Effective date: July 8, 2026

This Privacy Policy describes how NextEO, part of MediaSavior L.L.C. ("NextEO," "we," "us," or "our") collects, uses, shares, and protects information when you use our website at nexteo.ai, our free AI visibility checker, and our application at app.nexteo.ai (collectively, the "Service").

Information We Collect

Depending on how you use the Service, we may collect:

Account information: your name, email address, and password (stored only as a bcrypt hash), and, if you sign in with Google, the basic profile information (name and email) Google returns.
Lead information: if you use the free checker or the AI-traffic estimator, the email address and, if you provide one, the phone number you enter, along with the website and estimate. Lead details are stored and may be sent to our own customer-relationship spreadsheet (hosted on Google) so we can follow up.
Website and analysis data: the website addresses you add, the pages we analyze at your request, and the scores, findings, and history we generate for you.
Connected-account data: if you choose to connect Google Search Console or Google Analytics, the data described in "Data From Google Services" below.
Billing information: your subscription status and plan. Card numbers are collected and processed by Stripe on Stripe-hosted pages and never reach our servers.
Usage and log data: standard server logs (IP address, request path, user-agent, timestamp, response code) and product-usage events, used to operate, secure, and improve the Service.

You can use the free checker without creating an account. The application requires an account.

How We Use Information

To provide, operate, maintain, and improve the Service and its features
To create and secure your account, process payments, and provide customer support
To generate your AI visibility analyses, reports, recommendations, and assistant (EO) responses
To understand usage patterns and popular features
To detect, prevent, and respond to abuse, fraud, and security incidents
To send you transactional and service messages, and (where permitted) product updates you can opt out of

Data From Google Services (Search Console, Analytics, and Google Sign-In)

Connecting a Google account is optional and always initiated by you. When you connect one, we request only the access needed for the feature you are turning on:

Google Search Console (read-only): we read your site's search-performance data (queries, clicks, impressions, click-through rate, and positions) to power Search Intelligence, your reports, and recommendations.
Google Analytics (GA4) (read-only): we read aggregated traffic and attribution data (including AI-referred sessions and revenue) so we can show you the business results of AI search.
Google Sign-In (optional): we use your basic Google profile (name and email) only to create and authenticate your account.

Limited Use. NextEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above. We do not sell Google user data, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security or to comply with the law, or where the data has been aggregated and anonymized.

You can disconnect a Google connection at any time from the Service, which deletes the OAuth tokens we hold for it, and you can also revoke access directly from your Google Account permissions page.

How We Share Information

We do not sell your personal information or your Google user data. We share information only in the following ways:

Service providers (subprocessors): we use a small set of vendors to run NextEO. Each receives only the data needed for its function, and only to provide services to us:
- Render: Application hosting and compute: the API, background workers, and cron.
- Neon: Managed PostgreSQL database: your account, websites, scores, and connected-account data are stored here.
- Upstash: Managed Redis for background job queues, rate limiting, and usage counters.
- Stripe: Payment processing and subscription billing (card details are entered on Stripe and never reach our servers).
- Resend: Transactional and lifecycle email delivery.
- Sentry: Error monitoring (with secrets and personal data redacted).
- OpenAI: AI visibility testing, the EO assistant (ChatGPT), and the ChatGPT Ads integration.
- Anthropic: AI visibility testing (Claude).
- Google: AI visibility testing (Gemini), the Search Console and Analytics connections you choose to enable, business-listing and review lookups for reputation (Google Places), and optional Google sign-in.
- Perplexity: AI visibility testing (Perplexity).
- xAI: AI visibility testing (Grok).
- SerpAPI: Search-result and review-listing lookups for reputation monitoring (optional features).
Advertising and analytics (consent-gated): on our marketing site only, and only after you accept cookies, we load Google Analytics, Meta, LinkedIn, Apollo, OpenAI (Ads pixel). These are detailed in our Cookie Policy. If you decline cookies, they never load.
Legal and safety: we may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of NextEO, our users, or the public.
Business transfers: if NextEO is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

AI providers. AI visibility testing sends content from your public website and your business details to the AI providers we test against (OpenAI, Anthropic, Google, Perplexity, and xAI). Those providers process that content under their own privacy policies and terms, which are outside NextEO's control and may differ from ours. We send only what a test needs, and we never sell it.

Data received from Google APIs is shared only with the subprocessors above that are necessary to operate the features you use, and only as needed to provide them, consistent with the Limited Use requirements above.

How We Protect Your Information

We apply administrative, technical, and organizational safeguards designed to protect your information, including sensitive data such as connected-account credentials:

Encryption in transit: all traffic is served over HTTPS with HSTS, and standard security headers are enforced on every response.
Encryption at rest for credentials: OAuth tokens for connected accounts (such as Google Search Console and Google Analytics) are encrypted with AES-256-GCM. API keys are stored only as SHA-256 hashes, and passwords are hashed with bcrypt.
Access controls and tenant isolation: every read and write is authorized against your ownership or active team membership at the database layer, so one customer cannot access another's data. Administrative and support access is restricted, audited, and requires two-factor authentication.
Account protections: optional two-factor authentication, server-side sessions that are revoked on logout and password change, and rate-limited, logged authentication attempts.
Data minimization in logs: passwords, tokens, and authorization headers are automatically redacted, and support message contents are never written to logs.
Monitoring and dependencies: errors are monitored (with secrets redacted) and dependencies are kept at zero known vulnerabilities as part of our release checks.

No method of transmission or storage is perfectly secure, but these measures are designed to protect your data against unauthorized access, disclosure, alteration, and loss. You can read more on our Security page.

Cookies and Tracking

We use cookies and similar technologies for authentication and analytics. See our Cookie Policy for details and your choices.

Data Retention

We retain your account and analysis data for as long as your account is active and as needed to provide the Service. We retain usage logs for a reasonable period to operate, secure, and improve the Service, after which they are deleted or anonymized. When you disconnect a Google connection or delete your account, we delete the associated connected-account tokens and data, except where we must retain limited information to comply with legal, tax, or security obligations.

Your Rights and Choices

Depending on your jurisdiction, you may have rights to access, correct, delete, or export the personal data we hold about you, and to object to or restrict certain processing. California residents can find additional detail in our CCPA notice. You can disconnect integrations, edit your account, or request deletion at any time. To exercise these rights, contact us at nexteo@mediasavior.com.

Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

International Users

We operate in the United States, and our service providers may process data in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in those locations.

Changes to This Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the most recent revision, and we will provide notice of material changes where required.

Contact

NextEO, part of MediaSavior L.L.C.
nexteo@mediasavior.com