">

Beta GEONALY is in open beta — you may meet a rough edge. Tell us at support@geonaly.com and we will fix it.

Privacy Policy.

How Geonaly collects, uses, discloses and protects personal data when you visit geonaly.com or use the Service. For the Website and your account, Geonaly is the data controller under the GDPR.

The Service is a business tool that analyzes search performance and how brands appear in AI assistants. It is not designed for, and must not be used for, monitoring identified or identifiable natural persons.

LAST UPDATED · 28 JULY 2026 GDPR · REGULATION (EU) 2016/679
/ 01 · WHAT WE COLLECT

The categories of personal data we hold.

We do not intentionally collect special categories of personal data, anything revealing health, religious beliefs or political opinions, and we ask that you do not submit such data to the Service.

Account and contact data

Name, business email, company name, job title, password (stored hashed) and account preferences.

Billing and transaction data

Limited transaction information from Paddle: name, email, country, plan and payment status. We never receive or store full card numbers.

Connected-account data

Data from services you connect: Search Console, GA4, Slack, Notion, BigQuery. Analytics data may contain online identifiers and approximate location.

Usage and device data

Collected automatically: IP address, browser and OS, device identifiers, pages viewed, features used, timestamps and referring URLs.

Communications data

The content and metadata of emails, support requests, demo bookings and other correspondence with us.

Marketing data

If you subscribe, download materials or register for events: name, email, company, plus your preferences and consent records.

Cookie data

Data collected through cookies and similar technologies. Strictly necessary and functional only, see section 05.

/ 02 · WHY WE PROCESS IT

Every purpose, with the
legal basis behind it.

Processing under Article 6 GDPR. Where we rely on consent you can withdraw it at any time; where we rely on legitimate interests you can object.
Providing the Service : accounts, integrations, support, transactions
Performance of a contract
Art. 6(1)(b)
Security and integrity : authentication, fraud prevention, incident response
Legitimate interests
Art. 6(1)(f)
Product improvement and analytics
Legitimate interests, or consent for non-essential cookies
Art. 6(1)(f) / (a)
Marketing communications
Consent, or legitimate interests for existing customers where permitted
Art. 6(1)(a) / (f)
Legal compliance : accounting, tax, lawful requests
Legal obligation
Art. 6(1)(c)
Establishing, exercising or defending legal claims
Legitimate interests
Art. 6(1)(f)
/ 03 · WHAT YOU CONNECT

Your content and the accounts you authorize.

Where personal data sits inside your content, in data retrieved from a connected account, or in AI-generated responses we store, we process it on your behalf as a processor. You are responsible for your right to connect each account and for the destinations you configure.
INTEGRATION

Google Search Console and Google Analytics 4

We access search and analytics data for the properties you connect. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

INTEGRATION

Slack and Notion

Where you enable delivery, we send reports and alerts to the workspaces or pages you select.

INTEGRATION

Google BigQuery, API and CSV exports

Where you enable them, we deliver data to the destination you configure.

INTEGRATION

AI assistants: ChatGPT, Claude, Gemini, Perplexity

The Service sends prompts, which generally concern brands and categories rather than individuals, and stores the responses.

INTEGRATION

Data providers such as DataForSEO

We request keyword and visibility data using inputs such as domains and keywords.

/ 04 · WHO RECEIVES DATA

Every party that touches it.

We do not sell personal data, and we do not share it with third parties for their own direct marketing. A current list of sub-processors, with purposes and processing locations, is available on request at support@geonaly.com.
Webglobe, s.r.o.
Hosting, infrastructure and domain email services
Processor
Paddle.com Market Limited
Merchant of Record : payment, tax, invoicing, fraud prevention
Independent controller
Transactional email, product analytics, support / CRM providers
Acting on our documented instructions
Processors
Services you connect, data providers and AI assistants
To the extent you use those features (section 03)
Third parties
Professional advisers
Lawyers, accountants and auditors, under confidentiality obligations
Recipients
Public authorities
Where disclosure is required by law or a valid legal request
Recipients
/ 05 · COOKIES & TRANSFERS

Two things people always ask about.

