Privacy policy

Last updated October 27, 2026

This page says what Fecto collects, why, who else handles it, and how to get it deleted. We don’t sell personal data and we don’t use it for advertising.

What we collect

• Your account: your email, a name, and either a hashed password or your Google profile (name, email, picture) if you sign in with Google. Sessions record the IP address and browser they came from, for security.
• Agent connections: when you connect a coding agent, we store the access it was given so it can act for you, until you disconnect it. We log which Fecto tools it calls, whether they worked and how long they took, but not what it sent.
• Sites and plans: the sites you add, scan results, the goals you ask for, plans, checks and charges, and the change links (such as pull request URLs) your agent logs.
• Scans: anyone can scan a public website. We fetch its public pages and keep the score and findings, so we can show changes over time and compare sites in aggregate. Scans from the homepage are limited per IP address, which we keep in memory only for that.
• AI answer snapshots: when you ask what AI says about a site, we send short questions about the site's category (never your email or account details) to the AI engines below, and keep their answers and the pages they cite for 7 days so repeat requests don't ask again. Limits are counted per account and per IP address.
• Your business record: the facts and buyer questions you confirm on the dashboard. Questions can't contain names, emails, phone numbers or links. They stay private to your account; only Fecto's generic category questions are shared across sites.
• Listing requests: if you ask for help getting listed on a page, we keep the page, the draft pitch and whether you sent it, and look at the page again about 30 days later.
• Connected sources: if you connect Google Search Console, we keep a read-only access token, encrypted, and read your site's search queries and impressions. They're shown only to your account. Disconnecting deletes the token.
• Payments: your card is saved and charged by Stripe, through Autumn. Fecto never sees or stores the card number.

The Fecto tag on your site

The tag counts page views and conversions (form sends and goals you mark) so plans can be measured. For each event it sends the page path and the event name; for page views, also the website the visitor came from (its host name only, or the utm_source value), so visits from AI assistants can be counted. It sets no cookies and stores no IP addresses: visitors are counted with a code made from the IP address, browser and date that changes every day and can’t be turned back into either. If you put the tag on your site, mention this measurement in your own privacy notice.

Why we use it

• To run Fecto: sign-in, scans, quotes, verification and billing.
• To email you about your account: confirming your email, resetting your password, and plan results.
• To keep Fecto safe and working: limits, abuse prevention and fixing problems.

Who else handles it

• Vercel hosts the website and servers, and counts page views and page speed on fecto.ai itself without cookies (Vercel Web Analytics and Speed Insights).
• Neon stores the database (AWS, us-east-1).
• Amazon Web Services (Bedrock) runs the Claude model that reads the goal you type and words the plan card. It doesn’t receive your email or account details.
• Resend sends our emails.
• Google, if you choose to sign in with Google or connect Search Console, and the Places API, which reads public Google listings for profile goals.
• OpenAI, Perplexity and Anthropic answer the category questions for AI snapshots and, for sites that confirm buyer questions, regular measurement runs. They receive the questions, not your account details. Anthropic's Claude API also runs Claude with web search.
• Cloudflare Turnstile checks that a snapshot request comes from a person, when you aren't signed in.
• Stripe and Autumn handle billing.
• Google PageSpeed Insights loads your public home page to measure speed for speed plans.

They process data for us under their own security and privacy terms. Data is stored in the United States.

How long we keep it

Account, site and plan data stay while your account is open. Records of charges are kept as long as tax and accounting rules require. Tag events are kept while the site is on your account, so plans can be measured. Cached AI answers are kept for 7 days; measurement-run answers while a site needs them, then deleted with the panel.

Your choices

You can ask us for a copy of your data, to correct it, or to delete your account and its data, by writing to support@fecto.ai. We’ll reply within 30 days. Depending on where you live you may have further rights, such as objecting to processing or complaining to a data protection authority.

Children

Fecto is for businesses and isn’t meant for anyone under 18.

Changes

If we change this policy in a way that matters, we’ll tell you by email or in the dashboard before it takes effect.

Questions: support@fecto.ai