Privacy notice
Last updated 10 October 2026
Draft. The responsible organisation and contact address are still to be filled in (the bracketed text below). Everything else describes what the service actually does today.
The short version
A summary. The sections below are what apply.
On this page
Firstnamed measures how often AI assistants name your brand when people ask questions in your market. To do that we hold your account details, what you asked us to track, and the answers we collected. This notice explains all of it, and what you can ask us to do about it.
Who is responsible
[CONTROLLER NAME — to be completed] is the data controller for the personal data described here. Contact us at privacy@sightaeo.com, or from the Support page once you are signed in.
What we hold, and why
| What | Why | Our lawful basis |
|---|---|---|
| Your email address and password | To create your account, sign you in, and send you the emails you choose. | Performance of our contract with you |
| Your brand details: whether the account is for a business or for you, name, other names, website, industry, what you sell, customers, market | To recognise your brand in AI answers and to tell it apart from similar words. | Performance of our contract with you |
| The questions you ask us to track, and your competitors | To run the checks you asked for. | Performance of our contract with you |
| The answers AI assistants give, and our analysis of them | To produce your results: how often you are named, where, in what tone, and what changed. | Performance of our contract with you |
| The web pages an AI assistant read to answer your questions: their addresses and titles | To show you which sites shape the answers about your market, and whether you were named when each was read. | Performance of our contract with you |
| When you start a free trial: your website's domain (if you gave one), and a one-way hash of your email address | To review new accounts, and to stop the same business taking repeated free trials. | Our legitimate interests in preventing abuse of the free trial |
| Usage records: when you signed in, when checks ran, request counts | To keep the service working, stop abuse, and hold costs down. | Our legitimate interests in a secure, working service |
| Notes you add in the Explorer about changes you made | To show them on your charts, and to compare your results before and after each one. | Performance of our contract with you |
| Support requests you send us | To answer you, and to keep a record of what was agreed. | Performance of our contract with you |
On a personal account the name we track is your own, so the answers we collect and analyse are about you in your work. They are held for the same purpose, and kept for the same time, as any brand's.
We do not use your data to train AI models, we do not sell it, and we do not share it with other customers. Your brand facts and results are visible only to your own account, to any teammates you invite to it, and, where it is needed to support you, to us.
If you make a share link, anyone who has it can see a read-only page of your results without signing in, until you turn the link off. It shows figures, your questions and the sites answers read, not the answers themselves or your brand facts.
The tag on your website
AI referrals works through a tag you choose to add to your own website. When someone arrives at your site from an AI assistant, the tag tells us three things: that it is your site, which assistant they came from, and the path of the page they landed on. For a visit from anywhere else it sends nothing. (It also reports when you test it yourself, by opening your site with our test address. A test is recorded as a test and counted as nothing.)
We keep a count for each day, assistant and page, and nothing about the visitor: no IP address, no identifier, no record of the visit itself. The tag sets no cookies and stores nothing on their device, and it never sends the part of an address after the question mark. Its report carries no cookies, and part of a path that looks like a token or an id is left out. Like any request to a website, the report passes through our hosting supplier, whose own short-lived logs include IP addresses.
So that we can tell you whether your tag is working, we also keep two things about your site: when it last sent a test, and the name of the last website it reported from that isn't the one on your account.
The tag sends nothing at all for a visitor whose browser sends a Global Privacy Control signal. We use what it sends only to show you your own report, never for anything of ours.
It is your website, so mentioning the tag in your own privacy notice is yours to do, and so is deciding whether your visitors must agree before it runs. Our installation guide sets out the options.
Who else processes it
We use a small number of suppliers. They process data only on our instructions, except where a line below says otherwise:
- Supabase — the database and sign-in system that stores your account and results (hosted in London).
- Vercel — runs the website itself (served from London).
- OpenAI (ChatGPT) — answers your tracked questions, and analyses the answers from every assistant. Your questions and your brand details are sent to it.
- Google (Gemini) — answers your tracked questions.
- Perplexity — answers your tracked questions.
- DataForSEO — fetches Google's results page, and ChatGPT's and Gemini's own pages, for each tracked question, so we can read the AI Overview, the answers and the product cards on them.
- Web search. The chat assistants search the live web before answering, so we measure what a real person would see. Your questions pass to their search providers.
- Resend — sends the emails you have asked for.
- Cloudflare — runs the security check on the forms for signing in, signing up, resetting or changing a password, and deleting an account, to tell people from bots. Your browser loads it from Cloudflare, which receives your IP address and details of your browser. Cloudflare also uses these to improve the check, and is responsible for that use itself. It also runs our domain's DNS, and passes on email sent to our addresses; it says it does not keep those emails.
- Google (Gmail) — the inbox that email sent to our addresses arrives in.
What reaches the AI providers is the text of your questions — “best car insurance uk” and the like — and, for OpenAI's analysis, your brand details. Your email address and password are never sent to any of them, and none of them may train models on what we send through their paid APIs.
Some of these suppliers may process data outside the UK. Where they do, they rely on the safeguards UK data protection law requires, such as approved contract clauses.
How long we keep it
- The full text of AI answers, and sentences quoted from them: 180 days. That includes the answers to questions about your brand's facts, and the sentences shown for tone, accuracy and changes. After that the text is removed and the counts and analysis it produced are kept, so your history and trends stay intact.
- The pages an assistant read: 180 days, removed at the same time as the answer text. They are evidence about an answer, so keeping them after the answer has gone would leave a claim with nothing behind it. The site-level counts they produced are kept.
- Your account, brand and results: for as long as your account exists.
- A free trial that ends, or a cancelled plan once its paid month ends: checks stop and we keep everything for 30 days so you can pick up where you left off. We email you a week before the end of that, and if you have not chosen a plan by then the account and all its data are erased.
- A new account we decline: nothing runs, and the account and everything in it are erased 30 days after we decide.
- A new account still waiting for our review 30 days after it asked: erased, with everything in it.
- A login on no account, such as one that never finished setting up, or a teammate who has left or been removed: erased 30 days after it was last used.
- Free trial history: 24 months, even after an account is erased — your website's domain, if you gave one, and a one-way hash of your email address, nothing else. A hash can't be turned back into the address; it only tells us the same address has had a trial before.
- A record of what our staff did to an account: 24 months, even after the account is erased. When we change your brand's details for you, it keeps them as they were before and after; when an account is erased, it keeps a note of that by its internal number, with no email address.
- When you delete your account: everything above is erased immediately, apart from free trial history and our staff record, which keep to the periods above. Emails already sent stay in your inbox, and our email supplier keeps its own delivery records for a short period.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data — you can download the whole lot yourself, as a file, from your account page, without asking us;
- correct anything that is wrong;
- delete your data — there is a button for this on your account page;
- stop or limit how we use it, or object to our use of it;
- hand your data to another provider — the same download is the file to give them.
Ask from the Support page, or by email. We answer within one month. If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.
The free trial
A trial account is an ordinary account: it lasts 14 days, needs no card, and holds the same data as a paid one. We review each new account by hand, within one working day, using what you told us when you set it up, and the trial starts when we approve it. If you do not continue, checks stop, the account is paused for 30 days, and then it is erased along with everything in it — or sooner if you delete it yourself.
Changes to this notice
If we change how we use your data, we will update this page and, where the change matters to you, tell you by email.