Privacy Policy

Effective October 14, 2026

This policy explains what personal data Dottpace collects, why we collect it, who we share it with, how long we keep it and the choices you have. We've tried to write it plainly. If anything is unclear, write to us at hello@dottpace.com.

Who we are

Dottpace is run by Fares Alhaka, an individual based in Türkiye, trading as Dottpace ("Dottpace", "we", "us"). This policy covers the website at dottpace.com, the dashboard embedded on our home page (served from preview.dottpace.com), the Dottpace app, our emails and the Dottpace Founders community.

For data about you as a visitor, waitlist member or customer, we decide how it's used (we're the "controller"). For data that comes from the accounts you connect and is about other people, such as your own customers or reviewers, we process it on your behalf, only to provide Dottpace to you. If you need a data processing agreement for that data, write to us.

Contact: hello@dottpace.com.

What we collect

When you join the waitlist or ask for the free audit

Your email address and your site's address.
Anything optional you choose to add on the form (site type, how you heard about us), and your consent to be emailed at launch and about Dottpace.
How you found us: the page you came from (the referrer), the campaign tags in the link you followed (UTM parameters such as source, medium and campaign), the page where you signed up, and the date and time.

We save your email and your site's address when you start the audit, before it runs, with the words you agreed to and the time. If we ask you to confirm your email, we keep the date you did.

Until launch, the audit page shows an example report. When you ask for the audit with your site, we crawl the public pages of that site, check how it appears in Google and in AI answers, and email you the audit report before launch. We also use your email to tell you when Dottpace opens.

When you create an account

Your name, email address and sign-in details. If you sign in with another account, such as Google, we receive basic profile details from it: your name, email address and, if available, your profile picture.
Your workspace: the sites you add, the people you invite and their roles, and your settings.
Your plan and billing status. Paddle collects your payment details. We receive your name, email address, country, plan, and transaction and subscription references. We never see or store your full card number.
What you do in the app: approvals, comments, documents you write or edit, questions you ask Dottpace AI, and the history of changes.
Messages you send us, such as support requests.

From the accounts you connect

You choose which accounts to connect. Each connection asks for read access. Some also ask for permission to make changes, which we use only for changes you approve. Depending on what you connect, we receive:

Google Search Console: search queries, clicks, impressions, average positions, pages, and indexing status for the properties you choose.
Google Analytics 4: traffic, engagement and conversion reports for the properties you choose. These reports are aggregated; we don't request data about individual visitors.
Google Business Profile: your listing details, posts, reviews (including reviewers' public names and review text) and performance figures. With your approval, we post replies and update the listing.
Shopify, WordPress and other website platforms: your pages, posts, products, collections, metadata and search-related settings, and for stores, order and sales figures. With your approval, we publish or update content.
Stripe and other billing tools: revenue, subscription and payment figures, used to connect search and content work to business results.
Advertising platforms, such as Google Ads, Microsoft Advertising and Meta: campaigns, spend, clicks and conversions.
Other tools you choose to connect. The connection screen shows what each one reads and what it can change.

Some of these sources can include personal data about your own customers, such as a reviewer's name or the buyer on an order. We use it only to provide Dottpace to you, for example to show a review you may want to answer or to calculate revenue by page. We don't contact your customers or use their data for anything else.

From your site and the public web

Crawl data: we crawl the public pages of the sites you add, up to the limit in your plan, and store page content, metadata, links, speed and technical findings.
Test visits: when you run a mystery-shopper check, an automated browser visits your site the way a customer would and records what it saw, including screenshots.
AI answers about your brand: we ask AI assistants, such as ChatGPT, Gemini, Perplexity, Claude, Grok, Google AI Overviews and AI Mode, the questions you track. We store their answers, the sources they cite, and how they mention you and your competitors.
Search and link data: rankings, search volumes, backlinks and competitor data from SEO data providers.
Mentions: public pages and posts that match the watch terms you set.

This information is mostly about businesses and websites. It can include personal data when a public page or an AI answer names a person.

When you visit our website

We count visits with Vercel Web Analytics, which doesn't use cookies. It shows us, in aggregate, which pages are viewed, which sites send visitors, and broad details such as country, browser and device type. We don't use it to identify you.
Our hosting provider keeps standard server logs, including IP addresses, to keep the service secure and running.
Our pages load the Geist font from Google Fonts. To deliver the font, Google receives your IP address and browser details. Google Fonts doesn't set cookies.
Your browser stores your theme choice, where your visit came from (for that tab only), and, in the dashboard embedded on our home page, your actions there. Our Cookie Policy explains this.

