Who we are
Prominara is an AI search visibility platform: it tracks how AI assistants such as ChatGPT, Perplexity, Gemini and Google’s AI Overviews and AI Mode answer the questions your customers ask, and whether they mention or cite your brand. Prominara is operated by Nicolas Rodriguez Seara, Buenos Aires, Argentina (“Prominara”, “we”, “us”), who is the data controller for the personal data described here.
This policy applies to prominara.com, the Prominara app, the client portal, our free tools and our MCP server, which lets AI assistants such as ChatGPT work with your workspace. It sits alongside our Terms of Service.
Definitions
- Personal data. Information that identifies, or can identify, a person: for example a name, email address, IP address or device identifier.
- Workspace. Your Prominara organization and everything in it: sites, brands, competitors, tracked prompts, results, notes and settings.
- Tracked prompt. A question you ask Prominara to put to AI platforms on a schedule, such as “best accounting software for agencies”.
- Service provider. A company that processes data for us to run Prominara. Section 06 lists them.
- AI assistant connection. Access you grant an outside AI assistant, such as ChatGPT or Claude, to your workspace through our MCP server.
Information we collect
Account and sign-in
Your name, email address and profile picture. App users sign in with an emailed link, Google or GitHub, so we store no password for them; when you use Google or GitHub, we keep the tokens that provider issues for your sign-in. Client-portal users set a password, which we store only as a bcrypt hash.
What you put in your workspace
- Site domains, brand names and descriptions, markets (country and language), competitor names and domains, and brand facts.
- Tracked prompts, notes, mission statuses and the content changes you log (page URL, summary, release date, hypothesis).
- Team members’ emails and roles, invitations, agency client workspace names and client-portal users’ emails.
- Alert destinations you configure, such as a Slack channel or webhook URL.
What we generate for your workspace
- AI answers to your tracked prompts: the answer text, the sources cited, the brands named, position and sentiment.
- Crawls of your public website: page text and HTML, used for audits and to measure content changes.
- Audit scores, factual errors found in AI answers about your brand, prompt suggestions and measurement verdicts.
- Public details of Reddit threads that AI answers cite, including the author’s username, shown in the app.
Prompts and AI answers are business data, but an answer can name a person, such as a founder. Please do not put personal data about others, passwords, payment card numbers, government identifiers or health information into prompts, notes or other fields.
Connected integrations
- Google Search Console and Google Analytics. If you connect them, read-only access to the properties you choose. We store encrypted access tokens and sync search queries, clicks, impressions and positions, and traffic and conversion counts by source and landing page (sessions, users, engagement, key events and visitors who converted), including visits referred by AI assistants. These are totals, not records of individual visitors.
- Bing Webmaster Tools. If you connect it, the API key you paste (stored encrypted) and your site’s search and crawl statistics.
Billing, messages and free tools
- Billing. Lemon Squeezy, our merchant of record, collects your payment details directly. We receive your customer and subscription status, never card numbers.
- Messages. Support and contact messages, and in-app feedback with any screenshots you attach. Demo bookings go through Cal.com.
- Free public checker. The domain you submit and the public content of that site.
Collected automatically
- Usage data. Pages visited and features used, through PostHog, Google Analytics 4 and Vercel Analytics.
- Session recordings. About 10% of browser sessions are recorded with PostHog to find usability problems. A recording shows what was on screen, including workspace data such as prompts and AI answers; text typed into fields is masked.
- Device and log data. IP address, browser, operating system, screen size, referring page and request times.
- Error reports. Errors and server logs, through Sentry, linked to your user id and email.
We do not collect precise location, and we never use your data for advertising.
ChatGPT and other AI assistants
You can connect an AI assistant such as ChatGPT or Claude to your workspace through our MCP server. You sign in to Prominara, choose one organization and approve read access, and write access if you want it. The assistant can then use the tools below for that organization only.
