Privacy Policy

Reflyma ("Reflyma", "we", "us") operates the AI search visibility analytics platform available at reflyma.com. This policy explains what personal data we process and why.

For any privacy request you can contact us at reflyma@gmail.com. We respond to verified requests within 30 days.

Account data: your name, email address, password hash (or Google sign-in identifier), organization name and role. This is required to create and secure your account.

Project data: the domains, brand names, aliases, topics, prompts and competitors you configure for tracking.

Analysis data: the responses returned by AI providers for your prompts, the extracted mentions, citations, competitors and computed metrics, plus crawled public pages from the domains you submit.

Billing data: subscription status, plan, and payment identifiers received from our payment processor. We never see or store your full card number.

Technical data: IP address, browser type, device information, and product usage events used for security, abuse prevention and reliability.

To provide the service: run prompts across AI providers, crawl the domains you submit, compute visibility metrics, generate reports and deliver them to you.

To secure the platform: authenticate you, enforce rate limits, detect abuse and investigate incidents.

To communicate: transactional emails such as account confirmation, password reset, report delivery, billing receipts and service notices.

To improve the product: aggregated, de-identified usage analysis. We do not use your project content to train third-party models.

Where GDPR applies, we rely on: performance of a contract (providing the service you signed up for), legitimate interests (security, abuse prevention, product improvement), consent (optional marketing emails and non-essential cookies) and legal obligation (tax and accounting records).

We share data only with infrastructure vendors required to run Reflyma: our cloud hosting and database provider, AI model providers used to answer your configured prompts, our transactional email provider and our payment processor.

We do not sell personal data and we do not share it with advertising networks.

We may disclose information where legally required, or to protect the rights, safety and property of Reflyma and its users.

Account and organization records are retained while your account is active. Analysis runs, crawl snapshots and reports are retained for the history window of your plan and are deleted or anonymized after account closure.

Guest (unauthenticated) tool sessions and their results expire automatically. Billing records are kept as long as required by applicable tax law.

Subject to your jurisdiction, you may request access, correction, deletion, restriction, portability, or object to certain processing. You can also withdraw consent to marketing at any time.

Most data can be edited or deleted directly in your dashboard. For a full export or account deletion, email reflyma@gmail.com from your registered address.

We use strictly necessary cookies for authentication and security, plus limited analytics to understand product usage. See our Cookie Policy for details and controls.

Data is encrypted in transit and at rest. Access is scoped per organization with row-level security, privileged operations are audit-logged, and secrets are stored in a managed secret store never exposed to the browser.

No system is perfectly secure; if a breach affects your data we will notify you and any relevant regulator as required by law.

Our providers may process data outside your country. Where required we rely on standard contractual clauses or equivalent safeguards.

Reflyma is not intended for children under 16 and we do not knowingly collect their data.

We may update this policy as the product evolves. Material changes will be announced in-app or by email before they take effect, and the date above will be revised.