GeoPeak Privacy Policy
geopeak.ai · Last updated: Oct 1, 2026
In short
GeoPeak collects very little: your email address, the domain name you want analysed, and a few technical details used to limit abuse and fix errors on the site.
Three things worth knowing:
- Your email address is verified through a confirmation link. Until you click it, nothing is stored and no analysis runs.
- The box that lets us contact you is never pre-checked. You can withdraw that consent at any time, in one click.
- Your email address is never sent to the providers that analyse AI assistant answers. Only the question asked and the address of the analysed site are.
The rest of this policy gives the detail: what is collected, why, who has access, for how long, and how to take back control.
Who is responsible for your information
GeoPeak is operated from Montreal by Wink's Quebec entity. That entity is the controller, meaning the one that decides why and how your information is used, wherever you live.
| Role | Contact |
|---|---|
| Controller | Wink's Quebec entity, in Montreal. [TO FILL IN: full legal name] |
| Postal address | [TO FILL IN: postal address in Montreal] |
| Privacy contact | [TO FILL IN: email address] |
| Privacy officer | [TO FILL IN: name, title, email] |
Quebec's Law 25 requires that one named person be responsible for the protection of personal information. That person receives your access, correction and deletion requests, and handles complaints.
The product is offered worldwide. The section called Wherever you are in the world sets out which regime applies depending on where you live, and which authority you can turn to.
What we collect
Three situations, and nothing else: the waitlist signup, use of the free tools, and error detection on the site. To that, add what your browser stores so the site can work, described in the next section.
Waitlist signup
When you sign up, we record:
- your email address
- the domain name of the site you want analysed
- the date you signed up
- where your visit came from, meaning the UTM parameters in the link you followed and the referring site
- the visibility score produced by the analysis
- your consent to be contacted, together with the exact wording you accepted and the date you accepted it
The consent box is never pre-checked. And your email address is verified through a confirmation link: before that click, nothing is stored and no analysis runs.
Free tools, no account needed
Three tools are open without creating an account:
- a technical audit of a domain
- a check of the robots.txt and llms.txt files
- a simulation of a question put to an AI assistant
The third one asks for a verified email address. The other two do not, but none of the three is anonymous for that reason: all three keep an address fingerprint in order to count uses.
To limit abuse, the site keeps a fingerprint of your IP address and of its address block. A fingerprint is the result of a hash: the address itself is never written in the clear in our systems. It is used only to count daily uses, and it is deleted every day.
[TO VERIFY IN THE CODE: does the hashing of IP addresses use a secret salt? The answer decides which sentence gets published. Without a secret salt, a hashed IP address can be reversed, because the IPv4 address space is small enough to be enumerated in full and compared.]
If the answer is yes, publish: "The fingerprint is computed with a secret key. Without that key, it cannot be used to recover the original address."
If the answer is no, publish: "The fingerprint remains tied to your address: anyone holding our database could recover the original address by systematic comparison. That is one of the reasons these fingerprints are deleted every day."
Technical error detection
The site uses Sentry to catch application errors, meaning bugs and failures in the code.
[TO CONFIRM] Which technical data is sent to Sentry when an error occurs, for example the page address, the browser type or the IP address. This list has to be checked against the configuration before publication.
Cookies and browser storage
The site uses no advertising cookies and does no behavioural tracking. No social network pixel, no ad network, no profiling.
What is stored serves the working of the site:
- Clerk session cookies, which keep account holders signed in
- where applicable, local storage in your browser, to remember display preferences
These stay in your browser. You can clear them at any time in its settings, at the cost of having to sign in again.
[TO VERIFY IN THE CODE: the exact list of cookies set and local storage keys used, with their lifetimes. This list must be complete before publication.]
