Privacy Policy

The Operato AI platform (app.operato-ai.com) and the operato-ai.com website are operated by Sarah Rolland, trading as Operato AI. Operato AI is not yet incorporated as a registered company; this policy will be updated with the registered entity name and address once incorporation is complete. Sarah Rolland is the data controller for the personal data described here. Questions go to privacy@operato-ai.com.

• Platform account: email, name, password (never stored in plain text, only as a salted hash), organisation name.
• Lead / AI Readiness Score: email, the website domain submitted, language, consent.
• Connected ad accounts (optional): connection credentials, encrypted before storage, and aggregate campaign metrics.
• Technical logs: IP address and timestamp, kept for security and abuse prevention.

• Contract performance: running your account and the AI visibility dashboard.
• Consent: sending the AI Readiness Score you requested, and related communications.
• Legitimate interest: account security, fraud and abuse prevention, and improving the service.

We never sell your data. We share it only with the vendors needed to run the service, each acting as a data processor:

• Platform and database hosting: Fly.io (EU by default)
• Website hosting and transactional email: Base44
• Sampling AI assistant answers (your tracked category prompts, never your personal data): Anthropic, OpenAI, Google, and Perplexity, all US-based
• Keyword and question research: DataForSEO (US)
• If you connect your own ad accounts: Google, Microsoft, AppsFlyer, or Adjust, depending on which platforms you connect

Every one of these transfers is declared in an internal technical register with its purpose and the recipient country, rather than handled ad hoc.

Several of our vendors are based in the United States. Where data is transferred there, we rely on GDPR-recognized transfer mechanisms, such as Standard Contractual Clauses or the EU-US Data Privacy Framework, depending on the vendor.

Account data is kept for the life of your subscription, plus a default 400-day retention window afterward, unless you request earlier deletion. Unverified leads are kept until you exercise your right to erasure.

You have the right to access, correct, delete, restrict, and port your data, to object to certain processing, to withdraw consent at any time, and to lodge a complaint with your data protection authority. To exercise any of these, email privacy@operato-ai.com.

See our Security page for the technical measures in place.

We may update this policy as the service evolves. The last-updated date at the top of this page reflects the current version.