Privacy

Controller and contact

The controller under the General Data Protection Regulation (GDPR) is
Stead Network, Inc., a Delaware corporation
Wuhlestraße 7a, 12683 Berlin, Germany
Contact: hello@atstead.com

This notice covers our website at atstead.com and the Stead application. For each situation it says what data we process, for which purpose, on which legal basis (Art. 6 GDPR), which service providers process it for us (Art. 28 GDPR), whether data leaves the EU (Art. 44 et seq. GDPR), and how long we keep it.

1Visiting our website

In brief: Our website and application run on a server of Hetzner Online GmbH in Germany. We use no analytics, no advertising, no tracking pixels and no scripts or fonts from other providers. We set cookies only where the service cannot work without them.

Data: To deliver a page, your browser sends us technical data such as your IP address, the page requested, the time, and your browser type. We use the IP address for a short time to limit repeated requests and to stop abuse (for example too many sign-in attempts). It is held in memory only and not written to disk.

Cookies and browser storage: We set only what is technically necessary:

In addition, the application stores a few settings in your browser's local storage (for example the colours you chose for brands, and whether you have already read today's briefing, or whether you have been offered the tour of the assistant), and, for as long as the tab is open, which conversation with the assistant is open, so that it is still there after a reload. They stay on your device.

Legal basis: Delivering the website securely is our legitimate interest (Art. 6(1)(f) GDPR). Storing and reading the cookies and settings above is strictly necessary for a service you request and therefore needs no consent (§ 25(2) no. 2 TDDDG).

2Signing up and signing in

In brief: To create an account we need your business email address. You sign in with a link we email you.

Data: Your email address, and the name, company and website details you enter. Until you confirm your email address, these details wait for at most thirty minutes in a file on our server and are then used to create the account or discarded. Without an email address we cannot create an account; everything else you enter is voluntary. Once the account exists, we also keep what you enter later (for example your domain and brand name). We create an internal account ID. For each signed-in browser we store the type of device and browser (derived from what your browser reports; we do not store the full browser string or your IP address), when the session started and when it was last used. If you switch on two-step sign-in, we store the secret for your authenticator app and hashed backup codes. If you sign in with Google or LinkedIn where offered, we receive your name, email address and an identifier from that provider.

Purpose and legal basis: Creating and running your account and keeping it secure (Art. 6(1)(b) GDPR). Confirming a sign-in link opened on another device and the protection against misuse are also our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

3Using the product

In brief: Stead measures how your brand appears in answers of AI services. For that we process the data of your project, put your prompts to AI services, and store and evaluate the answers.

Data you enter: Your domain, brand and competitor names, your prompts, topics and markets, company profile, facts you give us for drafts, notes, and your settings.

Measurements: We send your prompts, together with the country to be measured, to a data provider, which puts them to publicly available AI services (such as ChatGPT, Google AI Mode, Google AI Overviews or Gemini) and returns the answers. No data about your account is sent with them. We store the answers, the sources and pages they cite, the searches the AI service ran, and the brands and names mentioned. To evaluate them (for example the tone of an answer, or whether a name is a brand), to create your company profile, topics and prompts, to write titles, question sheets and page drafts, and to answer the questions you ask in the dashboard, we use the AI models of a model provider. The facts you give us for page drafts are sent to it for that purpose. The provider does not use this data to train its models. To check the pages an answer cites, and your robots.txt, our server retrieves them from the public web under the name SteadBot; we keep what we derive from a page, not the page itself.

The assistant: What you write to the assistant in the dashboard is sent to our model provider together with the data of your project it needs to answer (for example measurements, profile, facts and prompts), and the answer comes back to you. When it reads a page of your website or a page cited in your measurements, our server retrieves it as SteadBot, as described above. We store each conversation with the project and the person who had it, so that you can open it again under "Earlier chats"; other people on your account do not see it. A conversation is deleted 30 days after its last message, and at once if you delete it yourself or delete the project or account. The short opening message is put together from your measurements without an AI model and is kept only in our server's memory for the rest of the day. Legal basis: providing the Service (Art. 6(1)(b) GDPR).

Connected AI apps (MCP): You can connect an AI app of your choice, such as Claude, ChatGPT, Cursor or Claude Code, to your account. It signs in through our login page; we then issue it a token that only works for this connection and keep a record of which app you connected, when, whether it may make changes, and when it was last used. When it reads your measurements or makes a change you confirmed, that data goes to its provider, under your own agreement with them; we have no control over what they do with it. We do not run an AI model for these requests. The record is deleted when you disconnect it, and with your account. Legal basis: providing the Service (Art. 6(1)(b) GDPR).

Logos in the dashboard: The small site icons next to domains are fetched by our server and delivered to you from our own address, so your browser does not contact those sites.

