SELISE GEO Privacy Policy

1. Introduction and Scope

SELISE GEO is a software-as-a-service platform that enables users to assess and monitor the visibility of brands in responses generated by artificial intelligence and search-related services.

This Privacy Policy explains how SELISE Group AG (“SELISE”, “we”, “us” or “our”) collects, uses, discloses and otherwise processes personal data in connection with SELISE GEO. It applies to the SELISE GEO website, the free public scan, user accounts and authentication, the SELISE GEO platform and workspace, brand, competitor, persona and query configuration, AI-assisted audits and related results, subscriptions and billing, support and other communications, and marketing activities.

This Privacy Policy applies where SELISE determines the purposes and means of processing personal data and therefore acts as a controller or equivalent responsible organisation under applicable privacy law.

Where SELISE processes personal data solely on behalf of a customer and in accordance with that customer’s instructions, the relevant processing is governed by the applicable agreement and Data Processing Agreement (DPA) between SELISE and that customer.

This Privacy Policy does not apply to independent third-party websites, services or platforms that are governed by their own privacy policies.

This Privacy Policy is intended to provide information required under applicable privacy and data protection laws, including the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and the UK data protection framework.

2. Who Is Responsible for Your Personal Data

The entity responsible for the processing described in this Privacy Policy is SELISE Group AG, The Circle 37, 8058 Zürich-Flughafen, Switzerland.

The privacy contact email is privacy@selisegroup.com.

SELISE acts as controller in relation to personal data for which it determines how and why the data is processed. This includes, where applicable, website and visitor information, free public scan data, account and authentication data, security information, billing and subscription information, service communications, marketing information, product analytics, and personal data processed for SELISE’s own legal, security and operational purposes.

Where SELISE processes personal data contained in a customer’s workspace solely on behalf of the customer and in accordance with the customer’s instructions, SELISE acts as the processor and the customer acts as the controller, as applicable under the relevant law. This may include the brand, competitor, persona and query information and audit results described in Sections 3.4 and 3.5.

If your personal data is contained in a customer’s workspace, you should normally direct your privacy request to that customer. SELISE will assist the customer in responding to the request where required.

3. Personal Data We Process

The personal data SELISE processes depends on how an individual interacts with SELISE GEO.

Providing personal data is generally voluntary. However, certain information is necessary to create and manage an account, provide SELISE GEO or process a paid subscription. If the required information is not provided, SELISE may be unable to provide the relevant service.

3.1 Website and Device Data

When an individual visits or uses the SELISE GEO website or platform, SELISE may automatically collect technical information relating to access and use. This may include the IP address, browser type and version, operating system, device type, device or session identifiers, date and time of access, pages or features accessed, referring website or URL, interaction and usage information, error and diagnostic information, security logs and other technical information generated through use of the service.

Certain technical information is necessary for the operation and security of the website and platform. Non-essential analytics, session-recording and advertising technologies, including Google Analytics, Microsoft Clarity, Google Ads and LinkedIn Ads, are used only where the required consent has been provided through the cookie consent mechanism.

3.2 Free Public Scan

SELISE GEO may allow a visitor to submit a website URL for a free public scan without creating an account. In connection with a public scan, SELISE may process the submitted URL, information retrieved from the relevant publicly accessible website, the results generated by the scan, the visitor’s IP address, device and browser information, security and server logs and related usage information.

SELISE acts as controller for personal data processed in connection with the free public scan. The scan accesses only publicly accessible pages of the submitted website for the purpose of generating the scan report.

If a visitor subsequently joins a waitlist, requests an expert consultation or otherwise contacts SELISE, SELISE may also process the visitor’s name, email address, organisation, contact details and information submitted through the relevant form.

3.3 Account Data

When an individual creates, accesses or uses a SELISE GEO account, SELISE may process the individual’s name, email address, organisation, account identifier, account role, authentication information, login history, login IP address, device information, security-related information and account preferences.

Authentication is provided through SELISE Blocks, SELISE’s identity and access management platform. Where a user chooses to sign in using a Microsoft or Google account, the relevant provider may also process authentication information in accordance with its applicable privacy terms.

3.4 GEO Workspace and Brand Data

When using SELISE GEO, users may create and maintain information relating to brands and their competitive environment. This may include the brand name, website URL, brand description, industry, target audience, products and services, keywords, competitor names, competitor URLs, persona names, persona descriptions, city, country, language, questions and query sets, query categories, settings, active or inactive query states and other information entered by the user.

Where the “Fetch from website” function is used, SELISE GEO may temporarily retrieve publicly accessible content from the relevant website to assist in preparing a proposed brand profile. The retrieved content is used to prepare the proposed profile. Information is saved to the workspace only where the user chooses to save it.

Competitor and brand information will often relate to businesses. However, such information may constitute personal data where it relates to an identifiable individual, including a sole trader, founder or other identifiable person.

