This Privacy Policy explains how Hasmord, Inc. ("Hasmord", "we", "us"), operator of the Hasmord platform (the "Service"), collects, uses, discloses, and protects personal data, and the rights you have. By using the Service you agree to this policy. Where we act as a processor of data you upload, we process it on your instructions to provide the Service.
Google user data and Limited Use
Hasmord accesses Google user data only when you explicitly connect your Google Analytics account, and only to power the AI-referral analytics described in this policy. This section describes that access specifically.
- What we access: read-only Google Analytics reporting data through the Google Analytics Data API, using the
https://www.googleapis.com/auth/analytics.readonly scope. We read aggregated session and referral metrics (traffic source / medium, landing page, and session and event counts) for the GA property you choose to map to your workspace, plus your name and email address from your Google sign-in. We do not access Gmail, Google Drive, Contacts, Search Console, or any other Google service, and we do not request write access.
- Why we access it: to attribute visits sent by AI assistants (such as ChatGPT, Perplexity, Gemini, and Copilot) to your specific products, so you can measure real AI-driven traffic to the pages you optimize with Hasmord.
- What we store: only the aggregated daily metrics needed to render your reports, scoped to your workspace. We store your Google OAuth refresh token in encrypted form solely to keep the connection active; you can revoke it at any time by disconnecting in Settings → Integrations, or from your Google Account’s third-party access settings.
- No AI training, no sale, no ads: we do not use Google user data to develop, improve, or train generalized/non-personalized AI or machine-learning models, and we never sell it, transfer it to data brokers, or use it for advertising.
Limited Use. Hasmord’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1. Data we collect
- Account data: your email address and, where your provider supplies it, your name — from Google, Microsoft or Apple, or the work email you enter to receive a sign-in link — plus your role and workspace membership. When you request a sign-in link we also keep the time, a hashed form of your network address and browser, and whether the link was used, for 30 days, to prevent abuse.
- Product & content data: the product URLs, categories, brand/model fields, and content you submit for analysis, plus the reports, drafts, and results generated from them.
- Analytics data: when you connect Google Analytics, read-only referral and session metrics used to attribute AI-driven traffic to your products. We request the minimum scope needed and you can disconnect at any time.
- Billing data: subscription status and identifiers from our payment processor. We never receive or store your full card number.
- Usage & technical data: logs, device/browser metadata, and diagnostic information needed to operate, secure, and troubleshoot the Service.
- Website analytics cookies: our public website (hasmord.com) uses Google Analytics 4 (GA4) to understand traffic sources and usage. These analytics cookies are set only after you accept the cookie banner; you can decline it, in which case analytics runs in a cookieless, privacy-preserving mode (Google Consent Mode). You can change your choice by clearing this site's data in your browser.
2. Commerce integrations (Shopify & Amazon)
If you install our Shopify app (“Hasmord — AI Answer Optimization”), the following applies to your Shopify store data:
- What we access: read-only product information via Shopify’s Admin API (the
read_products scope) — product titles, types, handles, status, online-store URLs, and images. We do not request access to orders, customers, or customer personal data.
- How we use it: we send your product page URLs and category to our scoring service to compute AI-readiness (AEO) scores and suggested fixes, which we show back to you in the app. Scoring is performed statelessly — product content is not retained after a score is returned.
- What we store: only your Shopify session/authentication tokens (to keep you signed in) in our secured database. We do not store your customers’ personal data.
- Mandatory privacy webhooks: we implement Shopify’s GDPR/compliance webhooks —
customers/data_request, customers/redact, and shop/redact. Because the app stores no customer personal data, data-request and customer-redact requests are acknowledged with nothing to return or erase; a shop-redact request deletes your store’s session data from our systems.
- Uninstalling: when you uninstall the app we delete your store’s session tokens. You can contact us to request deletion of any remaining app data.
Amazon Selling Partner API. If you connect your Amazon seller account (via Amazon’s Login with Amazon OAuth), the following applies to your Amazon Selling Partner data:
- What we access: your own product listing content through the Amazon Selling Partner API, using the Product Listing role only (
putListingsItem / patchListingsItem, including A+ content) — item titles, bullet points, descriptions, search terms, and listing images. We do not request or access orders, buyer information, or any buyer personal data, and we request no restricted (PII) roles.
- How we use it: to publish AI-optimized listing content back to your own listings, on your behalf and at your direction, so AI answer engines and shoppers surface your products more accurately. Each seller’s data is isolated to that seller’s workspace and used solely to optimize that seller’s own listings.
- What we store: your Amazon OAuth refresh token in encrypted form (solely to keep the connection active) and the listing content you choose to generate and publish. We do not store Amazon orders or buyer data.
- Sharing: Amazon Information is processed only within our own systems and the subprocessors listed in “Sharing & subprocessors” below (cloud hosting and LLM providers, used only to generate listing copy from your product data). We never sell or disclose Amazon Information to any other party.
