Geoffy is operated by Geoffy Limited (company number 17295484).
1. Who we are
Geoffy Limited, 20 Wenlock Road, London, N1 7GU, United Kingdom.
Privacy contact: legal@geoffy.ai.
2. Data we collect
2.1 Merchants using the Geoffy app
When you use Geoffy on Shopify, WordPress, a headless storefront or another platform, we collect:
- Account details for the people who use the app: name, work email address and sign-in data.
- Store or site identifiers, and the settings you choose in Geoffy.
- Product data: titles, descriptions, variants, prices, stock, images, tags and collections.
- Billing status. Payments go through Shopify or through our billing provider. We do not store card numbers.
- Usage data, such as which features you use and when, and session recordings of how you use the app. Recordings hide what you type in forms.
- Data from tools you connect, only if you connect them:
- Google Search Console: search queries, pages, clicks and impressions for your site. This data is about searches, not about individual people.
- Judge.me: review text, star ratings and the reviewer’s display name.
- AI crawler visits to your site: the bot name, the page and the time of each request from an AI crawler. This data is about bots, not people.
Geoffy does not need your customers’ personal data to work. Where personal data of your customers reaches us through your platform, we process it only on your instructions (see section 4).
2.2 The free GEO Score
When you request a free GEO Score on geoffy.ai, we collect:
- Your website address.
- Your work email address. The form accepts only a work email whose domain matches the website. It does not accept personal addresses such as Gmail or Outlook.
- A security check result from Cloudflare Turnstile, which helps us block automated abuse.
To produce your score, we read the public text of your homepage and ask AI engines questions about your category. We then store your score and report, and email them to you.
2.3 The free AI check on our homepage
When you use the AI check on our homepage, you type a shopping question and, if you choose, your website address. To answer it, we:
- Send your question through OpenRouter to four AI engines (ChatGPT, Perplexity, Claude and Gemini), and through OpenRouter to TypeSafe to check that it is a shopping question. We do not send your website address to the AI engines.
- Read the public pages of your website: the homepage, its sitemaps and one product page.
- Run a security check with Cloudflare Turnstile.
We store your question, your website address, the result and a short summary of the answers (which brands and sources the engines named). We also keep these in our customer relationship system (Attio), linked to the business at that website address, so we can see which businesses use the check and contact the business about Geoffy. We do not store your IP address, and we do not link the check to you as a person unless you give us your email. To limit how many checks one visitor can run, we keep a counter under a one-way code made from your IP address. The code changes every day, and the counter is deleted within 2 hours. We keep the answers to a question for up to 24 hours, so a repeat question is fast. These answers hold no personal data.
The answers come from the AI engines, not from Geoffy. They can be wrong, and they change from day to day.
If you then ask for your GEO Score, we send your work email, your website address, your question and a short summary of the result to our lead workflow (Make) and our customer relationship system (Attio). Section 2.2 then applies.
We count how the check is used, for example how many checks finish. These counts use no cookies, and they do not include your IP address, email or question.
2.4 Visitors to geoffy.ai
- Your IP address and general location (country or region).
- Browser and device information.
- Pages visited and basic analytics data. If you accept analytics cookies, this includes a recording of how you use the site, such as clicks and scrolling. We hide what you type in forms.
- Your cookie choices (see the Cookie Policy).
- Messages you send through the support chat.
On our /live page we record requests from AI crawlers to geoffy.ai (bot name, page and time). This data is about bots, not people.
3. How we use data
We use data to:
- Provide and operate Geoffy, including generating content and structured data for your store.
- Run your free GEO Score and send you the results, and run the free AI check.
- Send you follow-up emails about your results and about Geoffy, if you asked for a free GEO Score or use Geoffy. Every email has an unsubscribe link.
- Keep a record of business contacts in our customer relationship system.
- Monitor performance, reliability and security, and prevent abuse.
- Improve the accuracy, safety and usefulness of Geoffy. We use aggregated and anonymised data for this where possible.
- Comply with legal obligations and respond to lawful requests.
We do not sell personal data.
4. Controller and processor roles
- For merchant account data, free GEO Score data, free AI check data, website visitor data and our business contact records, Geoffy Limited is the controller.