3.5 AI Audit and Results Data

SELISE GEO conducts audits by submitting selected brand, competitor, persona and query information to supported artificial intelligence services. The information processed may include brand names, competitor names, persona information, geographic and language information, questions and prompts, AI-generated responses, cited sources, citation strength, mention information, list or ranking position, sentiment indicators, visibility indicators, share-of-voice information, competitor positioning, source domains and trend information derived from repeated audit runs.

AI-generated responses may contain personal data that was not originally provided by the user, including names or other information relating to founders, authors, executives or other identifiable persons.

Where personal data is obtained indirectly through AI-generated responses or publicly accessible sources, such information may be stored as part of the relevant audit or scan results. SELISE does not use such information for the purpose of evaluating the personal characteristics of the individuals concerned. Such information is retained in accordance with Section 9. Individuals may exercise their applicable rights under Section 12.

3.6 Billing and Transaction Data

Where a paid plan is used, SELISE may process information relating to subscriptions and billing. This may include the billing name, billing address, organisation, VAT or tax identification number, subscription plan, billing interval, renewal date, transaction records, payment status and payment token or payment reference.

Payment-card details are collected and processed directly by SELISE’s payment service provider, Adyen, and are not stored by SELISE. SELISE receives only the payment information necessary to manage the relevant transaction or subscription, such as a payment token, payment reference or payment status.

3.7 Communications and Marketing Data

Where an individual contacts SELISE, subscribes to updates, joins a waitlist or otherwise communicates with SELISE, SELISE may process the individual’s name, email address, organisation, message content, support communications, newsletter subscription status, marketing preferences, consent records, meeting or contact-request information and, where applicable, email engagement information.

Emails may be sent through SELISE Blocks using Amazon Simple Email Service (Amazon SES). Marketing communications may include technologies that indicate whether an email has been opened or a link has been selected, where permitted by applicable law and where the required consent has been obtained. Marketing communications include an appropriate unsubscribe option.

3.8 Information From Third Parties and Public Sources

SELISE may receive or obtain personal data from sources other than the individual concerned. These sources may include publicly accessible websites, authentication providers, payment providers, analytics providers, business customers, other users of the SELISE GEO workspace, artificial intelligence service providers, publicly available AI-generated responses, publicly available company information and other service providers acting on SELISE’s behalf.

Where information is obtained from public sources, SELISE processes it only for purposes connected with SELISE GEO and in accordance with applicable law.

4. Why We Process Personal Data and Our Legal Bases

SELISE processes personal data only for specified purposes and in accordance with applicable data protection law. Depending on the circumstances, the relevant legal basis may include performance of a contract, compliance with a legal obligation, SELISE’s legitimate interests or consent.

SELISE processes account, login, workspace, billing and communication information to provide and administer SELISE GEO, manage user accounts and subscriptions, provide support and comply with applicable legal and financial obligations.

SELISE processes submitted URLs, IP addresses, technical information, authentication data and security logs to operate and secure the Services, conduct public scans, prevent fraud and misuse, investigate incidents and protect SELISE, its users and its systems. SELISE may also process usage and technical information to maintain and improve the Services.

Where applicable, SELISE relies on its legitimate interests in providing, securing, supporting and improving SELISE GEO, preventing fraud and misuse, administering its business and protecting its legal rights. Where processing is necessary to provide the Services to an individual user, SELISE may rely on performance of the relevant contract. Where required by law, SELISE relies on consent, including for certain cookies, analytics, advertising and marketing activities.

Where SELISE processes personal data solely on behalf of a business customer, the customer determines the purpose and legal basis for that processing, and SELISE processes the data in accordance with the customer’s instructions and the applicable Data Processing Agreement (DPA).

For individuals in the European Economic Area (EEA) and the United Kingdom (UK), the principal legal bases relied upon by SELISE are contractual necessity, legal obligation, legitimate interests and consent, as applicable. Under Swiss law, personal data is processed in accordance with the principles and requirements of the Swiss Federal Act on Data Protection (FADP).

Where SELISE relies on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before the withdrawal.

5. Use of Artificial Intelligence

SELISE GEO uses artificial intelligence and AI-enabled services as part of its core functionality. AI may be used to assist in generating brand profiles, propose personas, generate or refine questions, submit audit queries, obtain responses from third-party AI engines, analyse visibility and competitive positioning, generate sentiment indicators, identify cited sources, and assist in producing comparative results and trends.

AI-generated brand profiles, personas and questions are proposals only. They are shown to the user for review and are saved only if the user chooses to save them, with or without changes.

Information submitted to AI services may include brand, competitor, persona and query information and, in some cases, personal data. AI providers used by SELISE GEO may include OpenAI (ChatGPT), Google (Gemini), Anthropic (Claude), Perplexity and other AI providers. Requests may also be sent through AI routing services, such as OpenRouter.

Third-party AI providers process information in accordance with the relevant contractual arrangements, service settings and their applicable terms and privacy policies. Such providers may also process limited information for their own security, abuse prevention, legal compliance or other lawful purposes.

