Privacy policy

This policy explains how Suggestible handles personal information: what we collect, why, who we share it with, how long we keep it and the rights you have. It is written for the United Kingdom (UK GDPR and the Data Protection Act 2018), the European Union and European Economic Area (the GDPR) and South Africa (the Protection of Personal Information Act, POPIA).

Some features this policy covers, such as connecting your own Google account, self-serve sign-up and payments, may not be available to you yet. Where this policy describes such a feature, it applies once the feature is available.

1. Who we are

Suggestible is provided by Ascend Group Media, trading as Suggestible (suggestible.ai), of 7 Main Road, Heathfield, Cape Town, 7945, South Africa ("we", "us"). You can contact us, and our Information Officer under POPIA, at info@ascendgroupmedia.com.

When we are the controller (the "responsible party" under POPIA). We decide how and why personal information is used for: the sign-in and security details of everyone who uses Suggestible (owners, team members and client viewers); billing; support; the records of who accepted our terms; the logs of any support access to an account; creating anonymous, aggregated statistics about how the service performs; and visitors to this website.

When we are a processor (an "operator" under POPIA). Agencies and individuals put information about their own clients, brands and teams into Suggestible, and may invite client viewers. For that information our customer is the controller and we act on its instructions under our data processing addendum. If you are a client of one of our customers, please contact that customer first.

2. What we collect

• Account details: your name, work email address, company or brand name, country, your role in the account, and whether your account is for an agency or for an individual.
• Sign-in and security details: a one-way hash of your password (never the password itself), your two-factor authentication settings and backup codes, sign-in times, IP addresses and security events such as failed sign-ins.
• What you track: the prompts (questions) you add, the places they are asked in, brand and rival names, website addresses, and the answers, links, scores, insights, page audits, fix guides, article drafts and reports Suggestible produces from them.
• Google data you connect: if you connect Google Analytics or Google Search Console, the Google account email you connect with and the report data you choose (see section 5).
• Billing details: billing name, email and address, tax number, plan and payment history. Card details are collected and held by our payment provider, Stripe; we never see or store full card numbers.
• Support messages you send us, and our replies.
• Records of agreement: when you accept our terms, an updated version or the viewer terms, who accepted, for which account, which version and a fingerprint of its text, the time, a keyed hash of your IP address (not the address itself), your browser, where you accepted and the words of the box you ticked.
• Support access logs: if an owner switches on support access, or we must look into a security incident, abuse or a serious fault, a record of which staff member looked at the account, when, for how long and why.
• Visits from AI crawlers: if you install our snippet or connect a log feed, the crawler's name (user agent), the page and the time, and any IP address the log feed sends.
• Technical details: IP address, browser and device type, and server logs, used to run, secure and fix the service.

This website sets no tracking or advertising cookies and runs no analytics scripts. If you use the theme switch, your choice is kept in your own browser's storage. See the cookie policy.

Please do not put sensitive personal information (for example health details, or information about a private individual) into prompts. Prompts are sent to third-party AI assistants to be answered (section 6).

3. Why we use it, and our lawful basis

We do not send marketing emails without your consent, and you can withdraw consent at any time. We do not sell personal information, and we do not use it for advertising.

4. Automated decisions

Suggestible scores how visible a brand is in AI answers. These scores are about brands and websites, not about people, and we make no decisions with legal or similarly significant effects on anyone by automated means.

5. Google user data

Connecting your own Google account is not available yet. This section describes how it will work once it is. If you connect a Google account, Suggestible asks Google only for read-only access: your basic profile (to show which Google account is connected), Google Analytics (read only) and Search Console (read only). We use this access to list the properties and sites you can read, to let you pick one for each client or site, and to read the reports Suggestible shows you: visits that arrive from AI assistants, and Search Console clicks, impressions, positions, queries and pages.

Suggestible's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google data only to provide and improve the features you see in Suggestible; we do not use it for advertising, we do not sell it, we do not let people read it except with your permission, for security, or where the law requires, and we do not use it to train general AI models.