Cookies

Strictly necessary cookies support authentication, session management and security, and cannot be disabled. Functional cookies remember your preferences. We do not currently use analytics or marketing cookies; if we introduce them they will be activated only with your consent where the law requires it.

International transfers

Personal data may be transferred to and processed in countries outside the EEA where we or our service providers operate. Where that happens we rely on mechanisms recognized by the GDPR: European Commission adequacy decisions, the EU Standard Contractual Clauses with additional safeguards where needed, or the EU-U.S. Data Privacy Framework for certified organizations in the United States.

Copies of the relevant safeguards can be requested at support@geonaly.com.

/ 06 · RETENTION

We keep it only as long
as we need it.

Retention runs to the purposes described on this page. Where the law sets a longer minimum, tax and accounting records, for instance, that governs.
Account data
Life of the account + 30 to 90 days
Then deleted or anonymized, unless the law requires longer.
Billing and transaction records
Up to 10 years
As required by tax and accounting law, depending on jurisdiction.
Connected-account and Service data
Duration of your Subscription
Plus the retrieval window described in the Terms, then deleted or anonymized.
Usage logs
Typically 12 months
Unless needed longer for a security investigation.
Marketing data
Until you withdraw consent
Then kept only on a suppression list, to honour your preference.
/ 07 · SECURITY

The measures we actually apply.

No system is completely secure. If we become aware of a personal data breach affecting your rights, we will notify you and the competent supervisory authority where the law requires it.
Encryption in transit
Access controls and role-based permissions
Hashed password storage
Network controls
Logging and monitoring
Staff confidentiality obligations
/ 08 · YOUR RIGHTS

What you can ask us to do.

Contact support@geonaly.com to exercise any of these. We respond within one month, extendable by two further months for complex or numerous requests, and we may need to verify your identity first.
Art. 15

Access

Get a copy of the personal data we hold about you.

Art. 16

Rectification

Have inaccurate data corrected and incomplete data completed.

Art. 17

Erasure

Have your data deleted, in the circumstances the law provides for.

Art. 18

Restriction

Restrict how we process your data in certain circumstances.

Art. 20

Portability

Receive data you provided in a portable format and send it elsewhere.

Art. 21

Objection

Object to processing based on legitimate interests, and to direct marketing at any time.

Art. 7(3)

Withdraw consent

Withdraw consent at any time, without affecting prior lawful processing.

SUPERVISORY AUTHORITY

You also have the right to lodge a complaint with a supervisory authority, in particular in your country of residence or work. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů).

/ 09 · ALSO WORTH KNOWING

Three short answers.

No automated decisions

We do not use your personal data for automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Not for children

The Website and Service are intended for business users and are not directed at anyone under 16. We do not knowingly collect their data, if you believe a child has provided it, contact support@geonaly.com and we will delete it.

When this changes

We may update this Policy to reflect changes in our practices, technologies or legal requirements. The "last updated" date shows the most recent revision, and for material changes we give notice by email or through the Service before they take effect.

/ 10 · QUESTIONS

Asked often, answered plainly.

/ 11 · CONTACT

Talk to a person about it.

CONTROLLER
Geonaly
Prvního pluku 347/12a, Karlín
186 00 Praha 8, Czech Republic
Company registration number (IČO): 29805937
PRIVACY ENQUIRIES
support@geonaly.com

Data subject requests, DPA copies, sub-processor lists and transfer safeguards.

Send an email →
This page mirrors the Geonaly Privacy Policy. Where the wording differs, the signed policy document takes precedence. Last updated 28 July 2026.
READY / SIGNAL ACQUIRED

Your brand is already part of the answer.Make sure it's the right one.

Join the teams turning scattered AI mentions and search data into weekly wins.

7 DAY TRIAL · NO CARD REQUIRED · LIVE IN 2 MINUTES