What we store about a connection
The assistant’s name, the organization and permissions you approved, when the connection was created and last used, and one-way hashes of its access tokens (valid for 1 hour) and refresh tokens (valid for 30 days). We never store the tokens themselves. We do not store the IP address or device of a connection in our database; our hosting provider’s request logs and the rate limiter on the sign-in endpoints see the IP address of the assistant’s server.
What the assistant sends us
The inputs of the tool it calls, listed below. ChatGPT may also attach its locale, an approximate location and an anonymous user id to each call; our server does not read, log or store them. We never request or receive your conversation, chat history or memories.
What each tool receives, returns and shares
No tool returns your email, your teammates’ details, passwords or tokens. Results are business data from the organization you connected. AI answer text is third-party content and can name people or companies. “Shared with” lists the outside services a call sends data to, beyond the assistant itself and the hosting and logging providers in section 06.
Tools that read your workspace
List sites
prominara_list_sites- Receives
- An optional result limit.
- Returns
- Your sites: domain, brand name, market (country and language), latest audit score and date, and the number of active prompts.
- Shared with
- Nobody else.
Visibility overview
prominara_visibility_overview- Receives
- Which site (domain or id), the time window and the level of detail.
- Returns
- Mention and citation rates with confidence intervals, per-platform figures, the trend, the leading competitor brands with their share, and sentiment counts. Detailed mode adds your tracked prompt texts with each platform’s latest result.
- Shared with
- Nobody else.
List tracked prompts
prominara_list_prompts- Receives
- Which site, a status filter, optional search text and a limit.
- Returns
- Your tracked prompt texts with their category, panel, platforms, check schedule and the latest result on each platform.
- Shared with
- Nobody else.
Get latest AI answers
prominara_get_answers- Receives
- A prompt id, an optional platform and a limit.
- Returns
- For each platform: whether the brand was mentioned or cited, the source URLs the answer used, the competitor brands it named, position, sentiment and check dates. Detailed mode adds up to 4,000 characters of the AI answer text, which is third-party content and can name people or companies.
- Shared with
- Nobody else.
List missions
prominara_list_missions- Receives
- Which site, filters (priority, status, intent, search text) and paging.
- Returns
- Your tracked prompt texts with their priority, citation rate, the URL of the page on your site that should answer them, the source gap and the suggested next action.
- Shared with
- Nobody else.
Sources intelligence
prominara_sources- Receives
- Which site, the view (domains, cited pages, opportunities or accuracy), paging and optional search text.
- Returns
- Domains and page URLs that AI answers cite and the brands they mention; ranked places to earn a citation, with their impact, feasibility and risk scores, a suggested action plan, the AI platforms citing them, the competitors already there and your own notes; and factual errors found in AI answers about your brand (the claim and what it is about, the correct value from your brand facts, the prompt it appeared in, severity, status and a suggested fix). Usernames from cited Reddit threads and internal account ids are removed.
- Shared with
- Nobody else.
Measurement verdicts
prominara_measurement- Receives
- Which site and an optional change id.
- Returns
- Your logged content changes (summary, type, page URL, release date, page-check status, linked prompt) with their measurement status, verdict, probability and before-and-after figures. The detail of one change adds, per observation window, the changes in citation, recommendation and source rates (overall and per AI platform) with the number of checks behind them, the change in AI-referred visits from your Google Analytics when it is connected, which AI model versions were compared, whether the result held, and how reworded versions of the prompt performed, with the rewordings themselves.
- Shared with
- Nobody else.
Suggest prompts to track
prominara_suggest_prompts- Receives
- Which site and how many suggestions.
- Returns
- Suggested prompt texts with their panel, buying-journey stage, reason and score, plus a recommended set that fits your plan.
- Shared with
- When no cached suggestions exist, OpenAI receives the site’s stored context to draft new ones: domain, brand name, market, industry, topics from your crawled pages, up to 5 competitor names, your existing tracked prompts and, if Google Search Console is connected, up to 10 of its search queries. PostHog keeps a log of that AI request and response. Nothing is saved to your workspace.
