Privacy Policy — AIScore by UpSites
Last updated: September 29, 2026
This Policy describes how UpSites processes personal data in connection with AIScore (aiscore.upsites.digital). For users in the European Economic Area and the United Kingdom, processing is carried out in accordance with the General Data Protection Regulation (GDPR) and the UK GDPR, as applicable.
1. Controller
UPSITES DESENVOLVIMENTO DE SITES LTDA, a Brazilian company registered under CNPJ 25.139.884/0001-90, Rua José Versolato, 111, Bloco B, Sala 3319, Centro, 09750-730, São Bernardo do Campo, SP, Brazil.
Data protection contact: comercial@upsites.digital.
2. Data we process
Data you provide: e-mail address, name and language, submitted when requesting a diagnostic; an optional phone number, stored in full international format together with the country derived from it; and any free-text notes you write when requesting corrections. Providing your e-mail address is necessary to deliver the report; without it, the service cannot be provided.
Data collected automatically: the address of the analyzed website, the dates of first and last contact, the number of diagnostics requested, a visit identifier, the referring domain you arrived from, a cryptographic fingerprint of your browser (the text description is not stored), campaign parameters (utm) when present in the request, identifiers linking your record to our CRM, and a hashed identifier derived from your e-mail address.
IP address: we never store your full IP address. We retain only an aggregated network block (/24 for IPv4, /64 for IPv6), used for rate limiting, recording the origin of diagnostics and opt-ins, and auditing verification operations. The full address is read only during the request and submitted to Cloudflare Turnstile for anti-bot verification (Section 5); it is not written to our systems or technical logs.
Marketing opt-in records: if you ticked the optional marketing checkbox offered on the diagnostic form until September 28, 2026, we keep the date, the version of the text accepted, the language and the network block.
We do not collect postal addresses, government identifiers or payment data.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Running the diagnostic, delivering the report by e-mail and following up on corrections you request | Performance of a contract, Art. 6(1)(b) |
| Contacting you about the diagnostic and UpSites services, by e-mail and, if you provide a phone number, by phone and WhatsApp, including recording in our sales tools | Legitimate interests, Art. 6(1)(f): following up on the diagnostic you requested, disclosed prominently on the diagnostic form |
| Fraud and abuse prevention, rate limiting | Legitimate interests, Art. 6(1)(f): protecting the security and integrity of the service |
| Keeping records of consent and complying with legal obligations | Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f): establishing and defending legal claims |
This contact is part of the free diagnostic and is disclosed prominently on the form, before submission. You have the right to object to it at any time, free of charge (Art. 21(2) and (3) GDPR): the unsubscribe link in our marketing e-mails stops them, and a request through the channels in Section 8 also stops contact through our sales tools. Objecting does not affect the diagnostic or the e-mails required to provide it, such as the access code.
If you opted in to marketing communications before September 28, 2026, you receive them on the basis of that consent (Art. 6(1)(a)), which you may withdraw by the same means. Withdrawal does not affect the lawfulness of processing carried out before it.
Anonymized or aggregated data that can no longer be linked to an identifiable individual is not personal data and may be used for statistics, market studies and product improvement.
4. Cookies
We use five cookies, all first-party, scoped to the tool's own host and strictly necessary for its operation: a language preference (1 year), a visit identifier (1 year), a session cookie for accessing your results (7 days), an internal staff session (12 hours) and a temporary staff login state (10 minutes), the last two applicable to UpSites personnel only. All are set with the HttpOnly, Secure and SameSite=Lax attributes.
Pages containing forms load Cloudflare Turnstile, an anti-bot verification served from challenges.cloudflare.com, which receives your IP address and browser signals during the challenge and may set strictly necessary verification cookies of its own.
We do not use advertising cookies, third-party analytics or social media pixels. All cookies used, including any verification cookies set by Turnstile, are strictly necessary for the operation and security of the service and are therefore exempt from consent requirements.
5. Recipients
We do not sell personal data. Personal data is shared only with providers necessary to operate the service.
Processors handling your record:
| Processor | Purpose | Location |
|---|---|---|
| Railway | Application and database hosting | USA |
| Resend | Transactional e-mail delivery | USA |
| Cloudflare (Turnstile) | Anti-bot verification during the request | Global |
| Ploomes | Customer relationship management | Brazil |
Measurement providers, which receive content of the analyzed website and never your record:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic | Generating measurement questions and classifying answers | USA |
| OpenAI, Google (Gemini), Perplexity | Running the measurement questions | USA |
| DataForSEO | Collecting Google AI Overview results for the measurement | USA |
| Firecrawl | Extracting and rendering pages of the analyzed website | USA |
We do not send your name, e-mail address or phone number to the measurement providers. What each one receives: Firecrawl receives the full address of the analyzed page, including path and parameters, with only campaign parameters removed; Anthropic receives public elements of the analyzed website (title, description, headings, structured data, the organization name and location declared on the site, and limited excerpts of the main text) and the answers returned by the engines, for classification; OpenAI, Google (Gemini), Perplexity and DataForSEO receive only the text of each question and the target market country.
Public content of the analyzed website that happens to contain personal data may be transmitted within this flow. Responsibility for the submitted URL, including any parameters it contains, lies with the person who submits it (Terms of Use, Section 3).
Personal data may also be disclosed where required by law, court order or a request from a competent authority.
6. International transfers
UpSites is established in Brazil, and some providers are located in the United States. Where personal data of EEA or UK users is transferred to processors outside those territories, we rely on appropriate safeguards under Chapter V of the GDPR, including Standard Contractual Clauses and, where applicable, EU-U.S. Data Privacy Framework certifications held by the processor.
7. Retention
| Data | Period |
|---|---|
| Lead record | 24 months after last contact |
| Diagnostics | Anonymized after 12 months; only non-identifying site data is retained: domain, score, band and date |
| Raw AI search engine responses | 30 days |
| Response text | 90 days |
| Citation measurements and events | 12 months |
| Network block in event records | 90 days |
Retention periods are enforced automatically. Upon expiry, data is permanently deleted or anonymized. Administrative audit records, which contain only cryptographic identifiers and not the data itself, are kept as evidence of compliance. Retention may be extended where storage is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
8. Your rights
Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, including the contact described in Section 3, and withdrawal of consent at any time.
Erasure can be performed directly at /en/privacy/delete, upon confirmation via a code sent to your registered e-mail address. All other requests should be sent to comercial@upsites.digital and will be answered within the deadlines set by applicable law. You also have the right to lodge a complaint with a supervisory authority in your place of residence, work or of the alleged infringement.
The diagnostic score relates to the analyzed website, not to you as an individual, and does not produce legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR.
9. Security
We apply technical and organizational measures appropriate to the nature of the data processed, including encryption in transit, restricted access controls and individualized logging of administrative access to personal data. No system is infallible; personal data breaches will be handled and notified as required by applicable law.
10. Children
The tool is intended for professional use by individuals aged 18 or older. We do not knowingly collect data from children.
11. Changes
This Policy may be updated at any time by publishing the current version on this page, with the date of the update indicated above.