Privacy policy

Preferly (https://www.preferly.ai) is run by Avant Tech Solutions PR LLC, a company in Puerto Rico ("we", "us"). Preferly asks AI models how they describe and recommend a business, and shows the result to the business owner.

Questions about this policy: hello@preferly.ai.

This policy covers preferly.ai, the free check, the paid full report, our creator program, and our crawler, PreferlyBot. It explains what we collect, why, who we share it with, how long we keep it, and what rights you have.

What you type in

• Your email address and name, when you start a free check or buy a full report.
• Business details: the business name, website and location (city or region).
• For direct purchases, the details you type to find your business, and the business you pick from our list of candidates.

What we create when you use the service

• Check sessions. One record per started free check: your email, a normalized copy of it (lowercased, "+tags" removed, Gmail dots ignored, so we can limit one free check per mailbox), the business details, timestamps, and the state of the run.
• Email codes. We email you a 6-digit code to prove the address is yours. We do not store the code. We store only a keyed hash (an HMAC) of it. It expires after 10 minutes and allows 5 guesses. The hash stays in the check session record.
• Leads. Your email, name and website, whether you ticked the box asking for product updates (marketing_ok), and whether you verified the code.
• Hashed browser identifier. We store a SHA-256 hash of your browser's User-Agent header, so we can spot bot bursts. We do not keep the header itself.
• Orders. For the $99 report: your email, the amount and currency, our order status, the Stripe checkout session id and payment intent id, and a hash of your private report link. We never see or store your card number. Stripe handles it.
• Run results. The result of each check: public information about the business (from its public website and, for local businesses, its public Google Business Profile), the questions we asked the AI models, their full answers, the competitors they named, the pages we fetched from the website, our scores and fixes, and timing and cost figures. We do not copy your email into the run itself; runs are linked to your order or check session by internal ids.
• Emails we send you. The verification code, your free report (score, top finding and a private link to the report), and for a full report, the report link and any refund notice. We send them through Resend.
• Where you came from. If you arrive from a campaign link or another website, we note the campaign tags, the referring site's host name and the page you landed on, and save that with your check, lookup or order (see "Analytics").
• Creator referrals. If you arrive through a creator's link, we save PromoteKit's referral id (from the promotekit_referral cookie) with your check, lookup or order, so the creator is credited and you get their discount (see "Cookies").
• Free AI crawler check. When you use the free AI crawler check, we store the domain you checked and a one-way hash of your IP address for 7 days, to limit abuse. We don't store the result.
• Preferly in ChatGPT. When you ask Preferly to check a website inside ChatGPT, ChatGPT sends us the website address and an anonymized user ID that OpenAI creates so apps can limit abuse. We run the same public check as our free AI crawler check and send the result back to ChatGPT. We store the domain checked and a one-way hash of that anonymized ID for 7 days, to limit abuse. We don't store the result. ChatGPT may also send your language setting and an approximate location; we don't use or store them. How ChatGPT handles your conversation, including the result we return, is covered by OpenAI's terms and privacy policy.
• Creators. If you join our creator program, you sign up in our provider PromoteKit's creator portal. PromoteKit keeps your creator account: your name and email, the link name and promo code you choose, your answers on the application, your referrals and commissions, and the details you give it to get paid. We see your account, referrals and commissions in PromoteKit's dashboard, and we record your link name (via) with the orders you refer. Creators don't see buyers' email addresses.
• Share links. If you turn on a public link for your full report, anyone with the link can see a summary: your business name and website, your score, how often AI named you, how many competitors were named instead, and the headline findings. If you choose, it also shows up to three competitors' names and up to two examples where AI contradicts your website. Your fix list, code and email address are never on it. You can turn the link off at any time, which breaks it everywhere. Social sites and messaging apps may keep their own copy of a link preview after you turn the link off.
• Links for your web person. If you make one, anyone with that link can read your full report and download the PDF and AI Fix Pack, but can't re-scan or change your sharing. You can turn it off at any time.
• Gift links. An eligible full report comes with one gift link that gives one other person a discount. We record which order a gift came from and which order used it, so each gift works once. We tell you that your gift was used and when, never who used it, and we don't tell the person who used it who sent it.
• Share cards. If you make a share card from your free check, we save a copy of the numbers on it: your business name (unless you hide it), category, score, how often AI named you, how many competitors were named instead, and how many models said they couldn't find you. Anyone with the card's link can see it. You can remove it from your free report page.
• Shared-link visits. If you open a Preferly link that someone shared, we set the pf_share cookie. If you then run a check or buy a report, we record which shared link you came from, for our own analytics. It doesn't change your price, and the person who shared the link doesn't see it.

What we collect automatically

• IP address. We read your IP address from request headers to rate-limit starts, resends and lookups. The limiter lives in server memory only. We do not write IP addresses to our database (the free AI crawler check stores only a one-way hash of yours, see above). We pass your IP to Cloudflare Turnstile with the bot check (see "Who we send data to"). Our host, Vercel, also logs requests, which can include IP addresses, under its own policy.
• Cookies. See the next section.
• Server logs. We log errors. Our code logs check ids, not email addresses.

