This Privacy Policy describes how IntentNexus (“IntentNexus,” “we,” “us,” or “our“) collects, uses, shares, and protects personal information when you use the IntentNexus website at intentnexus.co, the IntentNexus application at app.intentnexus.co, our free audit tools, and any related services (collectively, the “Service“). If you do not agree with this Policy, please do not use the Service.
1. Who we are
IntentNexus is operated by IntentNexus (the “Company“), based in the United States. For questions about this Policy or our data practices, contact us at legal@intentnexus.co.
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, IntentNexus is the data controller for personal information collected through the Service.
2. Information we collect
We collect information in three ways: information you give us, information we collect automatically, and information we receive from third parties.
2.1 Information you provide
- Account information: name, email address, password (hashed and salted; never stored in plaintext), and account type (business or agency).
- Billing information: processed exclusively by Stripe, Inc. We do not store your full payment card details on our servers. Stripe provides us with a customer ID, billing email, last-four card digits, and subscription status.
- Brand and campaign inputs: brand name, domain, target keywords, competitor URLs, brand voice samples, uploaded logos, and any text or files you submit through the wizard.
- Generated content: articles, FAQs, schema markup, social posts, meta descriptions, and visual assets created within the Service.
- Communications: messages you send to support, feedback, feature requests, and any other content you submit.
- Newsletter subscriptions: email address and subscription status when you opt into our mailing list.
2.2 Information collected automatically
- Usage data: pages viewed, features used, wizard steps completed, time spent in the application, error events.
- Device and connection data: browser type, operating system, screen size, language, and approximate location derived from IP address.
- IP address (hashed): for free audit tools, we hash your IP using SHA-256 and store the hash alongside a tool identifier and timestamp solely for rate limiting. We do not retain raw IP addresses for free tool usage.
- Cookies and similar technologies: see Section 8.
2.3 Information from third parties
- Audit tool inputs: when you use a free audit tool, we may scan publicly accessible information from the domain you submit (HTML, sitemap, robots.txt, schema markup, AI engine search results referencing the domain). This is the same information any visitor or search engine could collect.
- AI engine queries: when running citation tracking, we query public AI services (ChatGPT, Perplexity, Google AI) with questions related to the user-submitted topic and parse the public response.
3. How we use information
We use the information described above for the following purposes.
| Purpose | Examples |
|---|---|
| Provide the Service | Run the wizard, generate content, store campaigns, sync brand profiles, deliver audit results. |
| Process payments | Manage subscriptions, send invoices, collect payment via Stripe, prevent payment fraud. |
| Communicate with you | Send transactional emails (account confirmations, billing receipts, password resets), respond to support requests, send newsletter content only if you’ve subscribed. |
| Improve the Service | Analyze usage to fix bugs, identify performance issues, prioritize features. |
| Enforce rate limits & prevent abuse | Compare hashed IPs against limits per tool to deter automated scraping and abuse. |
| Comply with law | Respond to lawful subpoenas, court orders, or regulatory requests. |
| Protect our rights | Investigate potential violations of our Terms of Service. |
4. Legal bases for processing (EEA, UK, Switzerland)
If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal information under one of the following legal bases:
- Contract (Article 6(1)(b) GDPR): to deliver the Service you subscribed to.
- Legitimate interests (Article 6(1)(f) GDPR): to operate, secure, and improve the Service; to prevent abuse; to enforce rate limits.
- Consent (Article 6(1)(a) GDPR): for newsletter subscriptions and any optional cookies. You may withdraw consent at any time by emailing legal@intentnexus.co or clicking unsubscribe.
- Legal obligation (Article 6(1)(c) GDPR): to comply with tax, accounting, and other legal requirements.
5. How we share information — sub-processors and third parties
We share personal information only as described below. We do not sell personal information to third parties for advertising.
5.1 Sub-processors
The following third parties process personal information on our behalf as sub-processors. We have contracts with each requiring them to protect personal information consistent with this Policy.
| Sub-processor | Purpose | Data shared | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management | Name, email, payment card, billing address | United States |
| Supabase, Inc. | Database, authentication, edge function hosting | All account data, generated content, usage logs | United States (AWS us-west-2) |
| Anthropic, PBC | Long-form content generation (Claude) | Brand inputs, content prompts (no payment data) | United States |
| Google LLC | Live search and reconnaissance (Gemini API) | Brand inputs, search queries (no payment data) | United States |
| OpenAI, L.L.C. | Fallback content generation (GPT-4.1 Nano) | Brand inputs, content prompts (no payment data) | United States |
| Perplexity AI, Inc. | Verified-fact retrieval (Sonar Pro) | Topic queries (no payment data) | United States |
| Vercel, Inc. | Frontend application hosting | IP addresses, request logs | United States, global edge |
| Automattic, Inc. (WordPress.com / Jetpack) | Marketing site hosting, newsletter delivery | Email addresses (newsletter only), site analytics | United States |
We may update this list as we add or remove vendors. Material changes will be reflected here, and significant changes will be communicated through the Service or via email.
