Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how Howseen AI ("Howseen", "we", "us") collects, uses, and protects your information when you use our website and application at howseen.ai and app.howseen.ai (the "Service").

Who we are

The Service is operated by Raphaël Aubry, sole trader (entrepreneur individuel / micro-entreprise) registered in France under SIREN 102456951 (APE 70.22Z), with registered address 128 rue La Boétie, 75008 Paris, France. For any privacy question or request, contact us at raphael@howseen.ai.

Information we collect

Account data, your email address and a securely hashed password (or a Google sign-in identifier).
Onboarding data, the domain you track, your competitors, tracked prompts, and optional survey answers (how you found us, your role, your intended use). The same applies to the free AI visibility report: your website address, brand, buyer questions and competitors.
Google data (with your explicit consent), access to your Google Search Console (to read your search performance and index status, and to submit your sitemap after we publish an article for you) and read-only access to your Google Analytics 4 metrics, connected through Google OAuth.
Usage data, basic logs needed to operate and secure the Service, and product analytics as described in our Cookie Policy (cookies and session recordings only if you accept them).
API and MCP usage, if you create an API key: the key is stored only in hashed form, and we log each request (key, endpoint, time) to apply rate limits and measure usage.
Messages you send us, by email or through the chat on howseen.ai, including the email address you give in the chat.
Payment data, subscriptions are processed by Stripe. We do not store your card details; Stripe processes them under its own privacy policy.

Google user data

Howseen's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Google, we request only what the features you connect need:

Google Search Console (webmasters scope): we read your own search performance (queries, pages, clicks, impressions, positions) and the index status of the articles we publish for you, to show them in your dashboard and turn them into recommendations in your Action Plan. The only thing we write is your site's sitemap: after an article is published to your CMS, we re-submit your existing sitemap to Search Console so Google discovers the new page. We never add or remove users, properties or any other Search Console setting.
Google Analytics 4 (analytics.readonly scope): we read your own traffic metrics, including AI-driven traffic, to display them in your dashboard. We never change anything in Analytics.

Specifically:

We use this data only to provide and improve the features you connected it for.
We do not sell Google user data, and do not use it for advertising.
We do not use Google user data to train generalized artificial-intelligence or machine-learning models.
We do not transfer Google user data to others except as necessary to provide the Service, to comply with applicable law, or with your consent.
Only you (and, where applicable, staff acting to operate or support the Service) can access the data you connect.
Protection and retention: your Google refresh token is stored encrypted (AES-256-GCM). Search Console and Analytics metrics are fetched live when you open your dashboard; we store only the index status and the clicks and impressions of the articles we published for you, for as long as your account is active.

You can disconnect Google at any time from your dashboard: we then delete your stored Google token immediately. You can also revoke access via your Google Account permissions. Revoking removes our ability to read your Google data or submit your sitemap.

Shopify data

When you install the Howseen app from the Shopify App Store, we access your store data only to provide the features you installed the app for, in line with Shopify's API and data-protection requirements.

On install, Shopify grants us an offline access token scoped to read_products, read_content and write_content. Specifically:

We read your store's content and products to analyze your AI visibility and generate relevant articles.
We write articles to your store's blog only when you ask us to publish.
We store only your shop domain and an encrypted access token, plus the content we generate at your request.
We do not sell your Shopify data, use it for advertising, or use it to train generalized AI models.
We do not access customer personal data or order information.

When you uninstall the app, Shopify notifies us and we delete your shop's stored data. We also honor Shopify's data-request, customer-redaction and shop-redaction webhooks. You can uninstall at any time from your Shopify admin under Settings, Apps.

How we use your information

To create and manage your account and provide the Service.
To display your AI-visibility, search, and analytics metrics.
To generate and, at your request, publish content to your connected platforms.
To process subscriptions and send transactional emails (e.g., confirmation, billing, the reminder before your trial ends).
To send product emails about your account (for example your first results or a scan summary). Every such email has an unsubscribe link.
To secure the Service, prevent abuse, and comply with our legal obligations.

Legal bases (GDPR)

We process your data to perform our contract with you (providing the Service), based on your consent (e.g., connecting Google), for our legitimate interests (security, product improvement), and to comply with legal obligations.

Service providers

We share data only with providers that help us run the Service, under appropriate safeguards. We do not sell your personal data.

Supabase, database and authentication.
Vercel, hosting of howseen.ai and app.howseen.ai.
Stripe, payments, subscriptions and the billing portal.
Brevo, transactional and product emails.
PostHog (EU hosting) and Google Analytics, product and website analytics, with cookies and session recordings only after you accept them.
Crisp, the live chat on howseen.ai, loaded only when you open it.
Cloudflare, security and bot protection (captcha on the free report).
AI model providers (OpenAI, and as backups Google Gemini, DeepSeek, Mistral, Groq, Cerebras and OpenRouter), to analyze your website and brand and to write content. They receive your website content, brand information and prompts, not your account details.
DataForSEO, which sends your tracked buyer questions to the AI engines we monitor and returns their answers.
Jina AI, which reads the public pages of the website you ask us to analyze.
Telegram, internal notifications to our team (for example, the email address of a new account).
Google (when you connect Search Console or Analytics) and Shopify (when you install our Shopify app).

Security & storage

Data is stored on secure infrastructure with row-level access controls; sensitive tokens (including Google and CMS credentials) are encrypted at rest. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

Data retention

We keep your data for as long as your account is active and as needed to provide the Service, then delete or anonymize it, unless a longer period is required by law (for example, invoices are kept for the period required by French accounting rules). To delete your account and its data, email raphael@howseen.ai from your account address.

We handle deletion requests without undue delay and at the latest within one month of receipt; for complex requests this period may be extended by two further months, in which case we tell you within the first month and explain why (GDPR Articles 12(3) and 17). Records we must keep under French accounting law, such as invoices, are retained for the legally required period even after your account is deleted.

Your rights

Under the GDPR you may access, correct, delete, or export your data, object to or restrict processing, and withdraw consent. To exercise these rights, email raphael@howseen.ai; we answer within one month of receipt (extendable by two further months for complex requests, with notice to you). You may also lodge a complaint with the French data-protection authority (CNIL).

International transfers

Some providers may process data outside the European Economic Area. Where they do, appropriate safeguards (such as Standard Contractual Clauses) are in place.

Cookies

We use essential cookies to keep you signed in and to secure the Service. Analytics cookies and session recordings are used only if you accept them in the cookie banner. We do not use advertising cookies. Details are in our Cookie Policy.

Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

Howseen AI · Raphaël Aubry (micro-entreprise), 128 rue La Boétie, 75008 Paris, France · raphael@howseen.ai · Terms of Service · Cookie Policy · Refund Policy