Privacy policy.

1. Who We Are

SpyGlow is an AI-powered competitive intelligence platform operated at spyglow.com. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and service. For privacy inquiries, contact Click to show email.

2. What We Collect

We collect the following categories of data:

Account Information:

• Email address and name (provided at registration)
• Password hash (only for users who register with email and password; not applicable to Google or email code sign-in)
• Temporary verification codes used during sign-in, deleted after use or expiry
• Company name, domain, and business profile information
• Role and business stage (provided during onboarding)

Service Data:

• Competitor websites, keywords, and monitoring configurations you provide
• Public competitor page content, source URLs, capture timestamps, and change history generated from pages you configure for monitoring
• AI-generated reports, battle cards, insights, and analysis results
• AskGlow conversation history
• SEO audit results, content gap analyses, and keyword research data

Website Tools:

• The web address you submit and the result the tool produced (a screenshot, a list of pages, or a pricing table). Without an account, we drop the query string from the address we keep.
• Without an account: a random visitor id kept in the sg_tool_vid cookie, and a keyed hash of your network (the first three parts of an IPv4 address, or the first four groups of an IPv6 address). We use them for the daily free-run limit, for showing you your own results, and to stop misuse. The tools do not store your IP address itself.
• If you report a result: the reason you choose and any details you write.

Technical Data:

• IP address
• Browser type and version
• Device information
• Pages visited and features used within the dashboard
• Error logs and performance metrics

Payment Data:

Billing information is processed and stored by Lemon Squeezy, our payment provider and merchant of record. We do not store your full credit card details on our servers. Before September 2026 payments were processed by Dodo Payments, which still holds the billing records created while it was in use.

3. How We Use Your Data

We use your data to:

• Provide and operate the SpyGlow service, including AI-powered monitoring and analysis
• Process your queries through AI models to generate competitive intelligence
• Send transactional emails (account verification, OTP codes, password resets, alerts, digest reports)
• Process subscription payments
• Monitor service health and fix technical issues
• Improve the Service based on aggregated, anonymized usage patterns

We do not use your data to:

• Train public AI models
• Sell or rent your personal information to third parties
• Share your competitor monitoring lists or strategic insights with other users
• Send marketing emails without your consent

4. AI & Data Processing

SpyGlow uses third-party Large Language Models (LLMs) to analyze public competitor data and generate insights.

• When you use AskGlow, Content Generation, Battle Cards, the Pricing page to table tool, or other AI features, your queries and relevant context are sent to AI providers (Anthropic, OpenAI, Perplexity AI, Google Gemini) for processing.
• Under our agreements with these providers, they do not use your data to train their models.
• AI-generated insights are private to your account.
• AI context data may be temporarily cached in memory to improve performance and is cleared when the session ends or the cache reaches capacity.

5. Data Sharing & Subprocessors

We share data with the following third-party service providers solely to operate the Service:

Our database (MongoDB) and job queue (Redis) run on the same virtual private server as the application, not on a separate database service.

We do not sell your personal information to any third party.

6. Cookies & Local Storage

SpyGlow uses cookies and browser local storage:

Essential cookies:

• Authentication cookies: To keep you logged in and maintain your session. These are essential for the Service to function.
• Interface preference: A cookie remembers whether the dashboard sidebar is open or collapsed.
• Website tools visitor cookie (sg_tool_vid): When you use a website tool without an account, a first-party cookie holds a random id for one year. It counts your free runs for the day and lets you see your own results. It holds nothing else.

Bot check:

• Cloudflare Turnstile:Before a visitor without an account runs a website tool, Cloudflare Turnstile checks that a person is using the browser. Cloudflare receives your IP address and browser and device signals for that check, under its own privacy policy. A passed check is kept for up to 30 minutes in this browser tab's session storage, so you are not asked again on every run.

Analytics and advertising cookies:

• Google Analytics: In production, every page of www.spyglow.com, including the signed-in dashboard, loads Google's tag (gtag.js) for Google Analytics 4. We use it to measure site traffic and which pages and features people use. Google sets its own cookies and receives the pages you visit, your IP address, and browser and device information. We do not send your name or email address to Google Analytics.
• Google Ads: The same tag loads the Google Ads tag, which we use to measure whether our ads lead to sign-ups and paid upgrades (ad conversion measurement). It also sets Google cookies.
• Ad attribution cookie: When you arrive through an ad or a link with campaign tags, we store the ad click identifier (such as gclid), the campaign parameters (utm tags), the landing page, and the referring page in a first-party cookie for up to 90 days. If you create an account, these are saved with it, so a paid upgrade that followed an ad click can be reported to Google Ads.

Embedded scheduling:

• Calendly: The Book a demo page embeds Calendly, which sets its own cookies and receives the details you enter to book a call.

Local Storage:

• Preferences: Theme selection, onboarding progress, and UI settings are stored in your browser's local storage. This data is not transmitted to our servers.

Your choices:

• You can block or delete cookies in your browser settings. Blocking the authentication cookies will prevent you from signing in.
• To stop Google Analytics from collecting data in your browser, install the Google Analytics Opt-out Browser Add-on.

7. Data Retention

• Account data: Retained for as long as your account is active.
• Competitive intelligence data: Monitoring history, reports, and AI-generated insights are retained while your account is active.
• AskGlow conversations: Retained while your account is active.
• Website tool results:Results for visitors without an account expire after 24 hours. Signed-in results expire at the end of the plan's tool history period (7, 30 or 90 days). Expired results are deleted at the next daily cleanup. The record of each run, without the result, is deleted 30 days after the result expires.
• Technical logs: Retained for up to 90 days for debugging and security purposes.
• After account deletion: All personal data and associated competitive intelligence data will be deleted within 30 days of account deletion, except where retention is required by law.

8. Your Rights

Depending on your location, you may have the following rights:

For all users:

• Access and export: Download a copy of your data at any time from Account settings, under Your data. The download is a JSON file with your profile and the competitive intelligence data in your account.
• Correction: Request correction of inaccurate personal data.
• Deletion:Delete your account at any time from Account settings. Any paid subscription is cancelled first. Your account data is deleted at that point; billing records and security audit logs are kept where accounting, tax or security obligations require it. If you are a member of a team, data you added to the team stays with the team. A team owner must first remove the team's other members.

For EU/EEA users (GDPR):

• Legal basis: We process your data based on: (a) contractual necessity to provide the Service, (b) legitimate interest to improve the Service, and (c) your consent where applicable.
• Data transfers: Your data may be transferred to and processed in countries outside the EU/EEA (including the United States) where our subprocessors operate. We rely on our subprocessors' own compliance programs and data processing terms to ensure adequate protection.
• Right to object: You may object to processing based on legitimate interest.
• Right to restrict: You may request restriction of processing in certain circumstances.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

For California users (CCPA/CPRA):

• Right to know: You may request details about the categories and specific pieces of personal information we collect.
• Right to delete: You may request deletion of your personal information.
• No sale of data: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

You can export or delete your data yourself from Account settings. To exercise any other right, or if you cannot sign in, contact us at Click to show email.

9. Children's Privacy

SpyGlow is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from someone under 18, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy as our service evolves. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Privacy questions? Email Click to show email.

For general support: Click to show email.