In the Dottpace Founders community

If you join our community on Slack, Slack's own privacy policy applies to your Slack account. We see what you share there, such as your name, profile and messages, and we use your feedback to improve Dottpace.

Why we use it

For people in the EEA, UK and Switzerland, we also list the legal basis for each use.

To provide Dottpace: find what changed, explain why, prepare actions, apply the changes you approve and measure the results. Legal basis: our contract with you.
To run the waitlist: keep your place, send the real audit for your site at launch, and tell you when Dottpace opens. Legal basis: your request, and our legitimate interest in answering it.
To email you at launch and about Dottpace, because you ticked the box on the form. You can unsubscribe with the link in every email. Legal basis: your consent.
To bill you, with Paddle, and to keep the records tax and accounting laws require. Legal basis: our contract with you and our legal obligations.
To answer your messages and give support. Legal basis: our contract with you, or our legitimate interest in helping you.
To keep Dottpace secure and prevent abuse and fraud. Legal basis: our legitimate interests and our legal obligations.
To improve Dottpace, using feedback and aggregated information about how the product is used. Legal basis: our legitimate interests. Google user data is used for this only as the Limited Use requirements allow (see below).
To comply with the law and enforce our Terms. Legal basis: our legal obligations and legitimate interests.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects on you.

Google user data

When you connect a Google account, such as Google Search Console, Google Analytics, Google Business Profile or Google Ads, you choose what to grant on Google's consent screen. This is how we handle the data we receive from Google APIs ("Google user data"):

Access: we request only the access the features you use need. Most connections are read-only. For Google Business Profile, we also ask for permission to manage the listing, so we can post the replies and edits you approve.
Use: we use Google user data only to provide and improve the user-facing features of Dottpace that you see in the app, such as your search and analytics reports, findings, explanations, and the results of changes you approved.
Storage: we store it in our database, encrypted in transit and at rest, and keep it as described under "How long we keep data". Access tokens are stored encrypted.
Sharing: we share Google user data only with the service providers that run those features for you (hosting and database, and AI providers when you use AI features), only as far as needed to provide them; to comply with the law; for security purposes, such as investigating abuse; or as part of a merger, acquisition or sale of assets, after getting your explicit prior consent.
We don't sell Google user data, and we don't transfer it to advertising platforms, data brokers or information resellers.
We don't use or transfer Google user data to serve ads, including retargeting, personalized or interest-based ads.
We don't use Google user data to determine credit-worthiness or for lending.
We don't use Google user data to develop, improve or train generalized AI or machine-learning models.
No person reads your Google user data unless you give us your agreement for specific data (for example, when you ask us for help with a specific report), it's needed for security purposes such as investigating abuse, it's needed to comply with the law, or the data has been aggregated and anonymized for our internal operations.
You can disconnect a Google account anytime in Dottpace settings, or remove Dottpace's access on your Google Account permissions page. We then stop collecting data from it, and you can ask us to delete what we already have.

Dottpace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI processing

Dottpace uses AI models to explain changes, answer your questions in Ask Dottpace AI, draft content and replies, and check how AI assistants describe your brand. When you use these features, the relevant parts of your data, such as the search figures behind a finding or the page you're editing, are sent to an AI provider to produce the result you asked for.

We use AI providers through their business APIs, under terms and settings that don't let them use our requests to train their models.
When we track what AI assistants say about your brand, we send them the questions you track, not your private account data.
AI output can be wrong. Nothing an AI drafts is published on your site unless you approve it.

Service providers we use

These providers help us run Dottpace (they're often called subprocessors). Each one receives only what it needs to do its job.

Hosting and database: Vercel (hosting and cookieless website analytics) and Supabase (database).
Payments: Paddle, our Merchant of Record. Paddle sells the subscription to you and handles payment, tax and invoicing. It is responsible for the payment data it collects, under its own privacy policy.
Email: Resend, to send waitlist, account and product emails.
AI providers: Anthropic, OpenAI, Google, Perplexity and xAI.
SEO data: DataForSEO, for rankings, search volumes, backlinks and search results.
Browser automation: Browserbase, to load pages that need a real browser and to run mystery-shopper checks.