People named in answers: AI answers and the pages they cite can mention people, for example a company's founder or a practitioner. Such names can therefore end up in stored answers. The source is the answers of the AI services named above and the public pages they cite; the only recipient is the customer whose measurement it is. We do not search for people, do not build profiles of them and use these mentions only as part of that measurement. They are deleted with the customer's project or account. Our legitimate interest, and our customers', is to know what AI services say in their market (Art. 6(1)(f) GDPR). Informing each person individually would take disproportionate effort, so we publish this information instead (Art. 14(5)(b) GDPR). Anyone named can object and ask for deletion using the contact above.

Purpose and legal basis: Providing the Service you ordered (Art. 6(1)(b) GDPR). Error handling, security and improving the Service are our legitimate interest (Art. 6(1)(f) GDPR). We may use results in a form that identifies neither you nor anyone else (for example how a name is classified) to improve the Service for all customers.

4The free trial

Each business gets one free trial. To enforce that, we note on your account when your trial started, and we compare the domain of your email address with other accounts that had a trial; domains of public email providers are not compared. Stripe gives us a fingerprint of the card you entered: a value that is the same for the same card but does not reveal the card number. We keep it on your account to recognise a card that has been used for a trial before. Both are kept as long as your account exists. When an account that had a trial is deleted, we keep only one-way hashes of its email address, its email domain and the card fingerprint, from which none of them can be recovered, so that the same address, business or card does not get a second trial. Legal basis: our legitimate interest in preventing abuse of the trial (Art. 6(1)(f) GDPR).

5Emails and contacting us

Emails we send: sign-in links, confirmation of your email address, warnings about a new device, messages about your account, your plan and your trial, and, on plans with page drafts, the weekly question sheet. We send them through Resend. We send no newsletters and do not measure whether you open our emails. Legal basis: Art. 6(1)(b) GDPR.

When you write to us: We process your email address, the content of your message and whatever else you include, to answer you. Our mailbox is hosted by Microsoft. Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR).

Reports of unlawful content: If you use our reporting form, we store what you report, your reason, the time, and your email address if you give one, so that we can decide and tell you the outcome. We keep reports and decisions as a record of how we handled them. Legal basis: our legal obligation under the Digital Services Act (Art. 6(1)(c) GDPR).

6Payments

Payments run through Stripe. You enter your card details, billing address, the name of your business and, where applicable, VAT ID directly on Stripe's checkout page; we never see your full card number. Stripe also records that you accepted our Terms and confirmed that you order as a business. We store the Stripe customer ID, your plan, the billing period and its dates. Invoices and payment records are kept as tax and commercial law requires. Legal basis: Art. 6(1)(b) GDPR, and for keeping records Art. 6(1)(c) GDPR. For its own fraud prevention and legal obligations, Stripe acts as an independent controller; see stripe.com/privacy.

7Service providers

These providers process personal data on our behalf and only as we instruct. We have data processing agreements with them (Art. 28 GDPR).

Two providers are named above by the service they provide. You can ask us for their names at any time, and we tell you (Art. 15 GDPR).

Where you choose to sign in with Google or LinkedIn, those providers act as independent controllers for the sign-in they perform. Apart from our service providers, we pass personal data on only where the law obliges us to.

8Transfers outside the EU

Some providers above are based in, or may access data from, the USA. Such transfers rest on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses. You can ask us for a copy of the clauses at the address above. For Israel, the European Commission has decided that the level of data protection is adequate.

9How long we keep data

We keep account and project data, including measurements, for as long as your account exists. After your plan or trial has ended, the dashboard is closed, but the data stays so that you can continue with a new plan, and on request we send it to you. If an account has had no plan for three months, we delete it; we tell you by email thirty days before. You can delete your account in the application; the deletion takes effect after fourteen days, during which you can undo it. After that we delete the account together with its projects, prompts and measurements. Conversations with the assistant are deleted thirty days after their last message. Signed-in devices are deleted thirty days after their last use. Backups of the database are kept for seven days, other backups for fourteen days, and are then overwritten. Invoices and payment records are kept for as long as tax and commercial law require, generally up to ten years.

10Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw consent at any time with effect for the future. Write to hello@atstead.com; we answer within one month.

Right to object. Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You may also complain to a data protection supervisory authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information; you may equally go to the authority where you live or work.

11Further information

Security: Connections are encrypted (HTTPS), the database connection is encrypted and its certificate verified, and access to personal data is limited to those who need it.

Automated decisions: We make no decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).

Children: The Service is for businesses and not directed at anyone under 16.

If you are in the United States: We do not sell personal information and do not share it for cross-context behavioural advertising. This notice also serves as the notice required by the Delaware Online Privacy and Protection Act.

Changes: When this notice changes, the date at the top changes with it. If a change affects what we process about you, we will tell customers by email.