We use only the cookies below. None is used for advertising. pf_attr, pf_share and promotekit_referral are optional; you can block them without losing anything except a creator discount. The others are necessary to run the service.

We use Umami Cloud (Umami Software, Inc.) to count visits and see which pages and steps people use. Umami does not use cookies and does not store your IP address. For each page view or step it records:

• the page address, with private report and check addresses masked and only campaign tags kept;
• the referring website;
• your browser, operating system, device type and country;
• steps such as starting a check, confirming your email, starting checkout or completing a purchase (with the amount paid), sharing a report or card, or opening a shared link. These never include your email, your name, the business name or any id.

Umami keeps this data for 6 months. We also keep the campaign details from the pf_attr cookie with your check, lookup or order, for as long as we keep that record.

To opt out, block cookies for preferly.ai or use a tracker blocker. The service works the same either way.

We use these service providers. Each handles data only to provide its service to us.

What goes to the AI models

We send OpenRouter, and through it the companies that run each model:

• the business name, website and location;
• the questions we ask (for example "who is the best dentist in San Juan?");
• text from the business's public web pages, and the models' own earlier answers, when we ask a model to extract or check claims.

We do not send your email address or your own name to OpenRouter or any model provider. The name you type is used as the business name, so if the business name is your own personal name (for example a sole trader), it will be sent as a business name. Please do not enter personal data you would not want sent to AI providers.

Model providers have their own terms, and some may keep or use prompts under those terms.

AI answers may themselves mention people (for example an owner named on a website). We store those answers as part of the run result.

Other disclosures

We may disclose data if the law requires it, to protect our rights, or in a sale or merger of the business. We do not sell your personal data and do not share it for advertising.

To compare what AI says with what a website says, we fetch public pages of the business's website: robots.txt, the homepage and some of the pages it links to, such as about, contact and pricing. The agent-readiness checks also request up to 25 of the site's own links to find broken ones. For a full report, a test agent also visits the site in a real browser, which runs JavaScript, follows links and clicks only buttons that don't submit anything, to see whether an AI agent could reach the booking, contact or checkout page. Our crawler:

• identifies itself with the User-Agent PreferlyBot/1.0 (+https://preferly.ai/bot);
• never disguises itself or tries to get past bot protection (if a site challenges it, we report that and stop);
• never types, fills in fields, submits forms, books, buys, signs in, accepts cookies or terms, or solves a CAPTCHA;
• lets only requests that read a page through (GET, HEAD and OPTIONS) and blocks everything else;
• follows robots.txt rules for PreferlyBot when it checks links and runs the browser test;
• when configured, signs its requests with Web Bot Auth so sites can verify they come from us.

In the browser test, short excerpts of the page text and the list of links it may follow go to an AI model, through OpenRouter, to choose the next link.

More at https://www.preferly.ai/bot.

If you are in the EU, UK or a similar region, we need a legal basis. In plain terms:

The free-check form has a checkbox, "Send me occasional product updates. Unsubscribe anytime." It is unticked unless you tick it, and you can run a check without it. We record whether you ticked it (marketing_ok). The direct-purchase form does not ask, and buying a report does not sign you up.

We will not send product updates until every one carries a one-click unsubscribe link. You can withdraw your consent at any time: reply to any email from us or write to hello@preferly.ai, and we will record it. Transactional emails (codes, your report, refund notices) are not marketing and still go out when needed.

We keep data only as long as we need it, then delete it automatically:

Anonymized, aggregated statistics, with no business or person identifiable, may be kept indefinitely.

Depending on where you live (for example under the GDPR, the UK GDPR or California law), you may have the right to:

• Access the personal data we hold about you, and get a copy;
• Correct data that is wrong;
• Delete your data;
• Object to or restrict some uses;
• Take your data with you in a usable format;
• Opt out of marketing at any time;
• Opt out of the sale or sharing of your data (we do not sell it or share it for advertising);
• Withdraw consent where we rely on it;
• Not be treated worse for using these rights;
• Complain to your data protection authority.

To use any of these, email hello@preferly.ai from the address you used. We may need to confirm it's you. We reply within 30 days.

We may need to keep some data, such as order records for tax purposes. A deletion request removes the rest. If we delete a report, its private link stops working.

Report links are long random tokens, and we store only a hash of them. Email codes and cookies are signed with a secret key. Our admin area needs a single-use sign-in link sent to an approved address. No system is perfectly secure.

Anyone who has a report link can read that report. Keep it private.

Our providers are mostly in the United States and may process data elsewhere.

Preferly is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you think a child has given us data, email hello@preferly.ai and we will delete it.

We will post changes here and update the date at the top. If a change is significant, we will tell you by email or on the site.

Avant Tech Solutions PR LLC
151 Calle de San Francisco, Ste 200
San Juan, PR 00901
Email: hello@preferly.ai