We'll update this list before a new provider starts handling your personal data. You can ask us for the current list anytime. We may also disclose data when the law requires it, to protect people's safety or our rights, or as part of a merger, acquisition or sale of the business, with notice to you.

We don't sell your personal data

We don't sell personal data, and we don't share it for cross-context behavioral advertising (ads targeted at you based on what you do on other businesses' sites). There are no ad or tracking pixels on our site. Because of that, there's nothing to opt out of, but we honor Global Privacy Control signals anyway.

How long we keep data

Waitlist and audit requests: until 12 months after launch, or until you unsubscribe or ask us to delete them, whichever comes first. We keep your email address on a do-not-email list so we don't contact you again. If you become a customer, your details become part of your account.
Account data: for as long as your subscription is active. Historical data, such as search, analytics, crawl and AI answer history, is kept for the data history in your plan (2, 3 or 5 years), and older history is deleted on a rolling basis.
After you cancel: your account stays available, read-only, for 30 days so you can export what you need. Then we delete your account data. Copies in backups are deleted within a further 30 days.
Billing records: as long as tax and accounting laws require. Paddle keeps its own records as the seller.
Server and security logs: only as long as needed for security and troubleshooting.

We may keep specific data longer only where the law requires it or to resolve a dispute, and only for that purpose.

Security

All connections use encryption in transit (HTTPS/TLS), and our database is encrypted at rest.
Access tokens for connected accounts are stored encrypted and used only by the service.
Connections ask for the narrowest access each feature needs. Changes to your site run only after your approval, and each one is recorded.
Access to production systems is limited to the people who run Dottpace and protected with multi-factor authentication.
Payment details are handled by Paddle and never reach our servers.

No system is perfectly secure. If a breach affects your personal data, we'll tell you without undue delay and as the law requires.

Your rights

Everyone

Wherever you live, you can ask us what personal data we have about you, ask for a copy, ask us to correct it, or ask us to delete it. You can unsubscribe from emails with the link in each one. Write to hello@dottpace.com. We may need to confirm your identity first. We'll answer within one month; if we need more time, as the law allows, we'll tell you why. We won't treat you differently for using your rights.

California and other US states

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing (we don't sell or share it); to limit the use of sensitive personal information; and not to be discriminated against for using these rights. You can use an authorized agent; we'll ask for proof that the agent may act for you.

In the last 12 months, we have collected these categories of personal information, from the sources and for the purposes described above:

Identifiers, such as your name, email address, IP address and account IDs.
Commercial information, such as your plan, subscription and transactions.
Internet activity, such as how you use the app, the referrer and campaign tags of your visit, and server logs.
Professional information, such as your business, site and role, if you share them.
Sensitive personal information: only your account sign-in details, used only to sign you in.

We disclose these categories for business purposes only to the service providers listed above. Residents of other US states with privacy laws, such as Virginia, Colorado, Connecticut and Texas, have similar rights. If we decline your request, you can appeal by replying to our answer, and we'll tell you the result and how to contact your state attorney general if you disagree.

EEA, UK and Switzerland

Under the GDPR and the UK GDPR, you have the right to access your personal data, correct it, erase it, restrict its use, receive it in a portable format, and object to its use, including for direct marketing and where we rely on legitimate interests. Where we rely on your consent, you can withdraw it at any time. You can also complain to the data protection authority where you live or work, though we'd appreciate the chance to help first.

If we hold your data because a Dottpace customer connected it (for example, you left a review for one of our customers), please contact that customer first. We'll help them answer you.

Children

Dottpace is a business service for adults. It isn't directed to children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to us and we'll delete it.

International transfers

We're based in Türkiye, and our service providers operate in the United States and other countries, so your data may be processed outside the country where you live. When we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on recognized safeguards, such as the European Commission's Standard Contractual Clauses and the UK Addendum in our providers' data processing terms, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

Changes to this policy

We'll post any update on this page and change the date below. If a change materially affects how we use your personal data, we'll tell you by email or in the app before it takes effect.

Contact

Dottpace, Türkiye. Email: hello@dottpace.com. For questions about a payment, you can also contact Paddle at paddle.net.

Last updated October 14, 2026.