Why, and on what basis
Every piece of information we collect serves one purpose, set out here with the legal basis that allows it.
| What we do | Why | Legal basis |
|---|---|---|
| Run the requested analysis and keep your place on the waitlist | To answer the request you made yourself | Steps taken at your request before a possible contract (GDPR art. 6(1)(b)). In Quebec, the information is necessary to provide the service requested |
| Contact you about GeoPeak | To tell you about the launch and what comes next | Your consent, given through a box that is not pre-checked and can be withdrawn at any time |
| Keep the source of the visit (UTM, referring site) | To know which channels bring signups | Legitimate interest in understanding where our signups come from |
| Count daily uses of the free tools | To stop one visitor from overloading the service | Legitimate interest in protecting the service against abuse |
| Detect application errors | To keep the site working | Legitimate interest in the reliability of the service |
The source of the visit is attached to your signup at the moment it happens. It is not used to follow you from one site to another.
If you withdraw your consent, we stop writing to you. That does not affect the lawfulness of emails sent before the withdrawal.
Consent and commercial email
We only write to you if you ticked the box provided, and only once your address has been confirmed through the verification link. This is what CASL, Canada's anti-spam legislation, calls express consent.
Every commercial email we send contains:
- the sender's identification
- a valid postal address
- an unsubscribe link that works in one click
- a management link that lets you review or correct what we hold about you
Unsubscribing takes effect immediately. CASL allows senders up to ten business days to process it, but we do not use that delay.
We keep a record of your consent: the wording you accepted and the date. That is what lets us establish, if the question comes up, that you did agree.
The address verification email is not a commercial email. It is sent because you have just started a signup or an analysis, and it carries no solicitation.
Who else has access
We rely on providers to host the site, store signups, send emails and run analyses. Each one acts on our behalf and on our instructions.
| Provider | Role | Country |
|---|---|---|
| Vercel | Site hosting and code execution | United States |
| Upstash | Storage of waitlist signups and usage counters | [TO CONFIRM: hosting region] |
| Resend | Email delivery | United States |
| QStash | Running analysis tasks in the background | [TO CONFIRM] |
| Clerk | Account management. Present on the site, not used for the waitlist | [TO CONFIRM] |
| Stripe | Payments. Not used during the waitlist phase | [TO CONFIRM] |
| Sentry | Application error detection | [TO CONFIRM] |
| OpenAI, Anthropic, Google, Perplexity | Querying AI assistants to measure visibility | [TO CONFIRM] |
| Bright Data, DataForSEO | Collecting AI assistant answers | [TO CONFIRM] |
One rule applies to the providers in the last two rows: we send them the question asked and the address of the analysed site, never your email address.
One clarification is needed. A site address can identify a person on its own, that of a freelancer or a very small business for example. So we do not claim that nothing identifying leaves here: the analysed site does, because the analysis is about that site.
[TO CONFIRM] Law 25 and the GDPR require a written agreement with every provider that processes personal information on our behalf. This has to be verified for each one before publication.
Communication outside Quebec and international transfers
Part of your information is processed outside Quebec. The table in the previous section shows where, provider by provider. Site hosting and email delivery happen in the United States in particular.
Law 25 requires us to tell you this, and to assess whether the protection offered is adequate before entrusting information to a provider located outside Quebec.
[TO CONFIRM] The date of the last documented assessment and its conclusion. This text states that an assessment took place, which assumes it exists in writing.
If you live in the European Union, the GDPR governs these same transfers.
[TO CONFIRM] The mechanism relied on for each provider established outside the European Union, for example standard contractual clauses or an adequacy decision.
How long we keep it
The retention periods are set. Only one still has to be checked against the configuration before publication, the one for error data.
| Information | Retention period |
|---|---|
| Waitlist signup: email, domain, date, source of visit, score | 3 years after the last contact |
| Proof of consent: wording accepted and date | 3 years after consent is withdrawn |
| IP fingerprints used for the counters | Deleted every day |
| Error data collected by Sentry | 90 days [TO VERIFY IN THE CONFIGURATION BEFORE PUBLICATION] |
| Hash kept after a deletion request | Kept with no time limit, for the reason given in the section on your rights |
The last contact means the most recent of these: an email you send us, a click in one of our emails, or a new analysis started from your address. Three years with none of those, and your signup is deleted.
