Legal

Privacy Policy

What we collect, why we collect it, who else sees it, and how to get it deleted. This is the plain-English version — and it is the only version. There is no second policy written in legal language.

Effective 2 August 2026 · Loom Labs AI LLC

In brief

The short version

A summary you can read in twenty seconds. The full policy below is the part that counts.

We collect what a check-up needs

Your email address, the business details you type in, the public pages of your own website, and the answers ChatGPT and Gemini gave when we asked about you.

We do not sell it or track you for ads

No card details — Stripe collects those on its own pages. No advertising trackers. No data brokers. Nobody buys your information from us.

You can have all of it deleted

Email support and we remove your business’s data. Ask for a copy of it first if you want one — that request is free and there is no form to fill in.

Who we are

DiscoveryHQ checks whether AI assistants recommend your business when customers ask them for one, and tells you what to change. DiscoveryHQ is developed and operated by Loom Labs AI LLC. Our address is 30 N Gould St Ste R, Sheridan, WY 82801, United States.

Loom Labs AI LLC decides what information is collected here and why, so under UK and EU data protection law we are the controller of it. For anything at all about your information, write to support@dicoveryhq.com. That is a real inbox, and it is the same address you use to exercise every right described further down this page.

What we collect

Everything below is one of three things: something you typed in, something your own public website already says, or something an AI assistant said when we asked it a question about your kind of business.

Your account. Your email address, your name if you give one, and how you signed in — email or Google. If you use Google sign-in, Google tells us your name and email address. We never see your Google password.
The business you are checking. The website address, what kind of business it is, where it operates, the topics and questions you want checked, and any competitors you name.
Content from your public website. We read your pages the way a visitor would: the words on the page, the titles, and the small code labels that tell AI what your business is. Only pages that are already public. A check-up inside the app reads up to 100 pages.
The AI answers about you. We keep the full text of what ChatGPT and Gemini said, which businesses they named, and the reason each assistant gave for naming them. Every tracked question is asked 3 times per assistant, so a count like “recommended in 2 of 9 checks” traces back to answers you can open and read yourself.
Search results for the same questions. Which pages are currently winning the Google results for the questions you track.
Basic technical records. Your IP address, browser type and the time of a request. We use these to keep the service running and to stop people abusing the free check-up.

What we do not collect

No card or bank details.Paid plans are handled by Stripe. Your card is entered on Stripe’s own pages, so the number never reaches our servers and we have nothing to store. We receive only what we need to know who is subscribed: a Stripe customer reference, which plan you are on, whether it is paying, and the dates of your billing period.
No sensitive categories. We do not ask about health, religion, politics, race, trade-union membership, sexual life or biometrics, and you should not put any of that into the questions you track.
We do not sell your information, and we do not pass it to data brokers or advertising networks. There is no arrangement under which anyone pays us for it.
No advertising trackers. The site carries no ad pixels and no third-party advertising cookies. What we do use is set out in the Cookie Policy.

Why we use it

To run the check-up you asked for — and only when you ask. Nothing at DiscoveryHQ runs on a schedule. There is no background monitoring and no automatic weekly re-check. A check-up happens because you pressed a button.
To work out your two scores, the AI Visibility Score and the Website Score, and to show you the questions and answers sitting behind each of them.
To show which competitors AI named instead of you, how often it happened, and the reason the assistant itself gave for choosing them.
To write your fixes. We write the wording; you paste it into your own site. Nothing is ever applied to your website automatically, and a change counts as done only when another check-up confirms it.
To send the email you need: sign-in links, password resets, and a note when results are ready.
To keep the service working, fix faults, and stop abuse.

The legal reasons we rely on

If you are in the UK or the EU, the law asks us to name a reason for each use. Ours are:

Doing what we agreed (contract). Running your check-ups, storing your reports, letting you sign in and see them again.
Our legitimate interests. Keeping the service safe and working, preventing abuse of the free check-up, and understanding which parts of the product get used so we can improve them. We rely on this only where it does not override your rights.
Your consent. For anything optional — an email you asked to receive, for example. You can take that consent back at any time by emailing support, and it takes effect from then on.
Legal obligations. Where we have to keep or produce records because the law requires it.