Plan and usage
prominara_usage- Receives
- Nothing beyond the connection itself.
- Returns
- Your plan, check allowance used and remaining with the reset date, prompt, site and client-workspace allowances, enabled platforms and trial state.
- Shared with
- Nobody else.
Tools that change your workspace
Create tracked prompts
prominara_create_prompts- Receives
- Which site, 1 to 20 prompt texts and the AI platforms to track them on.
- Returns
- Which prompts were created (id and text), which were skipped and why, whether first checks were queued, and the plan’s platforms and check frequency.
- Shared with
- The first checks, unless the monthly allowance is used up. Each check sends the prompt text, with the site’s market country and language where the platform accepts them, to the AI platforms enabled for it: OpenAI (ChatGPT), Perplexity, Google (Gemini) and DataForSEO (Google AI Overviews and AI Mode), which may search the public web. OpenAI then receives each answer together with your brand name, domain, short brand description, competitor names and brand facts, to detect mentions and factual errors, and the prompt text, to match it to pages on your site. For a site’s newest prompts in its first week, and for prompts linked to a change being measured, checks also send two rewordings of the prompt written by OpenAI and repeat each wording three times. PostHog keeps a log of these AI requests and responses.
Run a check now
prominara_run_check- Receives
- 1 to 10 prompt ids and, optionally, the platforms to check.
- Returns
- Which checks were queued, which prompts were skipped and why, and how much of the check allowance is used.
- Shared with
- Each check sends the prompt text, with the site’s market country and language where the platform accepts them, to the AI platforms enabled for it: OpenAI (ChatGPT), Perplexity, Google (Gemini) and DataForSEO (Google AI Overviews and AI Mode), which may search the public web. OpenAI then receives each answer together with your brand name, domain, short brand description, competitor names and brand facts, to detect mentions and factual errors, and the prompt text, to match it to pages on your site. For a site’s newest prompts in its first week, and for prompts linked to a change being measured, checks also send two rewordings of the prompt written by OpenAI and repeat each wording three times. PostHog keeps a log of these AI requests and responses.
Log a shipped content change
prominara_log_content_change- Receives
- Which site, the URL of the page you changed, a summary (up to 2,000 characters), the release date, the change type and, optionally, a prompt id and a hypothesis (up to 2,000 characters).
- Returns
- The change id, whether it already existed, its release date, page URL and linked prompt.
- Shared with
- Prominara fetches the public page at that URL. When a prompt is linked, while the change is being measured (up to 112 days) its scheduled checks also send the prompt and two rewordings of it (written by OpenAI) to the AI platforms, and up to 8,000 characters of the page text go to OpenAI to extract the page’s key claims. PostHog keeps a log of these AI requests and responses.
Update mission status
prominara_update_mission- Receives
- Which site, a prompt id, the new status and an optional snooze date.
- Returns
- The mission’s new status and snooze date.
- Shared with
- Nobody else.
Enable or disable prompts
prominara_set_prompt_active- Receives
- 1 to 50 prompt ids and whether to turn them on or off.
- Returns
- How many prompts changed, which did not fit the plan or were not found, and the prompt limit.
- Shared with
- Nobody during the call. Prompts turned on are then checked on their schedule. Each check sends the prompt text, with the site’s market country and language where the platform accepts them, to the AI platforms enabled for it: OpenAI (ChatGPT), Perplexity, Google (Gemini) and DataForSEO (Google AI Overviews and AI Mode), which may search the public web. OpenAI then receives each answer together with your brand name, domain, short brand description, competitor names and brand facts, to detect mentions and factual errors, and the prompt text, to match it to pages on your site. For a site’s newest prompts in its first week, and for prompts linked to a change being measured, checks also send two rewordings of the prompt written by OpenAI and repeat each wording three times. PostHog keeps a log of these AI requests and responses.
