to the codebase and covered by automated tests, so it follows the platform as it changes instead of becoming a copy that slowly falls behind.

Google user data

If you choose to connect a Google account to Geoa, we only access the data needed for the feature you turn on:

Google Search Console (read-only): search queries, clicks, impressions and positions for the websites you select — so we can show your search visibility and prioritise improvements. If you ask us to submit a sitemap, we use write access for that action only.
Google Analytics (read-only): aggregated traffic statistics for the property you select — so we can show which visits come from AI assistants and search.
Google Business Profile: information, reviews and posts on your business profile — so we can show the profile's status, suggest review replies and publish replies or posts only after you have approved each individual reply or post. Reviews are fetched live from Google every time and are not stored by us; we only keep a log of the actions you approved.

Who we share Google user data with

We do not sell Google user data, do not use it for advertising and do not transfer it to data brokers or any other third parties. Data is shared only with the following sub-processors, and only to provide the features to you:

Hosting and database (Railway, Supabase — EU) — storage and operation of the service.
AI providers (primarily OpenAI; the full list is in Annex B) — text excerpts such as search queries, or a review you want to reply to, are sent to generate the recommendation or reply suggestion you see in your dashboard. The provider is bound by a data processing agreement and may not use the data to train its models.

Beyond this, we only disclose data where required by law or when you ask us to. We do not use Google user data to develop, improve or train generalised AI or machine-learning models. Geoa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect Google user data

Encryption in transit: all communication with Google and with our own servers uses HTTPS/TLS with HSTS.
Encryption at rest: the database is encrypted with AES-256. Google access credentials (OAuth tokens) are kept server-side only and are never sent to the browser.
Access control: only Geoa's backend can read tokens and Google data; each customer sees only their own data, and staff access is limited to operations and support you request.
Least privilege: we only request the access the feature you turn on requires — read-only, unless you ask for a specific action.

Retention and deletion of Google user data

You can disconnect at any time in your dashboard. We then revoke the access at Google and delete your tokens immediately. You can also remove access at myaccount.google.com/permissions. Retrieved Google data is deleted together with your account within 30 days, or sooner if you write to hello@geoa.app.

If you sign up for our newsletter, we process your email address on the basis of your consent (GDPR art. 6(1)(a) and the applicable national marketing rules). We store the exact wording you agreed to, together with the timestamp, so the consent can be documented. We collect the email address only — no name, no company, no phone number.

You can unsubscribe using the link at the bottom of every email; the unsubscribe is recorded immediately and no further newsletters are sent. The sign-up is deleted no later than 365 days after an unsubscribe. The newsletter is separate from the emails you receive as a customer about your own score and reports.

Data retention

Data is stored in the EU. We keep your data for as long as your account is active. When you delete your account, all associated data is deleted within 30 days.

Your rights (GDPR)

You have the right to:

Access the data we hold about you
Have inaccurate data corrected
Have your data deleted
Withdraw consent
Receive your data in a machine-readable format

Contact hello@geoa.app to exercise your rights. We respond within 30 days.

As Geoa is operated by a Danish company, the Danish Datatilsynet is the supervisory authority. You may also contact your local data protection authority.

Changes

We update this policy as needed. The date at the top reflects the latest revision. For material changes we notify registered users.

AddonNordic ApS · CVR 46495985 · Aalborg, Danmark · addonnordic.dk