Privacy Policy

Last updated 16 October 2026

This policy explains what personal data Teddit keeps and why. The controller is Sole proprietor (FOP) Ivan Mykolaiovych Dakhin, registered in Dnipro, Ukraine. Write to hello@teddit.io for anything below.

What we keep

  • Your account: name, email address, a profile picture if you upload one, a hash of your password (never the password itself), whether you confirmed your email, and the workspaces you belong to with your role.
  • Your workspace: the sites, prompts, competitors and brand names you enter, the AI answers each scan collects, the scan history and its cost, and the balance movements.
  • Sign-ins: for each active session, the browser’s user agent, the IP address, and when it started and ends. API keys are stored only as a hash.
  • Payments: handled entirely by Paddle. We receive the amount, the date and a transaction reference, never card details.
  • Businesses we contact about Teddit: the business details a company publishes itself (its name, website, business email, phone, LinkedIn page and the director named in its imprint) and its listing on Google Maps, with where each came from, and what was written to it and answered.

Why

  • To provide the service you signed up for: run scans, show the results, keep your balance (contract).
  • To keep accounts secure and stop abuse (legitimate interest).
  • To send the emails the service needs: confirming your address, invitations, password resets, monthly statements to owners and admins, and the weekly summary, which you can switch off under Account (contract and consent).
  • To keep accounting records of payments as the law requires (legal obligation).
  • To offer our service to businesses whose work it fits, by an occasional business email or a LinkedIn message, each with a way to say no that we honour for good (legitimate interest). In countries where a business email needs prior consent, we use LinkedIn or the company’s contact form instead.

We do not sell personal data, show ads, or use advertising or analytics trackers.

Who processes it for us

  • Paddle (payments; merchant of record).
  • AI providers — OpenAI, Anthropic, Perplexity and Google: they receive the text of your prompts with the language and location set for the site, to answer them. Do not put personal data in prompts.
  • Our search data provider, which reads Google’s AI answers and the ChatGPT and Gemini app answers for your prompts, and Google’s results for the searches the assistants ran: it receives the text of those prompts and searches with the site’s language and location.
  • Our hosting provider, where the service and its database run, and our email delivery provider, which sends the service’s emails.

Some of them are outside your country, including in the United States; transfers rely on the providers’ standard contractual safeguards.

Cookies and storage

Teddit sets one cookie, the session cookie that keeps you signed in. The app also remembers a few preferences in your browser (the colour theme, the last site and period you looked at). There are no tracking cookies. Visits to the site are counted with Umami, run on our own server: it sets no cookies and keeps no personal data, only the page, the referring site, the country and the kind of device. Requests from crawlers and AI bots (those whose browser name says so) are logged by our web server with the address asked for, the time, the bot’s name and a shortened IP address; people’s visits are not. The payment form is Paddle’s, and sets Paddle’s own cookies under Paddle’s privacy policy.

How long

  • Account and workspace data: while the account or workspace exists. What you delete (an account, a workspace, a site, prompts) is kept for 30 days, so it can be restored if it was deleted by mistake, and then erased for good; write to us to have it erased sooner.
  • Sessions: until you sign out, or at most 30 days after you last used them (12 hours without “Stay signed in”).
  • Payment records: as long as accounting law requires, even after the account is closed.
  • Crawler and bot request logs: 90 days.
  • Business contacts: while the conversation is useful, at most two years after the last contact; a business that asks not to be contacted is kept only as that, so it is never written to again.

Your rights

You can see, correct and export your data in the app, and ask us for a copy, for correction, for deletion, or to stop a processing; you can also complain to your data protection authority. We answer within 30 days.

See also: Terms of Service · Privacy Policy · Refund Policy. Questions: hello@teddit.io.