Logged for every call
The tool name, whether it succeeded, how long it took, your user and organization ids, plan, the site involved, the assistant’s name and result counts. These go to Sentry (up to 90 days) and PostHog (up to 12 months). Prompt and answer text are not part of these call logs. Calls are rate-limited per connection through Upstash, whose counters expire within 24 hours.
Your controls
See and revoke every connection under Settings, Connected agents. Revoking deletes its tokens at once and takes effect on the assistant’s next call. Removing a member or deleting your account also ends their connections. Tool results already shown in a ChatGPT conversation are kept by OpenAI under OpenAI’s own privacy policy; we cannot delete them there.
How we use your information
- Run the service: put your tracked prompts to AI platforms, analyse the answers, crawl and audit your pages, measure content changes and show the results in the app, reports, emails and connected AI assistants.
- Suggest prompts, write action plans and detect factual errors about your brand, using AI models.
- Keep a copy of the AI answers we collect to improve the accuracy of our analysis, and produce aggregated statistics that do not identify you, your brand or your prompts. We do not sell this data or give it to third parties to train their models.
- Bill your subscription and send account, report and alert emails.
- Answer support requests and fix bugs, using error reports, logs and session recordings.
- Understand how the product is used, so we can improve it.
- Prevent abuse: rate limiting, fraud checks and one free trial per person and domain.
Legal bases (GDPR)
- Contract. Running the service you signed up for, including checks, analysis, reports and AI assistant tools.
- Legitimate interest. Analytics, session recordings, error monitoring, security, abuse prevention and improving our analysis.
- Consent. Optional emails such as newsletters, and integrations you choose to connect. You can withdraw it at any time.
- Legal obligation. Tax and accounting records, and lawful requests from authorities.
Who receives your data
We do not sell personal data or share it for advertising. These service providers process data for us, only to run Prominara. The AI platforms we query never receive your name or email.
| Recipient | Purpose | What they receive |
|---|---|---|
| Vercel | Hosting and website analytics | Every request to prominara.com, including IP address and browser details. Its web analytics use no cookies. |
| Supabase | Database | All account and workspace data described in this policy. |
| Inngest | Background jobs | Job inputs and outputs: prompt texts, brand name and domain, AI answers, page URLs and page content being checked, report recipients, and feedback with your email. |
| Upstash | Rate limiting | Short-lived counters keyed by IP address, user or connection id, and the email used in a client-portal sign-in attempt. |
| OpenAI | ChatGPT answers and AI analysis | Tracked prompt texts with market country and language; AI answers with your brand name, domain, short description and competitor names; text from your pages; your drafts in the content editor; for prompt suggestions, your site context, existing prompts and up to 10 Google Search Console queries; and your Search Console and Bing queries, to group them into topics. If we move a feature to Anthropic models, Anthropic receives the same data for that feature. |
| Perplexity | Perplexity answers and research | Tracked prompt texts with market country and language; for mission research, the prompt with your brand name, domain and description. |
| Google (Gemini API) | Gemini answers | Tracked prompt texts, with the market country and language when set. |
| DataForSEO | Google AI Overviews and AI Mode results, prompt discovery | Tracked prompt texts with location and language; your domain, to find prompts AI answers already mention it for. |
| Jina AI | Page reading fallback | The URL of a public page when our own crawler is blocked. |
| Google (Chrome UX Report) | Public page-speed data | Your website’s address. |
| PostHog (US) | Product analytics, session recordings, AI request logs | Your user id, name, email, plan and organization name; usage events and IP address; recordings of about 10% of sessions, with typed text masked; and the full text of AI requests and responses made for your workspace. |
| Google Analytics 4 | Website and conversion analytics | Cookies, pages visited, your internal user id and plan tier, and sign-up, onboarding and purchase events sent from our servers. Google signals and ad personalization are turned off, and it is not linked to any advertising account. |
| Sentry | Error reports and server logs | Your user id and email, error details, and log lines with ids, tool names and counts. Logs and error reports from AI checks can include up to the first 200 characters of a prompt and your brand name. |
| Resend | Email delivery | Your email address, name and the content of the emails we send you. |
| Lemon Squeezy | Payments (merchant of record) | Your email, organization id and Google Analytics visit ids at checkout. You give your card details to Lemon Squeezy directly; we never see them. |
| Cloudflare R2 | File storage | Screenshots you attach to feedback. |
| GitHub | Sign-in and feedback tracking | If you sign in with GitHub, your GitHub profile. Feedback becomes a ticket with your description, a partly masked email, the page URL, browser details and screenshot links. |
| Sign-in and integrations | If you sign in with Google, your Google profile. If you connect Search Console or Analytics, read-only API requests for the properties you chose. | |
| Microsoft (Bing Webmaster Tools) | Bing integration | If you connect Bing, API requests for your site, made with the key you provided. |
| Cal.com | Demo booking | What you type into the booking form. |
Under their API terms, OpenAI, Perplexity and Google do not train their models on data we send them.