- For any personal data of a merchant’s customers that we process through the app, the merchant is the controller and Geoffy is the processor. Our Data Processing Addendum applies: geoffy.ai/dpa.
- Shopify may act as an independent controller under its own privacy policy.
4.1 Shopify data protection webhooks
Geoffy supports Shopify’s mandatory data protection webhooks:
customers/data_request: to answer customer data access requests.customers/redact: to delete or anonymise customer personal data.shop/redact: to permanently delete store data and credentials.app/uninstalled: to clean up store data when the app is removed.
These webhooks are verified with Shopify’s HMAC signature and are processed automatically. When we receive one, or when a merchant uninstalls the app, we delete stored access tokens and credentials, delete or anonymise customer personal data, and keep only non-personal or anonymised operational data where the law requires it. Deletion cannot be undone.
4.2 Logs
Our application logs do not record customer names or email addresses. Logs hold only the minimum data we need for security, auditing and reliability.
5. Legal bases
- Contract: to provide Geoffy to merchants who sign up.
- Legitimate interests: to run the free GEO Score or AI check you asked for, to send business follow-up emails to the work address you gave us, to keep business contact records, to secure Geoffy and prevent abuse, and to improve the service. You can object at any time.
- Consent: for optional cookies, where the law requires it.
6. Service providers (sub-processors)
We use these providers to run Geoffy. Each one processes data only for the purpose shown, under a contract that protects it.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting and storage | United Kingdom (London) |
| Neon | Database | European Union |
| Clerk | Sign-in and billing for non-Shopify accounts | United States |
| Shopify | App platform and billing for Shopify merchants | Canada and other regions |
| OpenAI | AI content generation | United States |
| OpenRouter | Access to AI models from OpenAI, Perplexity, Anthropic and Google, for content checks, the weekly AI test, the free GEO Score and the free AI check | United States |
| TypeSafe | Checks that a question in the free AI check is a shopping question. We reach it through OpenRouter. | United States |
| DataForSEO, Bright Data, Cloro | Search and AI answer data for the weekly AI test | European Union and United States |
| Search Console connection (only if you connect it), and business email | United States and other regions | |
| Judge.me | Review data (only if you connect it) | European Union |
| Cloudflare | Website delivery, security checks (Turnstile), AI crawler records, and running and storing the free AI check | Global |
| Make | Automation that runs the free GEO Score | European Union |
| Jina AI | Reads the public text of your homepage for the free GEO Score | European Union and United States |
| Attio | Customer relationship records | European Union and United States |
| Sentry, Axiom | Error tracking and logs | United States and European Union |
| PostHog | Product analytics and session recordings in the app and, if you accept analytics cookies, on geoffy.ai | European Union and United States |
| Tawk.to | Support chat on geoffy.ai | European Union and United States |
| Slack, Telegram | Internal alerts to our team about sign-ups and GEO Score requests | United States and other regions |
We tell merchants before we add a provider that processes their customers’ personal data, as the DPA sets out.
7. International transfers
Some providers process data outside the UK and the European Economic Area. When they do, we use safeguards that the law accepts, such as the UK International Data Transfer Addendum or the EU standard contractual clauses.
8. How long we keep data
- Merchant account and store data: while your account is active. When you uninstall the app or close your account, we delete or anonymise it without undue delay.
- Free GEO Score data (your website address, work email, score and report): 12 months from your last contact with us, unless you become a customer.
- Free AI check data (your question, website address and result): 7 days. The visitor counter: 2 hours.
- Business contact records in our customer relationship system: while we have a business reason to keep them. We review these records at least once a year and delete the ones we no longer need, or sooner if you ask.
- Logs and backups: for limited periods, only for security and reliability.
9. Your rights
Depending on where you are, you can ask us to:
- Give you a copy of your personal data.
- Correct data that is wrong.
- Delete your personal data.
- Restrict or object to how we use it, including for follow-up emails.
- Give you your data in a portable format.
To use these rights, email legal@geoffy.ai. We may need to confirm your identity first. To stop follow-up emails, click unsubscribe in any email.
10. Cookies
We use cookies and similar technologies on geoffy.ai for essential functions and basic analytics. See the Cookie Policy.
11. Contact and complaints
Questions about this policy: legal@geoffy.ai. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or to your local data protection authority.