Your Google refresh token is encrypted before it is stored, and short-lived access tokens are never stored. Google data is kept in your account only and is never shown to another customer. You can disconnect at any time in Suggestible, or remove access in your Google account settings; when you disconnect in Suggestible we revoke our access at Google and delete the stored token. Report data already read stays in your account until the account is closed or you ask us to delete it.

6. AI assistants

To measure what AI says about a brand, Suggestible sends your prompts, the places they are asked in and, where needed, brand and website names to AI assistants and to the services that reach them (listed on the sub-processors page). The answers come back to us and are stored in your account. Those providers handle the prompts under their own terms for business customers.

7. Who we share it with

• Our sub-processors, who host, store, email, take payments or answer prompts for us, under contracts that protect the information. The current list is on the sub-processors page.
• People in your account: owners and admins of an account can see its team and its data. An agency's client viewers see only the clients they are assigned to, and never billing details.
• Authorities and advisers, where the law requires it or to protect our rights, and our professional advisers under a duty of confidence.
• A successor: if Suggestible moves to another company in our group or to a buyer, your information moves with it under this policy, and we will tell you first.

8. International transfers

Our main database and the app run in London, United Kingdom. Some sub-processors are based in, or reach providers in, other countries, including the United States. Where personal information leaves the UK, the EEA or South Africa, we rely on an adequacy decision or put safeguards in place: the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, and for South Africa, agreements that give protection substantially similar to POPIA (section 72). You can ask us for a copy of the relevant safeguards.

9. How long we keep it

• Account and tracking data: for as long as your account exists. When a free trial ends without a paid plan, tracking pauses and we keep the history for 90 days, after which we may delete it. When an account ends, the owner can sign in and export its data for 30 days; we then delete or anonymise it within a further 60 days, and copies in our backups are overwritten within 35 days after that. You can ask us to delete your data sooner (section 11).
• Billing records: for as long as tax and accounting law requires.
• Google tokens: until you disconnect, the connection stops working, or the account closes; then they are deleted.
• Security logs: for a limited period, for security and abuse prevention.
• Records of agreement: for as long as the account exists and 6 years after it ends, as evidence of what was agreed.
• Support access logs: with our audit records, for up to 6 years.

10. Security

At launch, we will protect personal information with measures that fit the risk, including encryption in transit, encryption of Google tokens at rest (AES-256-GCM), two-factor sign-in with an authenticator app for every user, separation of each account's data with tests that check it, rate limits and bot checks on sign-in and sign-up, and access for our staff only where needed: our staff see the content inside an account only when an owner switches on support access (for up to 7 days, or until they switch it off), or to investigate a security incident, abuse or a serious fault, or where the law requires, and every such visit is read only unless you ask otherwise, and logged. No method is perfectly secure. We do not hold any security certification. If a breach puts your information at risk, we will tell you and the relevant regulator as the law requires.

11. Your rights

Depending on where you are, you have the right to:

• ask whether we hold information about you and get a copy of it;
• have inaccurate information corrected, and incomplete information completed;
• have information deleted, or its use restricted;
• object to our use of it, including for direct marketing, and where we rely on legitimate interests;
• receive information you gave us in a portable form (UK and EU);
• withdraw consent where we rely on it, without affecting what was done before.

To use a right, write to info@ascendgroupmedia.com. We may need to confirm who you are. We reply within one month (UK and EU) or within a reasonable time (South Africa), and there is normally no charge. If your request is about a client account an agency runs, we will pass it to that agency, which is the controller.

You can also complain to a regulator:

• United Kingdom: the Information Commissioner's Office (ico.org.uk).
• European Union and EEA: the data protection authority where you live or work.
• South Africa: the Information Regulator (inforegulator.org.za).

12. Children

Suggestible is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children's information.

13. Changes to this policy

We will post any change here with a new effective date, and tell account owners by email before a significant change takes effect.

14. Contact

Ascend Group Media, trading as Suggestible (suggestible.ai), of 7 Main Road, Heathfield, Cape Town, 7945, South Africa. Email: info@ascendgroupmedia.com.