Legal
Privacy Policy
Effective 16 August 2026 · NXT LVL AI
The data controller for the personal data described here is NXT LVL AI. This page says what we collect, why, who else sees it, how long we keep it, and how to get it deleted.
What we collect
Account data — your email address, the workspace name, and the times you signed in (with the IP address and browser of the sign-in, kept for security).
What you ask us to analyse — the website addresses you nominate, the prompts in your set, the languages and market you choose, and any competitor or location you enter.
What the service produces — the pages we crawled from the site you nominated, the answers the AI models gave, and the reports built from them.
Billing data — your plan, what you were charged and when. Card numbers never reach us: they are entered on Paddle's payment form and we only ever see the outcome and the customer identifier.
Technical data — server logs and error reports needed to keep the service running and secure.
Why we use it, and on what basis
To provide the service you asked for and to bill it (performance of our contract with you); to keep it secure, prevent abuse, and improve it (our legitimate interests); and to meet tax and accounting obligations (legal obligation). We send you the emails the service needs — sign-in links, run results, billing notices. Marketing email is only ever sent with your consent and every one of them can be unsubscribed in one click.
We do not sell your personal data, and we do not use your reports to advertise to you.
What we send to AI providers
This is the part worth reading. To measure AI visibility, the prompts in your set are sent to the AI providers listed below, together with whatever context the prompt contains — normally a market, a language and a product category, not personal data. The answers come back to us and are stored in your report.
The prompts are questions a shopper might ask (“best X in Y”), not your business documents. Do not put personal data, customer records or confidential material into a prompt or a site address: it leaves our systems for the providers below, and once a provider has received it we cannot recall it.
We crawl the public pages of the site you nominate — the same pages any visitor or search engine can reach. We do not log in to anything and we do not crawl pages behind a password.
Who else sees your data
We use the processors below to run the service. Each one only receives what it needs for its job, and each is bound to protect it.
| Provider | What it does | Where |
|---|---|---|
| Paddle.com Market Ltd | Payments, invoicing and sales tax — the Merchant of Record | United Kingdom / EU |
| OpenAI | Answers a tracked prompt as the GPT model family | United States |
| Google (Gemini) | Answers a tracked prompt as the Gemini model family | United States / EU |
| Perplexity | Answers a tracked prompt as the Perplexity model family | United States |
| OpenRouter | Routes prompts to add-on model families (Claude, Grok, DeepSeek and others) | United States |
| DataForSEO, Serper, Ahrefs | Search-result and keyword data used to build and rank prompts | United States / EU |
| Firecrawl | Fallback page fetching when a tracked site blocks our own crawler | United States |
| Resend | Sends sign-in links and account email | United States / EU |
| Cloudflare | DNS, CDN and protection for the website | Global |
| Hetzner Online GmbH | Hosting — where the application and database run | Germany |
Some of these are outside the European Economic Area. Where that is so, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision. We also disclose data if the law requires it, and we would tell you unless we are forbidden to.
Where it is stored, and for how long
The application and its database run on servers in Germany, operated by Hetzner Online GmbH. Data is encrypted in transit; access is limited to the people who operate the service.
We keep your account and reports for as long as your workspace is open, because the value of this product is the trend over time — a report deleted after a month takes the comparison with it.
To have it all removed, email [email protected] from the address on the account. We delete the account, its sites and its reports within 30 days, apart from the records we are required to keep for tax and accounting. Sign-in security records stay for as long as the account is open, so that a sign-in you do not recognise can still be looked into.
Cookies
Only the cookies the service cannot work without: the ones that keep you signed in and carry you through the sign-in handshake (authjs.session-token, authjs.callback-url, and short-lived sign-in cookies that expire in 15 minutes).
Your light-or-dark preference is not a cookie at all — it is kept in your browser's own storage and never sent to us. There are no advertising cookies, no analytics cookies and no third-party trackers on this site, which is also why you are not being asked to dismiss a consent banner.
Your rights
You can ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, or take it elsewhere in a portable form. Email [email protected] and we will answer within 30 days. If you are in the EEA or UK and think we have got it wrong, you can complain to your local data protection authority.
The service is not intended for children and we do not knowingly collect their data.
Changes and contact
If we change this policy we update the date at the top and, for material changes, tell you by email before they take effect.
NXT LVL AI
United Arab Emirates
[email protected]
See also our Terms of Service and Refund Policy.