Privacy Policy

⁰¹ Information we collect

Information you provide

• Account details. Your name, email address and a password when you create an account. Passwords are stored only as salted argon2id hashes — we cannot read them.
• Websites you submit. The URL of each website you want analyzed.
• Documents you upload. Paid workspaces can upload documents to a project knowledge base (PDF, DOCX, PPTX, TXT, MD, VTT, SRT — for example call transcripts or proposal decks, up to 20 MB per file). We store the file and the text extracted from it. Please do not upload documents containing sensitive personal data that the analysis does not need.
• Billing information. Payments are processed by Stripe. Card details are entered in Stripe's own interface and are never received or stored by us. We store your Stripe customer reference, plan and subscription status, and purchase records (amount, currency, dates, invoice references).
• Communications. Messages you send to our support address.

Information from connected services

Collected only when you explicitly connect a source to a project:

• Google Analytics 4 and Google Search Console — aggregate website performance statistics, described in detail in Section 2.
• CRM (HubSpot or Pipedrive) — aggregate sales statistics for the one pipeline you select: counts of deals created, won, lost and open, amounts, win rate, distribution by stage and by month, and the most common loss reasons, over a trailing 365-day window. We do not store contact names, contact details or individual deal titles. We also store the identity of the connected portal/company account (its ID, the authorizing user's email, and the portal name/domain) and an encrypted OAuth token.

Information collected automatically

• Server logs. Our servers record requests (IP address, timestamp, path, status code) for security, abuse prevention and operations. Rate-limiting counters store only truncated cryptographic hashes of IPs/emails — not raw values — and expire automatically within hours.
• Session cookie. A single essential, HttpOnly login cookie (fs_session). We set no analytics or advertising cookies (Section 8).
• Usage records. We record which reports were run for which project, to enforce plan limits and keep an auditable usage ledger, and technical telemetry about our own AI pipeline (model used, token counts, cost) that contains no personal data.

Website content we analyze

When you request an analysis, we crawl the publicly available pages of the website you submitted (respecting its robots.txt) and run performance audits on it. This is content about a public website; we keep it temporarily as working data (Section 6).

A free report can be generated without an account. It is linked to an anonymous token in your browser and is automatically deleted after 30 days unless you sign up and claim it into an account.

⁰³ How we use information

We use the information described above to:

• provide the Service: run analyses, generate reports, verify findings against connected data, and show them in your workspace;
• create and secure your account and sessions;
• process payments, manage subscriptions and enforce plan limits;
• send transactional email (email verification, password reset, sign-in links) and service notifications related to your reports and account, which you can manage in your notification settings;
• keep the Service secure: rate limiting, abuse prevention, debugging and incident response;
• comply with legal obligations (for example, tax and accounting rules for payment records).

Where EU/UK data-protection law applies, our legal bases are: performance of a contract (providing the Service), your consent (connecting data sources, which you can withdraw by disconnecting), legitimate interests (security, service improvement, defending legal claims), and legal obligation (financial records). We do not use your information for automated decisions that produce legal or similarly significant effects about you.

⁰⁴ AI processing

Foresight is an AI product. To generate your reports, the following content is processed by our AI model providers (currently OpenAI, via its API): extracted content of the analyzed public website, website performance audit summaries, and — where you use those features — aggregate statistics from your connected sources and the content of documents you uploaded to the project knowledge base.

Our AI providers process this data to serve our requests only; our agreements with them prohibit using it to train their models. We do not use your data to train generalized AI models of our own, and report outputs for one customer are never derived from another customer's private data.

⁰⁵ When we share information

We never sell personal information and never share it for advertising. We share information only:

• With service providers that host and operate parts of the Service on our behalf, listed below. Each receives only what its function requires:
• With data-source providers you connect (Google, HubSpot, Pipedrive): we contact their APIs with your authorization to fetch the data described in Section 1 and 2. Their handling of your accounts is governed by their own terms and privacy policies.
• At your direction — for example, when you share a report with someone.
• For legal reasons — if required by law, legal process, or to protect the rights, safety or property of Foresight, our users or the public.
• In a business transfer — if we are involved in a merger, acquisition or asset sale, information may be transferred with notice to you; Google user data remains subject to the Limited Use commitments in Section 2.

⁰⁶ Data retention

Data

Retention

Anonymous free reports

Deleted automatically after 30 days (unless claimed into an account)

Crawled website content and performance audits

Deleted automatically after 90 days (reports built from them are kept)

AI pipeline telemetry (model, tokens, cost)

Deleted automatically after 180 days

Account details, projects, reports, uploaded documents, connected-source snapshots

Kept while your account is active; deleted on verified request

Google/CRM OAuth tokens

Deleted immediately when you disconnect the integration

Billing and purchase records

Kept as long as required by tax and accounting law

Server and security logs

Kept for a limited operational period

After a subscription is canceled, your workspace remains available in read-only mode for a period (currently 12 months) so you keep access to reports you paid for; you can request earlier deletion at any time.

To request deletion of your account and associated data, email privacy@askforesight.ai from your account email address. We honor verified requests within 30 days, except for records we are legally required to keep (for example, payment records) and residual copies in encrypted backups that expire on their own schedule.

⁰⁷ Security

We protect your information with, among other measures: TLS encryption in transit; envelope encryption (AES-256-GCM) of OAuth tokens at rest with support for key rotation; argon2id password hashing; HttpOnly session cookies; scoped, account-isolated data access in our application layer; single-use, short-lived tokens for email verification and password reset; and rate limiting on authentication endpoints. No method of transmission or storage is 100% secure, but we work to protect your data appropriately for its sensitivity.

⁰⁸ Cookies and browser storage

The Service sets one cookie: fs_session, an essential HttpOnly cookie that keeps you signed in (30 days, refreshed while you use the Service). It is strictly necessary for the Service to work, so it does not require consent banners, and we have no advertising or cross-site tracking cookies.

When you pay, Stripe's checkout components may set their own cookies for fraud prevention, governed by Stripe's privacy policy.

The applications also use your browser's local storage for interface state (for example, a list of your recent reports on your device and short-lived tokens for an anonymous free report). This data stays in your browser and can be cleared by clearing site data.

⁰⁹ Your rights and choices

Depending on where you live (for example, under the EU/UK GDPR or California law), you may have rights to access, correct, delete or export your personal information, to restrict or object to certain processing, and to withdraw consent at any time (such as by disconnecting a data source). You will not be discriminated against for exercising them.

You can exercise most of these directly: edit your profile in settings, disconnect integrations, delete uploaded documents, or cancel your subscription in the billing portal. For anything else — including full account deletion and data export — email privacy@askforesight.ai and we will respond within 30 days. If you are in the EU/UK, you also have the right to lodge a complaint with your data-protection authority.

¹⁰ International transfers

Our infrastructure and service providers may process data in the United States and the European Union. Where personal data is transferred out of the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the providers' participation in the EU-U.S. Data Privacy Framework.

¹¹ Children

The Service is a business tool, not directed to children, and may not be used by anyone under 16. We do not knowingly collect personal information from children; if you believe a child has provided us information, contact us and we will delete it.

¹²  Changes to this policy

We may update this policy as the Service evolves. We will post the new version at this address with an updated date, and for material changes we will notify you by email or in the Service before they take effect.