1. Project isolation
Account-backed audit records, Agent conversations and location results are associated with their owner. Server-side requests check access before retrieving evidence or generating responses. Do not share your sign-in credentials.
2. Information sent to AI
Discovery sends selected public website content. Answer collection sends approved questions. Analysis sends the relevant answer and brand information. The Agent receives the selected project identity, relevant saved evidence, bounded recent conversation and any task context you attach. It does not receive every account’s records.
3. OpenAI processing
OpenAI is used through its server-side API. API keys are not sent to the browser. Agent requests use store:false and an output-token limit. This does not mean zero provider retention: provider abuse-monitoring and other applicable policies can still apply. OpenAI states that API business data is not used to train models by default unless the customer opts in. Review OpenAI’s API data controls for current details.
4. Provider categories
Clerk: sign-in and account management. Supabase: database persistence. OpenAI: website discovery, answer analysis and Agent text. Oxylabs: collecting answers from ChatGPT, Gemini and Google AI Mode to approved questions. Stripe: subscription checkout, billing and customer portal. Resend: account and report emails. Sentry: technical error reports without audit answers, form contents or email addresses. Vercel: hosting and delivery.
5. Locations
On paid plans, Locations asks ChatGPT up to five of your audit questions as if from each market you choose, and saves those answers like any other audit answer. It measures how ChatGPT answers in that market, not where your website visitors are. Crawlbird adds no tracking code to your website.
6. Security and agreements
The application uses authenticated access checks, database row-level policies, server-only provider secrets and usage controls. These controls do not amount to a security certification. We do not claim SOC 2, ISO 27001 or blanket GDPR compliance. Contact us before uploading data that requires specific contractual safeguards, regional processing commitments or a signed data processing agreement.
7. Review, export and deletion
Review AI drafts before publication. Export audit evidence and request an account data copy or deletion through Settings or contact@crawlbird.ai. Provider retention, legal billing records and backups may have separate schedules. Contact us for applicable details before sending sensitive material.
Need help?
Crawlbird is operated by Miten Gohil, sole trader. Address available on request.