Privacy notice

Controller: Darren Buckley, a sole trader trading as Would AI Recommend, 105 Cooline Drive, Cobh, Co. Cork, P24 R654, Ireland. Contact: hello@wouldairecommend.com. Effective date: 18 October 2026.

What we collect

We collect the brand name, domain, category and country you enter; the buyer questions we generate, the AI answers, parsed results, citation metadata and reports; your email address if you sign in or unlock a report; session and sign-in records; and Stripe customer and subscription IDs and billing status. Stripe handles card details, and we never see them. An events table records the funnel event type, report ID and timestamp. IP addresses are hashed for rate limiting and held for one hour. They are not stored in our database or application logs. We use no third-party analytics or advertising trackers.

Purpose and legal basis

We run checks and accounts to provide the service (contract). We rate-limit to prevent abuse (legitimate interests). We keep billing records to meet legal obligations.

Processors

Cloudflare, Inc. hosts the site, database and cache, and routes email sent to our address. Google (Gemini API) receives only the generated buyer questions, which contain the public brand, category and country. We never send your email, IP address or account or payment details to Google. Stripe Payments Europe, Ltd. processes subscription payments. Resend, Inc. or Cloudflare Email Service delivers sign-in emails, which contain your email address and a one-time link.

Retention

Report cache: 24 hours. Citation cache: 7 days. Rate-limit records: 1 hour. Unused sign-in links: 15 minutes. Sessions: 30 days. Expired sign-in and session records are deleted daily. Funnel events are deleted after 13 months. Free reports not linked to an account are deleted after 24 months. Account data, tracked brands and their results are kept while your account is open and deleted within 30 days of a deletion request. Invoices and billing records are kept for 6 years after the end of the tax year they relate to, as Irish tax law requires.

International transfers

Cloudflare, Google, Stripe and Resend may process data outside the European Economic Area, including in the United States. Where they do, transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses in each provider's data processing terms.

Your rights

Where GDPR or similar laws apply, you may ask for access, correction, deletion, restriction or portability, object to processing, and withdraw consent where we rely on it. Email hello@wouldairecommend.com and we will reply within one month. You may complain to the Data Protection Commission, Ireland (dataprotection.ie) or to your local supervisory authority. We do not sell personal data or make automated decisions with legal effects.