Separately, when we contact businesses about Prominara, we process business contact details (name, work email, company and public profile) from public sources. We verify addresses with ZeroBounce, send through Gmail, and research companies with OpenAI and DataForSEO. Anyone we contact can ask us to stop and delete their details by replying or emailing contact@prominara.com.
We also share data where you direct it: your teammates and the client-portal users you invite, alert destinations you set up, and AI assistants you connect. We disclose data when the law requires it, to protect our rights or users’ safety, or to a buyer if Prominara is sold, under this policy.
Data security
- Encryption. Data is encrypted in transit with TLS and at rest with AES-256 in our database.
- Secrets. Search Console, Analytics and Bing credentials are encrypted with AES-256-GCM before storage. AI assistant tokens are stored only as one-way hashes.
- Access. Every request is checked against your organization and role, and every user-facing API route is rate-limited.
- Logging. API keys and tokens are kept out of our logs and scrubbed from server error reports.
Data retention
| Data | How long we keep it |
|---|---|
| Account, sites, prompts, competitors, brand facts, notes, logged changes and mission statuses | Kept while your account exists. You can delete prompts; removing a site or brand fact hides it and keeps it. Deleting your account deletes all of it immediately for organizations you alone own with no other members; an organization with other members stays with them. |
| AI answers and check results | Shown for your plan’s history window (Starter 3 months, Pro 12 months, Agency 24 months). Older results are archived, hidden from the app, and kept until you delete the prompt or your account. |
| Copy of AI answers kept to improve our analysis | Archived (hidden, not deleted) after 180 days; deleted with the prompt or your account. |
| Removed sites | Removing a site archives it with its history. Synced Search Console, Analytics and Bing data for it is deleted at once; the rest goes with your account, or sooner on request. |
| Crawled page content | Full page text from crawls older than 90 days is archived (hidden, not deleted), except the site’s 10 latest crawls; deleted with your account. |
| Synced Search Console, Analytics and Bing data | Until you remove the site or delete your account. While an integration is connected, daily Search Console query rows older than 90 days and daily Bing rows older than 400 days are deleted at each sync. Disconnecting stops syncing and revokes our Google access but keeps data already synced. |
| AI assistant connections | Access tokens expire after 1 hour and refresh tokens after 30 days; expired tokens are deleted 7 days later, and revoking deletes them at once. The connection record (assistant name, permissions, dates) is kept until you delete your account. |
| Free public scans | Kept until you ask us to delete them. |
| Feedback and support messages | Kept, with your email, until you ask us to delete them; account deletion does not remove them. |
| Free-trial record | A one-way hash of your email, and the domains your organization added, kept after account deletion to prevent repeat trials. |
| Analytics events and AI request logs (PostHog) | Up to 12 months. |
| Session recordings (PostHog) | 30 days. |
| Error reports and server logs (Sentry, Vercel) | Up to 90 days. |
| Background job records (Inngest) | 7 days. |
| Rate-limit counters (Upstash) | Up to 24 hours. |
| Data held by AI providers | Kept by each provider under its API terms for abuse monitoring, typically up to 30 days (up to 55 days for Google). |
| Payment records | Held by Lemon Squeezy as merchant of record, for as long as tax law requires. |
Your controls and rights
Controls in the app
- Delete your account. Settings, Danger zone. Deletion is immediate and removes your user and every organization you alone own with no other members. If you are the only owner of an organization that has other members, transfer ownership or remove them first. If you have a paid subscription, cancel it under Settings, Billing first; deleting your account does not cancel billing at Lemon Squeezy.
