Privacy

What we store, and who sees it

Plain words, no legal fog. If any of this stops being true, this page changes before anything else does.

Updated 5 September 2026.

Who is asking

What we store

A free check stores five things:

• The business facts you typed: name, website, town, country, language and trade. Those describe a business, not a household.
• The answers the assistants gave, word for word, with the exact question we asked and what the call cost us.
• Your email address, if you leave one for the weekly re-check, with the day you confirmed it and the day you stopped it.
• A one way hash of your connection address, so the daily limit can count without us knowing whose connection it is. The address itself is never written down, not in the database and not in a log.
• Plain counters: which step of the checker happened, in which language, and which site you arrived from (the host name, nothing longer).

A free check needs no account, so it stores no password and no card. What an account and a paid plan add is further down this page.

What we never do

No tracking script, no advertising cookie, no third party analytics. The only cookie is the session cookie the site needs to keep your session and to protect the form.

There is one more cookie in the code, and you will never be given it. When somebody on our team signs in to the admin panel, their browser gets a marker called py_internal, so our own test checks can be left out of the numbers we publish. It holds the number one and nothing else, it says nothing about a person, and only the staff sign-in page sets it.

We do not sell or rent anything about you, and your email goes to nobody except the company that carries our mail.

We never publish your results. A results page is private to whoever holds the link, it tells search engines not to index it, and robots.txt disallows it as well.

Why we are allowed to

You asked for the check, so we run it and show it to you. That is the service you requested (GDPR Article 6(1)(b)).

The weekly email is consent, and we ask for it twice: once when you type the address, once when you click confirm in the mail we send. Nothing weekly goes out before that second click (Article 6(1)(a)).

The hashed connection and the plain counters keep a free tool free and let us see whether it works at all. That is our legitimate interest (Article 6(1)(f)), and it is why neither of them holds a name or an address.

Which companies see it

Each one gets the least it needs to do its job, and no other company sees any of it:

• OpenAI. Gets the question we ask ChatGPT, and the answer text back when we read which businesses were named in it. Never your email.
• Perplexity. Gets the question we ask it. Nothing else.
• xAI. Gets the question we ask Grok, on the days Grok is switched on. Nothing else, and never your email.
• DataForSEO. Looks things up on our behalf, so it gets the question, or the business name and town, or the website address. It is how we read Google AI Overviews, the Google Maps listing, the "best in town" pages and the Bing index.
• Cloudflare. Sits in front of the site, and its Turnstile challenge on the form checks that a person, not a script, is spending our vendor money. It sees your connection address and the request.
• SMTP2GO. Carries our mail from EU servers, so it gets your email address and the mail itself.
• Mollie. Takes the payment when you subscribe. It gets your name, your address, your email and the amount. Your card number never touches our servers: the card is typed on Mollie's page, and what comes back to us is a brand, four digits and an expiry month.
• Google. Sign in only, and only if you choose that button. We get the subject claim that identifies the account, your address and your name. Nothing about your businesses or your answers ever goes to Google.
• The European Central Bank. We fetch the daily euro reference rate once a day to print an indicative dollar figure. No personal data of any kind goes with that request.
• Hosting: a hosting provider inside the European Union runs the servers the site, the queue and the database live on. Everything we store sits there.

Hosting and mail are in the EU. The AI vendors and the search data provider are not, so the question, the business name and the town travel to their servers. We send them nothing about you personally, and that transfer rests on the data protection terms in each vendor contract.

How long we keep it

The AI answers stay, as they were returned. They are the evidence behind every count we ever showed anybody, the record of what each call cost us, and our sample of how the assistants behave over time. When a business is erased, everything that names it is removed from our records and the answers are kept under an anonymous business entry: nobody but our staff can open them, and no count about that business is ever shown again.

Your email stays with the check you left it on until you ask us to erase it, with one exception: an address that was never confirmed is deleted 30 days after it was typed, because the consent it was waiting for never came. Unsubscribing stops the mail that minute and keeps one row as a do not mail record, because forgetting that you unsubscribed is exactly how people get mailed again.

The hashed connection is kept for 30 days and then removed from the check. The daily limit only ever looks at the last 24 hours; the rest of the month is for spotting abuse. The plain counters are kept as they are.

When you have an account

An account adds your name if you give one, a hash of your password (never the password), the language your mails are written in, the businesses you claimed, and which mails you switched on.

The receipts snippet on your website records one thing per visit: which assistant a visitor arrived from and which page they landed on. No cookie, no address, no browser string, nothing that identifies a person. It runs on your site with your permission and it is yours to remove.

Counts across the businesses we sample are compared anonymously. The page called "Businesses like yours we sample" counts how often the assistants named each business in your category and your country in one week, and draws those counts beside yours as dots on a strip. It never shows another business's name, its website, a link to it or anything that could be joined back to it: what leaves our database for that page is a list of numbers. It says nothing at all until there are at least twenty businesses in your category and country with a complete week we sampled, and your own business is in the comparison only for a complete week we sampled. A week is complete when the same questions were asked of the same assistants and every answer came back.

A server log you upload is read once, counted into crawler hits per day, and deleted the same minute. It is never kept after the parse, whether the parse worked or not: an access log is a list of other people's visits and it has no business sitting on our disk.

Invoices, credit notes and payment rows are kept for ten years. That is the Lithuanian accounting law and the exception in Article 17(3)(b) that lets us keep them after an erasure request. They carry the buyer name and address that were on the document when it was issued.

The account page does two of your rights in one press each: "Download my data" builds a ZIP of everything we hold about you within a minute, and "Delete my account" closes it at once, keeps a restore link for 30 days and erases the rest on day 30, apart from the invoices the accounting law keeps and the anonymous AI answers described under retention.

If you use PicksYou through a partner platform such as Shopify, the platform tells us when you uninstall, and 48 hours later it asks us to erase your shop. We then remove everything that names your shop or the people around it the same day, and keep only the anonymous answers described under retention. Nothing we keep came from the platform or from your store.

What you can ask for

Write to [email protected] and we act within 30 days: a copy of what we hold about you, a correction, or deletion. Deletion removes your email, the confirmation record and the check attached to it.

An answer is what an assistant said in public about a town and a trade, and it may name a business, exactly as a search result would. A company's name is not personal data, so the answers about a company stay. If the business is you, a sole trader working under your own name, tell us at [email protected], or tick the box when you delete your account, and the answers about your business go too.

An erasure reaches what we hold about you. It does not reach the answers other businesses received, in which the assistant may have named you: those are their samples of the same public question, and the same words stay inside the assistant itself.

You can also complain to a data protection authority: the State Data Protection Inspectorate in Lithuania (vdai.lrv.lt), or the one where you live.

Changes to this page

When we add a vendor, keep something longer, or start deleting on a timer, this page says so on the day it happens and the date at the top moves.