picked

Privacy and data

Privacy Policy

Last updated

1. Who we are

Picked ("we", "us") runs picked.so, an AI visibility tool: it asks ChatGPT, Claude, Gemini, Perplexity and Google's AI answers the prompts you give it, records which brands and pages they name, reads your AI crawler traffic when you connect it, and writes articles for the prompts you lose. Picked is the controller of the personal data described here. Write to us about anything on this page at [email protected].

2. What we collect

We collect what the service needs to work, and no more.

  • Account: your name, email address and, if you sign up with a password, a hashed password. If you continue with Google or GitHub, we receive your name, email address and avatar from them, never your password there.
  • Sessions: when you sign in we store the session, with the IP address and browser (user agent) it came from, so we can keep you signed in and spot misuse.
  • Your company and team: the company or agency name, the people you invite and their roles.
  • What you track: your brands and websites, competitors, prompts, and the answers, mentions and cited pages the AI models return for them, with what each run cost us.
  • Articles: the briefs, drafts, edits, charts and screenshots you create, and product screenshots you upload.
  • Integrations you connect: for Cloudflare and Vercel, the access token you authorise, stored encrypted, and the AI crawler hits it lets us read (which bot, which path, the status, the country and a count per hour). For "Your server", the same fields your snippet sends. We do not store the IP addresses of the visitors or bots in those hits; where we check a bot against its owner's published IP ranges, we use the address only for that check. For GitHub, the installation you approve on your site's repository.
  • Billing: your plan and subscription status. Card details go to our payment provider (section 4), never to us.
  • Free AI visibility check: the work email, company, brand, website and category you enter, the answers we get back, and a one-way hash of your IP address that we use only to limit abuse.
  • Feedback: what you write in the dashboard's feedback form, the page you were on and who sent it.
  • Website and product usage: the pages of picked.so you load and the errors we log, to keep it running. We also measure how the site is used with Google Analytics and Ahrefs Analytics (section 4): the pages you view, how you got here, your approximate location, and your browser and device type.

3. What we never collect or store

  • Your passwords for other services, or your browser cookies for them.
  • Card or payment account numbers.
  • Your source code. When you connect a repository, we work with the article files we open a pull request for.

4. Who processes it

We use these providers to run the service. Each gets only what its job needs.

  • LemonSqueezy: our merchant of record for payments, invoices and VAT or sales tax.
  • Our server: your account and everything you track are kept in a PostgreSQL database on a server we control.
  • Trigger.dev: runs our scheduled and background jobs, such as daily prompt runs and article stages.
  • DataForSEO: returns the AI answers, search results and keyword data we ask for. We send it the prompts and keywords you track, not your name or email.
  • Google (Gemini API) and OpenAI: read pages and write or check article text, and read AI answers for brand mentions. They receive the prompt, page or draft text for that step.
  • Ahrefs: returns a domain's public Domain Rating for article research. We send it a domain name.
  • Google Analytics: measures how people use picked.so, only if you accept Analytics cookies. It sets cookies in your browser and receives your IP address, which Google uses to work out an approximate location.
  • Ahrefs Analytics: measures visits to picked.so. It does not use cookies or store anything in your browser. It receives the page address, referrer, page title, language and screen size, and, as with any request, your IP address.
  • Lemon Squeezy Affiliates: if you arrive on an affiliate link, its script sends the page address and referrer to Lemon Squeezy, computes a device identifier from your browser, and sets a cookie, so the referral can be credited when you buy. Visitors who did not come from an affiliate link do not load it.
  • Cloudflare Turnstile: checks that the free AI visibility check is used by a person.
  • Google and GitHub sign-in: only if you choose to sign in with them.
  • Cloudflare, Vercel and GitHub integrations: only the ones you connect, and only with the permissions you approve.

We do not sell your data and we do not use it to train AI models.

5. Why we use it

To run your account and deliver the service you signed up for, to bill you, to keep the service secure and stop abuse, to understand which pages are useful and improve them, to answer you, and, for the free check, to send you the result and follow up about Picked. You can say no to the follow-up.

6. How long we keep it

We keep your data while your account exists. When you ask us to delete your account, we remove your account, company, projects, prompts, answers, articles, integration tokens and uploaded screenshots, and we cancel your subscription first so you are not charged again. Payment records stay with LemonSqueezy for as long as tax law requires. Free check submissions are kept so we can stop repeat use; ask us to delete yours at any time.

7. Your rights

You can ask us to see, correct, export or delete the data we hold about you. Email [email protected] from the address on your account and we will act on it. If you are in the European Economic Area, the United Kingdom or California, you also have the rights your local law gives you, and you can complain to your data protection authority.

8. Cookies

We always use the cookies needed to keep you signed in, to protect forms and to remember your cookie choice. Everything else waits for your consent: when you first visit, a banner lets you accept all, reject all or choose by category (Analytics: Google Analytics; Affiliate tracking: Lemon Squeezy's script, for visitors who arrive on an affiliate link). Nothing in those categories is loaded before you accept it. You can change or withdraw your choice at any time with "Cookie preferences" in the footer; withdrawing removes the cookies we can reach. You can also block or delete cookies in your browser. We do not run advertising cookies, and we do not use analytics data to build advertising profiles.

9. Security

Integration tokens are stored encrypted. Sessions use secure cookies. No service is perfectly secure; if we learn of a breach that affects you, we will tell you.

10. Changes

We will update this page when what we collect or who processes it changes, and change the date at the top. If a change matters to you, we will email the account address.

11. Contact

[email protected]