Core infrastructure
Cloud hosting, managed database, cache or queue, and object storage providers may process customer information to operate the service.
Product operations
Payment, transactional email, support and consented analytics providers may process limited information for their defined service purpose.
AI providers
AI model providers may process prompts, retrieved evidence and generated artifacts when a customer requests an AI-assisted feature. Applicable provider roles, retention and training terms depend on the selected service and contract.
OpenAI: Google-derived AI evidence
When AI assistance and the relevant Google sharing permission are enabled, selected GSC search-query and page-path summaries with performance metrics and GA4 landing-page and traffic summaries may be sent to OpenAI with relevant project context to produce the requested content opportunities or recommendations. Each Google source is included only if you have enabled it for that project. These summaries remain Google-derived data even when aggregated. Google connection credentials are not sent as AI prompt evidence.
Manage your choices in Settings > Privacy & AI. AI assistance and Google sharing start off and are not accepted automatically when you register or connect Google. AI assistance allows OpenAI processing of your submitted messages, business answers and selected SEO evidence. Search Console and GA4 sharing are separate, optional choices for each project and your own requests. Saved choices apply to future requests until you change them; we do not ask again for every generation. Turning a permission off blocks future transmissions that have not already been sent, including pending work.
Google sign-in and viewing reports from connected Google services do not require AI sharing. Leaving the choice off does not recall earlier transmissions or delete saved results.
We do not opt in to sharing Google data with OpenAI for model improvement. We do not use Google data to train general-purpose AI models.
OpenAI may retain data for security and abuse prevention under its applicable terms. This is not a zero-retention promise. See OpenAI API data controls.
Previously generated content opportunities, recommendations and supporting evidence may be stored separately from a live Google connection. Disconnection does not retract data already processed by OpenAI, delete your Bostic.ai account, or automatically delete saved AI evidence, generated results or database backups.
See the Google data privacy disclosures for Google sign-in, read-only connections, data use restrictions, disconnection and deletion details.
Updates and questions
This page will be updated as the production vendor register changes. Questions about provider processing may be sent to privacy@bostic.ai.
Named services and what they receive
These are the principal services used by the implemented platform. Optional providers receive data when the relevant feature is enabled or requested; not every provider receives every customer's data. Their roles and processing terms depend on the service.
Hostinger · Hosting
Hosts the application, database, stored project records and background-processing infrastructure. Hosting includes the account and project data needed to operate Bostic.ai.
Stripe · Payments
Processes checkout, billing details, subscriptions and payment records. You enter card details on Stripe-hosted pages, not into Bostic.ai forms. Bostic.ai stores billing references and subscription status, not full card details.
Postmark · Transactional email
Delivers verification, security, report and contact emails. Receives recipient addresses, message content and delivery metadata needed for those messages. Sending a contact form can include its contents in an internal notification.
OpenAI · Optional AI processing
Receives prompts and selected project evidence for requested AI features when AI assistance is enabled. Google-derived evidence also requires its separate permission. The Google-specific controls, retention boundaries and restrictions on this page continue to apply.
DataForSEO · Search research
Receives the keywords, domains or URLs and market settings needed for requested rank, search-volume, trends and backlink research. It supplies search evidence; it does not receive your Bostic.ai password or Google connection credentials.
Google · Sign-in, integrations and measurement
Supports optional Google sign-in and authorized, read-only Search Console and GA4 connections. These are separate from public-site measurement. When configured, marketing measurement can send cookieless requests before consent or with Analytics storage off, as explained in the Cookie Policy.
Cloudflare Turnstile · Abuse prevention
Checks registration challenges using browser and network signals. A challenge result is verified by our backend before registration proceeds. This is a security check, not access to your saved SEO reports.
Sentry · Error monitoring when enabled
Receives filtered application-error diagnostics when centralized error monitoring is enabled. Our telemetry filters exclude credentials and raw request payloads; this service is used to investigate reliability issues, not to run SEO analysis.