How does an AI visibility measurement provider handle GDPR?
An AI visibility measurement works on public data: the buyer questions you agree with us, the answers AI services give to them and the public pages of your website and your competitors. We process personal data only to run your account: the sign-in details of portal users, stored with Supabase in Frankfurt, Germany, and billing details through Stripe, both to perform our contract with you (Art. 6(1)(b) GDPR). A data processing agreement is available on request.
Published 14 November 2026 · By Balázs Turán
Which data does the measurement use?
The measurement uses data that is public or that you choose to share with us:
- →Buyer questions. The question set you approve, in each market language.
- →AI answers. What ChatGPT, Claude, Gemini and Google AI Overviews answer to those questions, with the date and the sources they cite.
- →Public web pages. Your pages and the pages the answers cite, read the way an AI crawler reads them.
- →Search Console data. Read-only access, only where it is part of the agreed analysis.
- →Voice of Customer. Public comments from YouTube, Reddit and forums about your brand and your category. We store the text of the comment and never the name or handle of the person who wrote it. A comment can still mention a person by name; we use it only to understand what people say about your brand and your category.
We do not need your customer data, your CRM or access to your CMS.
Where is the data processed, and on which legal basis?
| Data | Where it is processed | Legal basis |
|---|---|---|
| Portal sign-in: name, email address, profile picture (Google sign-in), account identifier | Supabase, Frankfurt, Germany | Performance of a contract, Art. 6(1)(b) GDPR |
| Measurement results, recorded answers and recommendations | Supabase, Frankfurt, Germany | Performance of a contract, Art. 6(1)(b) GDPR |
| Buyer questions and public pages sent for measurement | DataForSEO and Anthropic | Not applicable: no personal data is sent |
| Search Console data, read-only | Performance of a contract, Art. 6(1)(b) GDPR | |
| Payment and invoices | Stripe | Performance of a contract and legal obligations, Art. 6(1)(b) and (c) GDPR |
The other services we use, such as website hosting, email delivery and call booking, are listed in our Privacy Policy. Where data leaves the European Economic Area, we use Standard Contractual Clauses.
What can your data protection team ask for?
- →A data processing agreement. We prepare one on request, before the work starts.
- →The list of services. Which services process which data, as in the table above.
- →Access, correction and deletion. For portal users, we delete sign-in data within 30 days after the account is closed, unless the law requires us to keep it.
Contact
Send data protection questions to turan@creative-data-engineers.com or book a call.
This page describes how our service works. It is no legal advice; your data protection officer decides what your company needs.
Questions data protection teams ask
Do you process personal data of our customers?
No. The measurement uses buyer questions, AI answers, public web pages and, where agreed, read-only Search Console data. It does not use your customer data.
Where is the data stored?
Portal sign-in data and measurement results are stored with Supabase in Frankfurt, Germany.
Do we need a data processing agreement?
Your data protection officer decides that. We provide one on request.
Does Voice of Customer collect personal data?
Only what people write in public comments. We collect public comments from YouTube, Reddit and forums and store the text, never the name or handle of the author.
Do you need access to our CMS?
No. Your team or agency publishes the recommended changes.
Questions about your setup
Tell us your markets and your data protection requirements, and we answer before you start.
Related guides: What buyers should know about AI search visibility services · What an AI visibility service costs for five markets