Privacy Policy

The Operato AI platform (app.operato-ai.com) and the operato-ai.com website are operated by Sarah Rolland, a sole proprietor (Osek Patur) registered in Israel, trading as Operato AI. Sarah Rolland is the data controller for the personal data described here. Questions go to privacy@operato-ai.com.

• Platform account: email, name, password (never stored in plain text, only as a salted hash), organisation name.
• Lead / AI Readiness Score: email, the website domain submitted, language, consent.
• Connected ad accounts (optional): connection credentials, encrypted before storage, and aggregate campaign metrics.
• Technical logs: IP address and timestamp, kept for security and abuse prevention.

• Contract performance: running your account and the AI visibility dashboard.
• Consent: sending the AI Readiness Score you requested, and related communications.
• Legitimate interest: account security, fraud and abuse prevention, and improving the service.

We never sell your data. We share it only with the vendors needed to run the service, each acting as a data processor:

• Platform and database hosting: Fly.io (EU by default)
• Nightly database backup, encrypted by us before it is sent: Scaleway (Paris, France)
• Website hosting and transactional email: Base44
• Email delivery: Resend (EU region, Ireland), with Base44 as fallback
• Sampling AI assistant answers (your tracked category prompts, never your personal data): Anthropic, OpenAI, Google, and Perplexity, all US-based
• Keyword and question research, and reading Google's results pages, including AI Overviews and AI Mode, for your tracked questions (keywords, tracked questions, domains and the country searched from, never your personal data): DataForSEO (Estonia, EU)
• Payments, invoicing and tax, as Merchant of Record: Paddle (UK / EU). We never receive or store your card details.
• If you connect your own ad accounts: Google, Microsoft, AppsFlyer, or Adjust, depending on which platforms you connect

Every one of these transfers is declared in an internal technical register with its purpose and the recipient country, rather than handled ad hoc.

For customers: our Data Processing Agreement (DPA) sets out our commitments as a processor under the GDPR, with the full list of sub-processors.

Several of our vendors are based in the United States. Where data is transferred there, we rely on GDPR-recognized transfer mechanisms, such as Standard Contractual Clauses or the EU-US Data Privacy Framework, depending on the vendor.

Account data is kept for the life of your subscription, plus a default 400-day retention window afterward, unless you request earlier deletion. Unverified leads are kept until you exercise your right to erasure.

You have the right to access, correct, delete, restrict, and port your data, to object to certain processing, to withdraw consent at any time, and to lodge a complaint with your data protection authority. To exercise any of these, email privacy@operato-ai.com.

See our Security page for the technical measures in place.

Operato AI is a limited-risk AI system under the EU Artificial Intelligence Act (Regulation (EU) 2024/1689): it is not a prohibited practice, not a high-risk system, and not a general-purpose AI model. Measuring a brand's visibility for marketing falls outside every high-risk area, and Operato AI makes no decision about any person. It uses models provided by OpenAI, Anthropic, Google and Perplexity, and does not train or provide a model itself.

• Transparency: the assistant inside the product is presented as an AI assistant and answers only from your account data. Content drafted by a language model is labelled as such, to review before publishing, and is never published on your behalf.
• Traceability: every figure links back to the AI assistant answers it is based on, which you can read in full.
• No personal data: the questions sent to model providers contain category phrases and brand names, never your personal data.
• Human control: Operato AI informs your marketing decisions; you decide and act.

We review this assessment whenever the regulation or our product changes in a way that could affect it, and at least once a year. Our full position note is available on request at privacy@operato-ai.com.

We may update this policy as the service evolves. The last-updated date at the top of this page reflects the current version.