- Delete prompts. Owners and admins can delete a prompt, which deletes its results and stored answers. Accuracy findings drawn from those answers, which include the prompt text, stay until you delete your account.
- Sites and brand facts. Removing a site or a brand fact hides it and keeps its history. Email us to delete it fully.
- After a trial ends. Without a subscription the app shows only the Plans and Billing pages, so these controls are out of reach. Email us and we will delete your account or any of its data.
- AI assistant connections. Settings, Connected agents: see and revoke each one.
- Integrations. Disconnect Search Console, Analytics or Bing from the site’s Integrations page.
- Emails. Settings, Notifications: turn emails off or change the digest frequency.
- Team. Leave an organization, or remove members if you manage the team.
- Export. Download Share of Voice data as CSV, JSON or PDF, and reports as PDF. For a full export, email us.
Your rights
Wherever you live, you can ask us to access, correct, delete, restrict or export your personal data, object to processing based on legitimate interest, or withdraw consent. California residents also have the right to know, delete and correct, and to non-discrimination; we do not sell or share personal data for cross-context behavioral advertising. Email contact@prominara.com. We reply within 30 days. You may also complain to your data protection authority.
International data transfers
Prominara is operated from Argentina, and our data is hosted in the United States by Vercel and Supabase. Most service providers in section 06 also process data in the United States. We rely on their data processing agreements, including standard contractual clauses where required, for transfers out of your country.
Children’s privacy
Prominara is a business service and is not meant for anyone under 16. We do not knowingly collect their data, and we delete it if we find we have.
Changes to this policy
We update this policy when our practices change; the date at the top shows the latest version. Section 04 is generated from the same tool list our MCP server serves, and we update each tool’s description there whenever its inputs, results or data sharing change. We will tell you by email or in the app at least 30 days before a change that reduces your rights.
Frequently asked
01Does Prominara sell personal data to third parties?
No. Prominara does not sell personal data or share it for targeted advertising. We share data only with the service providers listed in this policy, and only to run the service.
02How long does Prominara retain my data?
Account and workspace data stays until you delete it or your account. Check results older than your plan’s history window are archived and kept until you delete the prompt or your account. Analytics records expire within 12 months, session recordings within 30 days and error logs within 90 days. The data retention section has the full table.
03Is Prominara GDPR compliant?
We give every user, wherever they live, the rights the GDPR provides: access, correction, erasure, restriction, portability and objection. Email contact@prominara.com to use them. We do not show a cookie banner; the cookies section explains which analytics tools load and how to block them.
04What happens to my data if I delete my account?
Deletion is immediate. It removes your user and every organization where you are the only member, with its sites, prompts, check results, integrations and AI assistant connections; an organization with other members stays with them. A few records remain: feedback you sent us, a one-way hash of your email that prevents repeat free trials, and copies in our analytics and error logs until they expire. Billing records stay with Lemon Squeezy, so cancel a paid subscription first.
05Does Prominara use AI to process my data?
Yes. Checks send your tracked prompts to OpenAI, Perplexity, Google Gemini and DataForSEO, and we use OpenAI models to analyse answers, pages and prompt suggestions. The data sharing section lists what each provider receives. Under their API terms, OpenAI, Perplexity and Google do not train their models on this data. PostHog keeps a log of these AI requests and responses for up to 12 months so we can debug them.
Contact us
- Data controller. Nicolas Rodriguez Seara, operating Prominara
- Email. contact@prominara.com
- Address. Buenos Aires, Argentina
See also our Terms of Service and Documentation.