- Disconnecting: you can disconnect your Amazon account at any time in the app and request deletion of the associated data; disconnecting revokes our access.
3. How we use data
- To generate AEO reports, product information, citation probes, and analytics for your workspace, and to provide the features you use.
- To operate, secure, maintain, debug, and improve the Service, and to prevent fraud and abuse.
- To process payments, manage subscriptions, and send service and account communications.
- We do not sell your personal data. We do not use your Customer Data to train our own AI models, and we only use AI providers whose API terms state that they do not train on customer content (see Section 5). Each provider’s own retention terms apply to the requests we send them.
4. Legal bases
Where applicable law (such as the GDPR) requires a legal basis, we rely on: performance of our contract with you (to provide the Service), our legitimate interests (to secure and improve the Service), your consent (for example, connecting Google Analytics), and compliance with legal obligations.
5. Sharing & subprocessors
We share data only with service providers that help us run the Service, under contractual confidentiality and security obligations:
- Cloud hosting and database providers used to run and back up the platform.
- Stripe, for payment processing (we never store your full card number).
- AI model providers — Anthropic, OpenAI, Google (Gemini API), Perplexity and TypeSafe (including its Jev model). We send them only the content a feature needs: product-page text and the product facts in your workspace (for AEO reports, Auto-fill, Write with AI, plan drafting, question analysis, evidence checks, visibility simulations, citation probes and observation rounds), text you write for a feature (Write with AI instructions, buyer questions and notes, observation backgrounds, drafts), text read from public competitor pages for competitor research, and the messages you send to the Agent (to understand your request, suggest wording and prepare changes for your review). When you ask AI assistants a question through the Service, the question is sent to OpenAI, Anthropic, Google and Perplexity, which may run web searches to answer it. Some of this runs automatically after an action you take — for example identity enrichment when you import a product, re-checking visibility after you approve a change, and scheduled visibility refreshes (when enabled for your workspace). Under their API terms these providers do not use your content to train their models; retention of request logs is governed by each provider’s terms (Anthropic and OpenAI: up to 30 days; Google Gemini API paid tier: a limited period; Perplexity: not retained; TypeSafe: as long as reasonably necessary). This list may change as we add or replace providers; the current list is the one on this page and in Section 7 of our Terms of Service. Please don’t include personal information about other people, or confidential information, in what you send to the Agent or submit for analysis.
- Search data provider — DataForSEO, used for competitor research to retrieve search results, keyword and backlink data. We send the competitor domains, the market and language you choose for a research run, and the search terms the research needs; we never send your customers’ data. The provider’s data is kept with the research for up to 12 weeks. For the public competitor pages a run reads, our own research reader identifies itself and follows each site’s robots.txt, as described on hasmord.com/bot.
- Web-fetching services — ScrapingBee, used only to fetch public product pages that block our own crawler; we send the page URL, not your workspace data.
- The Google Analytics Data API, only when you explicitly connect it.
We may also disclose data if required by law, to protect our rights and users, or in connection with a merger or acquisition (with notice where required).
5a. Anonymised market context
To simulate how AI assistants compare products, Hasmord builds a catalog of products in the same category drawn from public product pages, and from facts a workspace has published on its Hasmord page. Facts from your workspace may appear in another workspace’s simulation only in this anonymised, product-level form (no workspace name, no personal data, no unpublished notes), and that simulation prompt is sent to the AI model providers in Section 5. Facts you have not published are never included.
6. International transfers
Your data may be processed in countries other than your own. Where required, we use appropriate safeguards (such as standard contractual clauses) for such transfers.
7. Retention
We retain personal data only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Retention is limited to what your reports and analytics require. Text read from third-party pages and data from our search data provider are kept for up to 12 weeks. Our own research records (which pages were cited, our judgements, and the history of a research run) are kept with your workspace. You may request deletion of your workspace data at any time (see below). Request logs held by AI model providers follow their own retention terms described in Section 5.
8. Security
We use tenant isolation, encryption in transit, access controls, and encrypted backups to protect data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. See our Security page for details.
9. Your rights
Subject to applicable law, you may access, correct, export, restrict, or delete your personal data, object to certain processing, or withdraw consent. To exercise these rights, email legal@hasmord.com and we will respond within a reasonable time. You may also have the right to complain to your local data-protection authority.
10. Cookies
We use only the cookies necessary to authenticate your session and operate the Service, including a short-lived cookie that links an email verification to the browser where you started signing in. The sign-in form is protected by Cloudflare Turnstile, which may set its own cookie and processes limited connection data to tell people from bots (see Cloudflare's privacy policy). We do not use non-essential advertising cookies.
11. Children
The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect data from children.
12. Changes
We may update this policy; material changes will be posted here with a new "last updated" date.
13. Contact
Privacy questions or requests: legal@hasmord.com. General support: support@hasmord.com. Data controller: Hasmord, Inc.
