What we use, what we keep, and when we delete it.
This policy explains how AI Visibility handles the information needed to review a public business website, process a full-report purchase, and produce a report.
Scope and operator
This policy applies to AI Visibility by OpenSiteCheck, including the public website, free public-beta reports, paid full reports, report downloads, payments, and related support. The service is operated by LATTY INTERACTIVE LLC ("OpenSiteCheck," "we," "us," or "our").
LATTY INTERACTIVE LLC
5830 East 2nd Street, STE 7000 #33665
Casper, WY 82609-4308
United States
support@opensitecheck.com
Information we collect and why
To create a report, we process the website address you submit, eligible URLs discovered on that website, selected public-page text and metadata, public business and contact details, the business details and buyer questions you approve, AI answers and sources, website findings, and the resulting report files. We use this information only to prepare, run, display, download, secure, and troubleshoot the report.
We also process limited operational information, including request timestamps, route status and duration, an essential browser session, Turnstile challenge results, and the connection IP address long enough to enforce beta limits and verify the anti-abuse challenge. We store a one-way, day-specific digest derived from the IP address rather than the raw address in the admission record. Operational logs are designed not to contain raw IP addresses, session tokens, private report links, prompts, or website-page text.
For a paid report, we retain an internal purchase reference, PayPal order and capture identifiers, payment status, amount, currency, and processing timestamps so we can verify delivery, prevent duplicate fulfillment, handle refunds, and investigate payment problems. PayPal collects and processes the payment account or card details on its own checkout surface. We do not receive or store the full card number, security code, or payment-account credentials.
If optional paid-report email is available and you choose to use it, we process the email address, verification status, encrypted message content, and limited delivery status to send a verification code, payment confirmation, and report-ready private link. Email is not required for checkout or report access, is not used for marketing, and does not create an account or recovery method. Free reports do not collect an email address through this feature.
What a public-page scan does
The service makes bounded, read-only requests to selected pages on the submitted public website. The website and its hosting, security, or analytics providers may receive and record our server IP address, user agent, requested URL, and related request details under their own policies.
A public page can still contain personal, confidential, or sensitive information in its text, URLs, images, or code. Do not submit login pages, private systems, personal profiles, signed or secret URLs, or pages containing information that should not be included in a report or sent to the providers described below.
AI processing
We do not begin public-page AI analysis until you check the consent box. Requesty processes selected public-page evidence to help prepare the business profile, buyer questions, and evidence-backed website findings. OpenAI processes the approved buyer questions and separate approved business-name lookup used for a free report. For a paid report, Gemini, OpenAI, and Perplexity each process the five approved buyer questions and the approved business-name lookup assigned to that provider. A provider may return public web sources with its answer.
AI answers and findings can be incomplete or incorrect. We retain answer and source evidence so the report can show separate results, excerpts or summaries, and source context. An unavailable provider response is shown as unknown rather than treated as a negative result.
We do not sell report data or use submitted website content to train our own AI model. AI providers handle data under their own agreements, settings, and privacy notices, which may change independently of this policy.
Service providers and disclosures
Oracle Cloud Infrastructure hosts the production service and retained report data in Frankfurt, Germany. Requesty routes the limited website-analysis processing and the configured Gemini and OpenAI API requests described above. OpenAI provides free-report AI-answer checks; Google Gemini, OpenAI, and Perplexity provide paid-report AI-answer checks. PayPal processes paid-report checkout, capture, and refund information. Their processing is governed by their own terms and privacy notices: Oracle Privacy, Requesty Privacy, OpenAI Privacy, Google Privacy, Perplexity Privacy, and PayPal Privacy.
Cloudflare Turnstile processes anti-abuse challenge data, including the connection IP address and browser or device signals, under the Cloudflare Privacy Policy. When you opt into paid-report email and delivery is enabled, Resend processes the verified address and transactional message needed to deliver the verification code, payment confirmation, or report-ready private link under the Resend Privacy Policy.
We may also disclose limited information when reasonably necessary to protect the service or users, investigate abuse, comply with a valid legal requirement, work with professional advisers, or complete a business reorganization. We do not sell personal information or share it for cross-context behavioral advertising.
Report access and sharing
A free report is tied to the browser session that started it. The customer-facing report and downloads may contain submitted website details, selected evidence, AI answer excerpts or summaries, sources, and findings. Keep any download private if the underlying public pages contain information you do not want redistributed.
A paid report has an unlisted private link that can be opened without the original browser session. Anyone with the link can access the report and downloads until retention expires. Share it only with people you authorize.
Report routes are sent with controls intended to discourage search indexing and shared caching. Those controls cannot stop someone who receives a downloaded report from copying or sharing it.
How long we keep information
Workflow records, selected public-page evidence, approved inputs, provider answers, report files, browser ownership records, and associated local payment records are scheduled for deletion 30 days after a report starts. Incomplete and failed reports follow the same limit. Access expires at that boundary even if active work must briefly finish before its files can be safely removed.
Verified paid-report contact data and queued transactional message content expire with the associated workflow. Verification codes expire after up to 15 minutes and challenge records are short-lived. Limited delivery metadata and keyed suppression records may be kept longer to investigate delivery, prevent repeated sends to addresses that bounced or complained, and protect the service; they do not preserve a report or recovery link.
Short-lived admission records are removed after they are no longer needed to enforce daily capacity. Application and proxy logs are size-limited and rotate as their limits are reached. Service providers may retain limited security, account, or processing records under their own agreements and retention policies.
Cookies and browser storage
An HttpOnly, Secure, SameSite=Strict session cookie keeps a workflow tied to the browser that started it and protects report and payment mutations. Local browser storage remembers the report route and submitted website label so the home page can offer a continue link. The local record does not grant free-report access or authority to change a paid workflow without the matching session cookie.
These tools are necessary for report access and security, not advertising or cross-site tracking. Clearing this site's cookie removes access to the free report. Clearing local storage removes the continue link. The optional verified email on a paid workflow sends only the selected transactional notices; it does not recover a free report, replace the browser session, or create an account.
Your choices
Do not start a report if you do not want selected public-page information processed as described here. Before the final checks begin, you can edit the extracted business details and all three free-report questions or all five paid-report questions. You may skip optional paid-report email or verify a different address. You can also download a completed report and let the 30-day deletion period expire.
You may ask us to provide, correct, or delete information we can reasonably locate. Email support@opensitecheck.com with the subject Privacy request. Because we deliberately collect little identifying information, we may need the report open in the original browser or its report URL to verify the request without exposing another user's report. Depending on where you live, applicable law may provide additional privacy rights.
The service is intended for adults acting in a business or professional capacity and is not directed to children under 18. Contact us if you believe a child has submitted personal information.
Security, policy changes, and contact
We use measures designed to protect retained data, including HTTPS, restricted production processes, hashed access capabilities, strict same-origin mutation checks, request limits, public-address validation, and automated retention. No internet service can guarantee absolute security.
Email support@opensitecheck.com with privacy questions or a suspected security issue. We may update this policy as the beta, provider coverage, or data handling changes. The effective date above identifies the current version, and material changes apply prospectively unless law requires otherwise.