Privacy Policy
Last updated 2 September 2026
Who we are
Aylake provides a free GEO report and paid local-visibility services for small businesses. We are based in the United Kingdom and are the data controller for the personal data described here.
Contact us at hello@aylake.com for anything in this policy, including to exercise your rights.
What we collect
| Data | When | Why |
|---|---|---|
| Website address, business name, branch, city, category, keywords | You submit the free grader | To identify the business and run the report |
| Email address | Optional on the grader; required to start a trial | To send your report and contact you about a trial |
| Name, email, profile picture, Google account identifier | You sign in with Google | To create and authenticate your account |
| IP address | Every request | Rate limiting and abuse prevention. Not used to profile you |
| Report contents, including public business information and AI model responses | Each grade | To produce and store your report, and to improve accuracy |
We do not collect payment details. We do not use advertising or tracking cookies, and we do not sell personal data.
Public information about businesses
Reports draw on publicly available information: your website, your Google Maps listing including a sample of public reviews, search results, and what AI assistants say when asked about your business. Reviews may contain the names their authors chose to publish publicly. We store this to produce your report and do not use it to build profiles of individual reviewers.
Our lawful bases
Legitimate interests for running the free grader, preventing abuse, and improving accuracy — balanced against your interests, which is why we rate limit rather than profile and keep only what a report needs.
Contract for providing an account and any paid plan you take.
Consent for sending you a report by email, which you give by entering your address. You can withdraw it at any time by replying or emailing us.
Who we share it with
We use the following processors. Each receives only what its function requires.
| Provider | Purpose | Where processed |
|---|---|---|
| Databricks (Lakebase) | Database — reports, accounts, sessions | United Kingdom (London) |
| Railway | Application hosting | European Union |
| Hostinger | Website hosting | European Union |
| OpenRouter | Sends business names and questions to AI models | United States |
| Serper | Google search and map-pack lookups | United States |
| Google (Places API) | Business listing and review data | United States |
| Resend | Transactional email, when enabled | United States / European Union |
Transfers outside the UK rely on the UK International Data Transfer Addendum or equivalent safeguards. We send business information rather than customer records to AI providers, and we do not send your account details to them.
How long we keep it
Reports and their underlying data are kept for two years so you can compare over time and so we can improve accuracy. Account data is kept while your account exists and for six months afterwards. Rate-limiting records are deleted after one day. Email addresses submitted for a report are kept until you ask us to remove them.
Your rights
Under UK GDPR you can request access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Email hello@aylake.com and we will respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We set one cookie, and only after you sign in: a session cookie that keeps you signed in. It is strictly necessary, so it needs no consent banner. We use no analytics, advertising or third-party tracking cookies.
Google user data
When you sign in with Google we receive your name, email address, profile picture and Google account identifier, and nothing else. We use them solely to create and authenticate your account. We do not share this data with third parties, and we do not use it for advertising or to train AI models.
Connecting a Google Business Profile is a separate step with its own permission screen, which we will ask for only if you choose it. Aylake's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke our access at any time at myaccount.google.com/permissions, and delete your Aylake account by emailing us.
Changes
If we change this policy we will update the date above and, for material changes, email account holders.