5.2 Other disclosures
- Business transfers: If IntentNexus is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you before personal information becomes subject to a different privacy policy.
- Legal compliance: We may disclose information if required by law, subpoena, or to protect the rights, property, or safety of IntentNexus, our customers, or others.
- With your consent: We may share information with third parties when you give us specific permission.
6. AI processing of your content
When you submit brand information, content prompts, or campaign inputs, that data is sent to the AI sub-processors listed in Section 5.1 in order to generate output. Each sub-processor handles your data under its own privacy and data-use policies:
- Anthropic does not train its models on data submitted via the API. https://www.anthropic.com/privacy
- Google (Gemini API) does not train its models on paid API content. https://ai.google.dev/gemini-api/terms
- OpenAI (API) does not train its models on data submitted via the API. https://openai.com/policies/api-data-usage-policies
- Perplexity (Sonar API) does not train models on API content. https://www.perplexity.ai/hub/legal/privacy-policy
We do not control these sub-processors’ systems, but we contract with each to protect your information at a level consistent with this Policy.
7. Data retention
We retain personal information for as long as necessary to provide the Service and comply with legal obligations.
| Data type | Retention period |
|---|---|
| Account data (profile, brands, campaigns, generated content) | For the lifetime of your account; deleted within 30 days of account deletion request |
| Billing records | 7 years (US tax/accounting requirement) |
| Free audit tool scans + leads | 24 months from the date of scan |
| Hashed IP addresses (rate limiting) | 7 days rolling window |
| Newsletter subscriber list | Until you unsubscribe |
| Support communications | 3 years from the date of last contact |
| Webhook event logs | 90 days |
| Application logs | 30 days |
You may request deletion of your data at any time by emailing legal@intentnexus.co.
8. Cookies and tracking technologies
We use cookies and similar technologies to operate the Service.
| Cookie type | Purpose | Required? |
|---|---|---|
| Strictly necessary | Authentication session, CSRF protection, load balancing | Yes — Service won’t work without |
| Functional | Remember preferences (e.g., dark reading mode for blog), language, dismissed banners | Optional |
| Analytics | Anonymized site analytics via Jetpack | Optional — opt-in via cookie banner where required |
We do not use cookies for cross-site advertising tracking. Your browser’s “Do Not Track” signal is respected for analytics cookies.
To manage cookies, use your browser settings or the cookie preferences link in our footer.
9. International data transfers
We are based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our sub-processors operate.
For transfers from the EEA, UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (SCCs) with our sub-processors as the legal mechanism for cross-border transfers.
10. Your privacy rights
10.1 Rights for all users
You may at any time:
- Access your account data through the Service settings.
- Correct inaccurate data through your account settings or by contacting us.
- Delete your account and all associated data by emailing legal@intentnexus.co.
- Export your generated content from the Service.
- Unsubscribe from marketing email via the unsubscribe link in any newsletter or by contacting us.
10.2 Additional rights — EEA, UK, Switzerland (GDPR)
If you are in the EEA, UK, or Switzerland, you also have the right to:
- Restrict processing of your personal information.
- Object to processing based on legitimate interests.
- Receive your data in a portable, machine-readable format (data portability).
- Lodge a complaint with your local supervisory authority. A list of EU authorities is available at edpb.europa.eu.
10.3 Additional rights — California (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and sell (we do not sell).
- Delete the personal information we have about you.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of personal information (we do not sell or share).
- Limit the use of sensitive personal information (we do not collect sensitive personal information as defined by CPRA).
- Non-discrimination for exercising these rights.
To exercise California rights, email legal@intentnexus.co with subject line “California Privacy Request” and verify your identity using the email associated with your account.
10.4 How we respond
We will respond to verified privacy requests within 30 days. If we cannot complete a request within that window, we will tell you why and how long we expect to need.
11. Security
We protect personal information using:
- Encryption in transit (TLS 1.2+) for all data moving between you and our servers.
- Encryption at rest for database storage via Supabase.
- Row-level security (RLS) policies in our database — your data is isolated to your account at the database layer, not just the application layer.
- Hashed and salted passwords stored using industry-standard algorithms.
- Webhook signature verification for all Stripe events.
- Rate limiting and abuse detection on public endpoints.
No system is perfectly secure. If we become aware of a security breach affecting your personal information, we will notify you and applicable regulators in accordance with applicable law.
12. Children
The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the threshold). If you believe a child has provided personal information to us, contact legal@intentnexus.co and we will delete it.
13. Changes to this Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this Policy reflects the most recent revision. For material changes, we will notify you by email (if we have your address on file) or through a prominent notice in the Service before the change takes effect.
Continued use of the Service after a change indicates acceptance of the revised Policy.
14. Contact
For privacy questions, requests, or complaints:
Email: legal@intentnexus.co
Subject line: “Privacy Request” (we route these on priority)
We aim to respond to all privacy inquiries within 5 business days.