Privacy Policy
Last updated October 19, 2026
Krawfly ("we", "us") is an AI visibility platform for e-commerce. This policy explains what personal data we process when you visit krawfly.com, use our free tools, the dashboard (dashboard.krawfly.com), Krawfly Edge or the Krawfly app for Shopify, and the choices you have.
Data controller: Christian Tufano · [email protected]
1. Data we collect
Dashboard accounts: name, email, password (stored salted and hashed), login codes, sessions and team members of your workspace. Customer content: the catalogs, URLs and public page content you import, the questions we ask AI engines, their answers and the suggestions we generate. Connected tools: if you connect Google Analytics, aggregated GA4 reports; if you use Krawfly Edge, the name of the AI crawler and the URL it visited; if you use the Krawfly app for Shopify, store domain, contact email and product data via the Shopify Admin API. Billing (only if you subscribe to a paid plan): billing details and subscription status (card data is handled by Stripe, not by us). We also keep technical logs needed to run and secure the service.
2. How we use data
We use data only to provide the service: run AI visibility checks, show crawler visits and AI traffic, generate suggestions, produce reports, secure accounts and handle billing. We do not sell personal data and we do not use customer data to train third-party AI models. Google Analytics data: access is read-only (analytics.readonly) and used solely to show you traffic and conversions from AI assistants in your dashboard; it is not used for advertising, not sold, not used to train AI models and not read by people except with your consent, for security or to comply with the law. Krawfly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time from the dashboard or your Google Account settings. For data processed on behalf of business customers (Krawfly Edge, connected Google Analytics, imported catalogs), we act as a processor for the customer.
3. AI processing
To check visibility and generate suggestions we send test questions and relevant product content to AI providers (listed in the subprocessors table). This content normally contains no personal data; please do not put personal data in catalogs or free-text fields. Suggestions are never published without your approval.
4. Data retention
We keep account and workspace data for as long as your account is active and delete it when you close the account or ask us to, unless the law requires us to keep it (for example billing records). Free-tool data is kept until you ask us to delete it or withdraw your consent. You can request deletion at any time by emailing [email protected]; uninstalling the Krawfly app for Shopify triggers deletion in line with Shopify's requirements.
5. Free public tools
Our free tools (AI Visibility Score, AI Brand Check, llms.txt Generator and AI Visibility Assessment) ask for your name and email address, and optionally your company, together with the website or domain you want analyzed. These details are stored in our database so we can run the analysis, send you the result and unlock the full report (for the AI Brand Check, also a one-time verification code by email). We also log the analyzed URL, the AI providers used and the processing time to run and improve the tools. Only if you tick the optional consent box, we may send you product emails, including one follow-up email about a day after your result; you can unsubscribe at any time. Legal basis: performing your request (GDPR Art. 6.1.b) and, for product emails, your consent (Art. 6.1.a). Requests are protected by Cloudflare Turnstile against abuse.
6. Demo and contact forms
When you book a demo, contact us, request an assessment or join a waitlist, your details (name, email, store domain, optional message and consent) are sent to us by email only and are not stored in a database. We use them only to reply to your request, and we do not add you to marketing lists unless you separately opt in.
7. Cookies & local storage
The public website does not currently use advertising cookies or retargeting pixels. We may use local storage to remember your theme preference. See our Cookie Policy for details.
8. Sharing & subprocessors
We share data only with subprocessors that help us run the service, each bound by confidentiality and data-protection obligations. Our current subprocessors are:
| Provider | Purpose | Location |
|---|---|---|
 OpenAI | AI product signal generation (fallback) | United States |
 Google Gemini | AI product signal generation (primary) | United States / EU |
 Perplexity AI | AI citation tracking | United States |
| Cloudflare | CDN, DDoS protection, and privacy-first web analytics (cookie-free, no personal data stored) | United States / EU |
| Anthropic (Claude) | AI visibility checks | United States |
| Google Analytics Data API | Read-only access to GA4 reports you connect to the dashboard | United States / EU |
| Brave Search | Search results used for product context | United States |
| Resend | Transactional emails (login codes, reports, form replies) | United States |
| Stripe | Payments and subscriptions (card data handled by Stripe) | United States / EU |
| Vercel | Hosting of application components | United States / EU |
Transfers of personal data to subprocessors outside the European Economic Area are governed by Standard Contractual Clauses or equivalent safeguards.
9. Your rights
Depending on your jurisdiction you may have rights to access, correct, export or delete your personal data. Contact us to exercise them.
10. Contact
Questions about this policy? Email [email protected].