Your rights, and how to exercise them
All of these rights can be exercised through the management link in every email we send, or by writing to [TO FILL IN: privacy email address].
| Right | What it allows | How to exercise it |
|---|---|---|
| Access | To know what we hold about you and get a copy | Management link, or by email |
| Correction | To fix inaccurate information, for example a mistyped domain | Management link, or by email |
| Deletion | To have your signup removed | Management link, or by email |
| Withdrawal of consent | To stop receiving our emails | One click unsubscribe at the bottom of every email |
| Portability | To receive your information in a structured, commonly used format | By email |
| Objection and restriction | To object to processing based on legitimate interest, or ask that it be restricted (GDPR) | By email |
| Complaint | To go to the competent authority if our answer does not satisfy you | See below |
What remains after a deletion
When you ask for deletion, your signup is erased. One thing remains: a hash of your email address. That hash cannot be reversed to recover the address. It is used only to recognise an address that has already been deleted, so that we do not sign you up or contact you again by mistake.
Verification and deadlines
Before acting on a request, we have to be sure it comes from you. For an email address, that is done through a confirmation link sent to that address.
Law 25 gives us 30 days to answer an access or correction request. The GDPR provides one month, extendable by two months if the request is complex. Unsubscribing takes effect immediately.
Wherever you are in the world
GeoPeak is offered everywhere, in French and in English, from a Quebec entity.
We do not apply a different regime country by country. We grant the same rights to everyone, wherever they live, by applying the most protective rule among those that bind us.
Here are the regimes we name, where we have a real presence or expect volume, with the authority you can turn to.
| Where you live | Regime | Authority to turn to |
|---|---|---|
| Quebec | Law 25 | Commission d'accès à l'information du Québec |
| Canada outside Quebec | Personal Information Protection and Electronic Documents Act (PIPEDA) | Office of the Privacy Commissioner of Canada |
| European Union | GDPR | The data protection authority of your country of residence. In France, the CNIL |
| United Kingdom | UK GDPR | Information Commissioner's Office |
| California | California Consumer Privacy Act | California Privacy Protection Agency |
California
We do not sell or share personal information within the meaning of California law. No information is exchanged for value, and none is passed to another business for cross-context behavioural advertising.
Everywhere else
The rights described in this policy are offered to everyone, whatever their country of residence. If our answer does not satisfy you, you can take the matter to the competent data protection authority where you live.
Automated decisions
No decision about you is made automatically. The visibility score is about a website, not a person. It is not used to rank you, or to grant or refuse you anything.
Security
We take reasonable measures to protect what we hold. Two of them are described above: your IP address is never stored in the clear, and your email address is verified before anything is recorded.
[TO CONFIRM] The other technical and organisational measures to describe here, for example encryption of data at rest and how internal access is limited.
No system is immune to an incident. We therefore do not promise absolute security.
Minors
GeoPeak is not aimed at people under 14, and we do not knowingly collect their information.
If you are a parent or guardian and you believe a child under 14 has given us their email address, write to us at the address below. We will check and delete the signup, following the procedure described in the section on your rights.
Changes to this policy
This policy may change, for example if GeoPeak adds a feature that collects new information.
The last updated date appears at the top of the page and changes with every modification. For a minor correction, a rewording or a repaired link, that date is enough.
When a change affects your rights or the use of your information, we tell you by email, at the address used when you signed up, at least 30 days before it takes effect.
If that change does not suit you, you have those 30 days to unsubscribe or to ask for your signup to be deleted.
Contact us
For a question about this policy, or to exercise one of your rights:
- Email: [TO FILL IN: privacy email address]
- Privacy officer: [TO FILL IN: name and title]
- Postal address: [TO FILL IN]
We answer within the deadlines set out above.