Privacy Policy

Data controller

The data controller for personal data processed through BuyerPrompt (buyerprompt.com) is the operator of this service. Contact: privacy@buyerprompt.com. If you need a formal legal entity name for a vendor questionnaire, email that address and we will provide the current controller details in writing.

What we collect

When you submit an audit, we collect the domain, brand name, category, target market, optional ideal-customer-profile description, competitor names, and—only if you choose to provide it—an email address. We do not require an account or password, and we do not collect payment card details ourselves — if you purchase a paid upgrade, your card details go directly to Stripe (see below).

Purposes and legal bases

• Providing the audit and report (including paid unlock and before/after) — performance of a contract / steps at your request before a contract (GDPR Art. 6(1)(b)).
• First-party funnel analytics — understanding conversion and product reliability — legitimate interests (Art. 6(1)(f)), balanced against your rights; events do not store your email. When you arrive via a campaign link, we may store standard UTM parameters (source, medium, campaign, term, content) in local storage and attach them to funnel events so we can see which channels convert. We also use a random, first-party session identifier scoped to one browser tab, the landing path, and the referring site without its query string to distinguish direct, search, referral, and AI-assistant traffic — not for third-party ad retargeting.
• Payments — Stripe processes card data as an independent controller/processor under its own terms; we receive payment status needed to unlock features (Art. 6(1)(b)).
• Advertising measurement — measuring whether a Google ad results in a completed audit form. Advertising storage is denied by default and enabled only after consent where required (Art. 6(1)(a)).
• Legal compliance — where required (Art. 6(1)(c)).

How we use it

Your brand and competitor information is used to generate buyer-intent prompts and run them through AI models to produce your visibility report. If supplied, your email is used only to associate you with your submission and prevent free-audit abuse — we do not automatically email the report link, and we do not sell or share your email with third parties for marketing.

Third parties we send data to

• OpenRouter — routes your generated prompts to the underlying AI providers (OpenAI, Anthropic, Google, Perplexity, xAI) to produce the answers your report is built from. Your brand/domain/category text is included in these prompts.
• Serper.dev — used to fetch Google search results for additional ranking context on some CATEGORY and ALTERNATIVE prompts. This is separate from citations that appear inside AI answers (see Methodology).
• Stripe — processes payment for the paid upgrade, if you choose to purchase one. We never see or store your card number.
• Vercel — hosts the application and provides aggregated web analytics (page views) without advertising cookies.
• Google Ads — measures whether an ad visit results in a successfully submitted audit form. We send a pseudonymous submission identifier for deduplication, not the email entered in the form. Enhanced conversions are not enabled.

International transfers

Some processors (including OpenRouter providers, Stripe, Vercel, Serper, and Google) may process data in the United States or other countries outside the EEA/UK. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or the provider's certified transfer mechanism. Ask privacy@buyerprompt.com for current subprocessors and transfer details.

Analytics

We use first-party funnel events (for example page view, form start, upgrade click), Vercel Analytics, and Google Ads conversion measurement to understand conversion. These events store a path, acquisition channel, tab-scoped session id, and optional submission id — not your email. Referrer query strings are discarded, and private audit, report, and status URLs are redacted before storage. Google advertising storage is denied by default and is enabled only if you select Allow measurement. You can change that choice at any time through Cookie settings in the footer. We do not sell analytics data.

Report links

Your report is accessible via a long, unguessable link rather than requiring a login. Anyone with that exact link can view the report, so treat it like any other unlisted-but-not-password-protected document. Report pages send a noindex directive to search engines.

Data retention and deletion

We retain submission and report data so you can return to a report link and use the before/after re-run feature. As a default we keep this data for up to 24 months after your last activity on that submission, then may delete or anonymize it. Email us to request earlier deletion; we aim to complete verified deletion requests within 30 days.

Your rights (EEA/UK and similar)

Subject to applicable law, you may request: access to your personal data; rectification of inaccurate data; erasure; restriction of processing; objection to processing based on legitimate interests; and data portability where processing is based on contract and carried out by automated means. You also have the right to lodge a complaint with your local supervisory authority (for example your EU member-state DPA or the UK ICO).

To exercise these rights, email privacy@buyerprompt.com. We may need to verify you control the email associated with a submission before acting on a request.

Contact

Privacy questions, rights requests, or deletion: privacy@buyerprompt.com.