Privacy Policy

1. Information We Collect

Scan data: When you scan a domain, we store the domain URL, extracted company information, AI model responses, and computed visibility scores.

Account data: If you sign in with Google, we receive your name, email address, and profile picture from Google OAuth. We do not access your Google password. When you scan a domain while signed in, here or through ChatGPT or a coding agent, we also record which domain you scanned, how many times, and when, so we can send you updates about that site. This record is deleted with your account.

Payment data: Payments are processed by Stripe. We do not store credit card numbers. We retain the Stripe session ID and purchase record for order fulfillment.

2. How We Use Your Information

We use your data to provide the Service: running scans, generating reports, processing payments, and sending report delivery emails. We do not sell your data to third parties.

3. Third-Party Services

We share data with the following services as necessary:

• Vercel for application hosting and runtime logs
• Neon for database hosting
• OpenRouter, which routes the visibility questions we ask to models from OpenAI, Anthropic and Google. These questions are built from the scanned domain's company name and category. They do not include your account data.
• Google (Gemini API) receives text from the public pages of the scanned site and the AI answers we collected, to extract company details, judge whether a brand is mentioned, and write report content. It does not receive your account data.
• Stripe for payment processing
• Google OAuth for authentication
• Resend for transactional email delivery

4. Data Retention

Scan results are retained to provide historical comparison and to improve the Service.

Domains on a paid plan: every completed scan is kept for as long as the domain remains on your plan, so you can compare each weekly scan with every earlier one.

Other domains: the most recent 14 completed scans are kept, and older ones are deleted when the domain is scanned again. A domain removed from a plan falls under this limit from its next scan.

Scan attempts that fail or do not finish are deleted. You may request deletion of your data by contacting us. Account data is retained for as long as your account is active.

Abuse-limiting records: the IP address and sign-in flag recorded with scan requests (see section 8) are deleted after 7 days.

Server logs: kept only for as long as our hosting provider retains runtime logs, which is no more than 30 days.

Crash reports and feedback: when a page fails, it sends us the error with the page path, the site version, your screen size and your browser's user agent. Messages you send with the Feedback button carry the same details. If you are signed in, your account ID is attached; we do not record your IP address or email with them. They are kept until we have dealt with them, and you can ask us to delete them.

5. Cookies

We use session cookies for authentication. The only third-party tracking is the X (Twitter) advertising pixel, described below.

Where you came from: if you arrive through a link carrying campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), we set two first-party cookies, mg_src and mg_ft, holding those tags, the page you landed on, the time, and a random visitor ID that identifies this browser, not you. They last 90 days and are never overwritten. When you create an account or complete your first scan, we keep a copy with it, so we can tell which campaigns and partners bring people to meraGEO. They are not shared with anyone.

X advertising pixel: to measure our ads on X, pages load X's pixel, which may set X's own cookies. It tells X when a visitor starts a scan, creates an account (with our random account ID) or subscribes (with the amount and a subscription ID). It never receives your email, the domains you scan or your results. It is not loaded if your browser sends a Global Privacy Control signal. X's use of this data is covered by its own privacy policy.

6. Security

We use encryption in transit (TLS) and at rest. Database access is restricted and credentials are stored as environment variables, not in source code.

7. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by emailing hello@merageo.com.

8. Using meraGEO from ChatGPT or a coding agent

The meraGEO plugin lets you look up the latest stored report for a website domain, request a new scan, and check a scan's status from within ChatGPT, or from a coding agent such as Claude Code, opencode or Codex. You must sign in to meraGEO with Google and approve access before any tool works.

What we read: the domain you ask about, and an access token that identifies your meraGEO account. We do not receive your conversations with ChatGPT or your coding agent, your files, your code or your memory.

What we store: your account ID, the domain scanned, and the scan results. A scan started from ChatGPT or an agent is tagged with your account ID. We do not store access tokens. When an agent registers itself with meraGEO we do not store that registration either: it is a signed token that carries the agent's name and the address it sends you back to. Access tokens expire after 1 hour and refresh tokens after 30 days.

IP and abuse limits: to limit abuse we record the IP address of scan requests, whether the requester was signed in, and a timestamp. For requests made through ChatGPT the address is that of the platform's servers, for a coding agent it is the address of your own connection, and we also keep counters keyed to your account ID to apply daily limits. These records are kept for 7 days.

Server logs: logs record your account ID, the action requested, the domain and the outcome, for security and debugging. They are kept only as long as our hosting provider retains runtime logs, which is no more than 30 days.

Recipients: see section 3. Visibility reports are published by domain and can be read without signing in. They describe a website, not you.

What we do not request: the plugin does not ask for payment card, health, government ID or credential data.

Your controls: you can disconnect meraGEO in ChatGPT, or remove the meraGEO server from your coding agent, at any time. To delete your account and data, email hello@merageo.com; we respond within 3 business days. See also our support page.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes by email.