Privacy Policy

Aylake provides a free AI visibility check and paid local-visibility services for small businesses. We are based in the United Kingdom and are the data controller for the personal data described here.

Contact us at hello@aylake.com for anything in this policy, including to exercise your rights.

Payments are handled by Stripe. When you start a trial or a plan, we send Stripe your email address, your business's name, your language and the plan you chose. On Stripe's own page you enter your name, billing address, card details and, if you wish, a tax ID. Card details go straight to Stripe: we never see or store them. If you cancel, Stripe also gets the reason and any comment you give. Of the billing data, we keep only what is listed above: Stripe's customer and subscription identifiers, the plan, the number of locations billed, its status and dates, the amounts of payments, including any that failed, and the reason and comment you give if you cancel. We do not use advertising or tracking cookies, and we do not sell personal data.

Reports draw on publicly available information: your website, your Google Maps listing including a sample of public reviews, search results, and what AI assistants say when asked about your business. Reviews may contain the names their authors chose to publish publicly. We store this to produce your report and do not use it to build profiles of individual reviewers.

Legitimate interests for running the free grader, preventing abuse, and improving accuracy. We weigh these against your interests, which is why we rate limit rather than profile you, and keep only what a report needs.

Legitimate interests also for understanding why customers cancel, so we can improve the service: the reason you choose when you cancel, and any comment you add, which is optional. We keep them while your account exists and delete them with it.

Contract for providing an account and any paid plan you take.

Your request for emailing you the free report you asked for. Consent for anything else we email you about it, such as tips, which you give only by ticking the box. We keep a record of when you ticked it, the wording you saw and the language it was in; in Germany we ask you to confirm by email first. Every tips email has a link to stop the tips and a link to stop all email from us, and you can also withdraw by replying or emailing us.

We use the following providers. Each receives only what its function requires and processes it for us as our processor, except Stripe in part, as explained below the table.

Stripe processes payments for us as our processor. For its own legal duties, such as preventing fraud and meeting the obligations of card schemes and financial regulation, Stripe decides for itself how it uses payment data and is an independent controller, under its own privacy policy.

Two services watch our own systems and receive no personal data: updown.io (France), which checks from outside that the site and the service are up, and ntfy, which sends alerts about our systems to our staff's phones.

Transfers outside the UK rely on the UK International Data Transfer Addendum or equivalent safeguards. We send business information to AI providers, and review text when we suggest a reply or sort reviews by topic. We never send your account details to them. If you connect WhatsApp in Settings, we keep your WhatsApp number and send your alerts to it through Meta's WhatsApp Business Platform: the business, the star rating, the reviewer's public name, the review's text and a suggested reply. Meta also passes us what you send back, such as a button you tap or a reply you write. The message you send to connect is our record of your consent; send STOP, or disconnect in Settings, to withdraw it. We delete suggested replies sent to WhatsApp after 90 days, and your number when you disconnect. If SMS alerts launch, that provider will be listed here before anything is sent.

Aylake support can see your account only to help you or to keep the service running: read-only, for up to 15 minutes at a time, after confirming their identity with a second factor and recording why. Every time is kept in our audit trail, with the reason. Support can't change anything while looking.

Reports and their underlying data are kept for two years so you can compare over time and so we can improve accuracy. Account data is kept while your account exists and for six months afterwards, except two things: Google Business Profile data, which we keep only while your profile is connected, as set out under Google Business Profile data below; and the reason and any comment you give when you cancel, which are deleted with your account. Rate-limiting records are deleted after one day. Email addresses submitted for a report are kept until you ask us to remove them. Visit counts are kept as totals; the daily visitor codes are deleted the next day. Records of the emails we send, and of what our staff do, are kept for two years. Records of consent to tips, and of its withdrawal, are kept for three years after your last contact with us, as evidence of what you agreed to.

Under UK GDPR you can request access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Email hello@aylake.com and we will respond within one month.

Service and billing emails about your plan, such as the reminder before a trial ends or a note that a payment didn't go through, are sent whatever your marketing choices and have no unsubscribe link. Every other email we send has a one-click unsubscribe link, and unsubscribing stops all of those.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

We set one cookie, and only after you sign in: a session cookie that keeps you signed in. It is strictly necessary, so it needs no consent banner. We use no analytics, advertising or third-party tracking cookies: visits to the website are counted without cookies, as described above.

When you sign in with Google we receive your name, email address, profile picture and Google account identifier, and nothing else. We use them solely to create and authenticate your account. We do not share this data with third parties, and we do not use it for advertising or to train AI models.

Connecting a Google Business Profile is a separate step, with its own permission screen from Google, that an owner of your Aylake account chooses to take. What we then keep, why, who receives it and for how long is set out under Google Business Profile data, below. Aylake's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove our access to your Google account at any time at myaccount.google.com/permissions, and delete your Aylake account by emailing us.

What we keep.The email address of the Google account that gave permission, Google's identifier for it, and who on your team connected it; the permission itself, as a token we encrypt before storing it; and, for each location you choose: its listing details, such as its name, address, phone number, website, opening hours, categories, description and map position, with their history and any changes Google suggests; its reviews, with each reviewer's public name and profile photo, the rating, what they wrote, your replies and how each has changed; your photos' details and links; your posts; your menus; and daily performance figures, such as views, calls, direction requests and website clicks.

What we use it for.To show your listings and reviews in Aylake Echo and keep them up to date; to post on Google the replies and changes that you or your team approve; to suggest replies and sort reviews by topic; to tell your team about new one- and two-star reviews, about new reviews at the star ratings each person chooses on WhatsApp, and about changes made to your listing outside Aylake; to check what AI assistants say about your business against your listing; and to show where you rank on Google Maps. We don't use it for advertising, and we don't sell it.

Who receives it. Only these providers from the list above, and only what each task needs:

• OpenRouter, which passes to AI models your business's name and town in the questions we ask about you; a review's text and rating, the reviewer's first name and your business's name, to suggest a reply; and review text and ratings, to sort reviews by topic.
• Resend, which delivers the emails your team chooses to get. An alert names the location and the rating, the reviewer's public name and what they wrote, or which details of your listing changed.
• Meta, only for people on your team who connect WhatsApp, as described above.
• Serper, which receives your business's name, town, phone number, postcode and category, and your listing's map position, to find your listings on other sites and check where you rank on Google Maps.
• Neon, which hosts our database.

The replies and changes you approve go to Google.

How long we keep it.For as long as your Business Profile is connected. When a reviewer deletes a review on Google, we remove their name, photo and words from that review and its history in Aylake a day after we notice. When an owner disconnects, we delete what we copied from your profile and ask Google straight away to end our access, asking again until Google confirms; we keep the encrypted token only until then. If the same Google account is also connected to another Aylake account, Google can only end its access everywhere at once, so it stays connected there and we delete our copy of the token at once. Your locations stay, with their own details: their name, website, town and category, which connecting may have filled in from your listing and which you can change. Our audit trail keeps a record that the connection existed, with the Google account's email address. If an owner connects a different Google account instead, the listings it also manages carry over, and the rest are removed a day later with what we copied for them. When the connected Google account can no longer manage a listing, we remove that listing in the same way and tell your owners. We do the same if another Aylake account links one of your listings after the Google connection it came through here has not worked for a day. If your Aylake account is closed, everything is deleted with it.

Ending our access. An owner can disconnect at any time under Settings in Aylake Echo. You can also remove our access at myaccount.google.com/permissions, signed in with the Google account that gave it. We then stop updating your data, and disconnecting in Settings, or emailing us, deletes what we hold.

If we change this policy we will update the date above and, for material changes, email account holders.