Sharing

Who else sees your information

A short list of providers runs DiscoveryHQ. Each one gets only what its job needs, under its own standard terms for business customers.

AI providers — OpenAI and Google: They receive the questions we ask, which contain your business name and location. They do not receive your account details, your email address or your billing information. These are the AI companies’ own official services, with web search turned on.
Our database and sign-in provider — Supabase: Stores your account and your results in Postgres. Every table has row-level security, so one business’s data cannot be read from another business’s account.
Our hosting provider — Vercel: Runs the site and receives the requests your browser makes, including your IP address, in the ordinary course of serving a page.
Our email provider — Resend: Sends the email you actually need: sign-in links, password resets and “your results are ready” notices. It sees your email address and the message.
A website-crawling provider: Fetches the public pages of the website you asked us to check, so we can read them. It gets the website address — nothing about you.
A search-results provider: Returns the Google results for the same questions, so we can show who is winning the search page as well as the AI answer. It gets the question text.

That is the whole list. Beyond it, information leaves us in only two situations: when the law genuinely requires it — a court order, say — and we will tell you when we are allowed to; and if the company is ever sold or merged, in which case your information moves with it and this policy keeps applying until we replace it and tell you what changed.

Where your information is stored

Our providers are mostly based in the United States, so your information is handled there — including when you are somewhere else. Where information moves out of the UK or the EU, we rely on the standard data-transfer terms in each provider’s data processing agreement.

How long we keep it

Account and business details: for as long as your account is open.
Check-up results, stored AI answers and reports: for as long as your account is open, so a new check-up can be compared against an older one and you can see what actually changed.
Basic technical records: for a short period, then cleared.

When you ask us to delete your account, we remove that business’s data: the account, the business details, the stored AI answers and the reports. Copies can sit in routine backups for a short while before those are overwritten, and email we have already sent cannot be pulled back — but nothing stays in the live product.

Your rights over your information

Wherever you live, you can ask us to:

Show it to you — a copy of what we hold about you and your business.
Correct it — fix anything that is wrong or out of date.
Delete it— remove your account and your business’s data.
Export it — hand it over in a file you can take somewhere else.
Object to a use, or limit it — tell us to stop a particular use, or to pause it while we look into a complaint.
Withdraw consent — for anything you opted into.

To use any of these, email support@dicoveryhq.com from the address on your account. We will check it really is you before we act, and we will not charge you for asking. If you are in the UK or the EU you can also complain to your local data protection authority — though we would rather you told us first and gave us the chance to fix it.

Children

DiscoveryHQ is a tool for running a business and is not for anyone under 16. We do not knowingly collect information about children. If you think a child has given us information, email support and we will delete it.

How we protect it

Every table in our database has row-level security, so one business’s data cannot be read from another business’s account. Sign-in is handled by Supabase, with email or Google. Traffic to the site is encrypted. The Security page explains this in more detail, including the parts we have not built yet.

Certifications

We hold no privacy certification, and we will not imply one

Plenty of sites hint at an audit they have never had. Here is exactly where we stand.

Independent audits and frameworks

Planned

DiscoveryHQ has not been audited or certified under SOC 2, ISO 27001, or any other privacy or security framework, and we make no claim to be. We follow the practices described on this page and on the Security page because they are the right way to handle your data, not because anyone signed them off. Seeking a formal audit is something we intend to do as the company grows; until that is genuinely done, this paragraph will keep saying so.

The Compliance page tracks where each framework stands — what is live, what is in progress, and what is only planned.

Changes to this policy

When something here changes in a way that matters, we update the effective date at the top of this page and record it in the changelog. If a change affects how we use information you have already given us, we will email the address on your account before it takes effect. We will not make a quiet edit and hope you miss it.

Contact

How to reach us about privacy

One inbox, one address. No ticket portal and no privacy web form to hunt for.

Email

The fastest route, and the one we watch. support@dicoveryhq.com — write from the address on your account and say plainly what you want: a copy, a correction, or deletion.

Post

Loom Labs AI LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States

See what AI says about your business

A free check-up takes a minute or two. No account needed to run it, and a free account saves the report.

Check my website See how it works