The retention of prompts, inputs and outputs by third-party AI providers may vary depending on the relevant provider, service and configuration.

SELISE GEO is not designed to process special categories of personal data or other sensitive personal data. Users should not include such data in brand profiles, competitor information, personas or queries unless such processing is lawful and necessary.

6. Cookies and Similar Technologies

SELISE GEO uses cookies and similar technologies to enable essential website and platform functionality, support authentication and security, maintain sessions, remember preferences, measure service performance, conduct analytics and, where applicable, support marketing activities.

Essential technologies may be used where necessary to provide or secure the service. Non-essential analytics and advertising technologies, including Google Analytics, Microsoft Clarity, Google Ads and LinkedIn Ads, are used only where the required consent has been provided through the cookie consent mechanism. Users may reject non-essential technologies and may change or withdraw their consent at any time through the “Cookie Settings” link available on the website.

Further information about the technologies used, their purposes, providers and retention periods is provided in the SELISE GEO Cookie Notice.

7. How We Disclose Personal Data

SELISE may disclose personal data where reasonably necessary for the purposes described in this Privacy Policy. This may include disclosure to hosting and infrastructure providers, authentication providers, artificial intelligence providers and AI routing services, such as OpenRouter, analytics and monitoring providers, advertising and marketing providers, payment service providers, and communications and support providers.

SELISE may also disclose personal data to other companies within the SELISE group where access is necessary for the development, operation, support, administration or security of SELISE GEO. Personal data may also be disclosed to lawyers, auditors, accountants, insurers and other professional advisers where reasonably necessary.

SELISE may disclose personal data to courts or any other competent bodies where required or permitted by law. Personal data may also be disclosed in connection with a merger, acquisition, financing, restructuring, sale of assets or similar transaction, or where disclosure is requested or authorised by the relevant user or customer.

Where required by applicable law, SELISE will ensure that appropriate contractual or other safeguards are in place for such disclosures.

8. International Transfers

SELISE GEO is provided by SELISE Group AG in Switzerland and may involve other companies within the SELISE group. Personal data may therefore be processed or accessed from countries outside the country in which the individual is located, including where SELISE group companies provide development, operational or support services.

Transfers of personal data between SELISE group companies are governed by an Inter-Company Data Sharing Agreement, which incorporates the applicable Standard Contractual Clauses (SCCs) and provides appropriate safeguards for the transfer of personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

SELISE may also use service providers, including cloud, artificial intelligence, analytics, communications and other technology providers, which may process personal data in other countries.

Where personal data is transferred to a country recognised as providing an adequate level of data protection, SELISE may rely on the applicable adequacy decision or recognised transfer framework. Where an adequate level of protection is not available, SELISE will apply appropriate safeguards as required under the GDPR and the Swiss FADP, including Standard Contractual Clauses or other lawful transfer mechanisms, where applicable.

Further information about the safeguards used for international transfers may be requested using the contact details in Section 16.

9. Data Retention

SELISE retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed.

Personal data may be retained for a longer period where necessary to provide the SELISE GEO services, perform or enforce a contract, comply with legal, tax, accounting or regulatory obligations, prevent fraud or misuse, maintain appropriate business records, or establish, exercise or defend legal claims.

Account, workspace, brand, audit and AI-generated information may be retained for as long as the relevant account, workspace or subscription remains active and for a reasonable period thereafter where necessary for operational, contractual, legal or administrative purposes.

Technical information, including IP addresses, server logs, login records and security information, may be retained for as long as reasonably necessary to operate and secure SELISE GEO, investigate incidents, prevent fraud or misuse, and comply with applicable legal requirements.

Where personal data is no longer required for the relevant purpose and no legal or legitimate reason requires further retention, SELISE will delete, anonymise or otherwise securely dispose of the data in accordance with applicable law and its internal retention procedures.

10. Data Security

SELISE implements appropriate technical and organisational measures (TOMs) to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access and other unlawful processing.

These TOMs include, as appropriate, access controls, role-based permissions, authentication controls, encryption in transit and at rest, logging and monitoring, secure development practices, backup and recovery measures, vulnerability management, incident response procedures and confidentiality obligations for authorised personnel.

The safeguards applied may vary depending on the service, system, data and associated risks. No electronic system can be guaranteed to be completely secure. SELISE therefore reviews and updates its security measures in light of applicable risks and technological developments.

Where SELISE acts as a processor, additional security obligations are set out in the applicable Data Processing Agreement (DPA).

11. Automated Processing and Profiling

SELISE GEO uses automated processing to generate analytics about brands and their visibility in AI-generated responses. This may include citation strength, sentiment, list position, visibility scores, competitive positioning, share of voice, technical readiness and trends across repeated audit runs.

These analytics assess brands, websites and related business information. They are not designed to evaluate the personal characteristics of individuals.

SELISE GEO may also analyse a brand associated with an identifiable individual, such as a personal portfolio website, to show whether and how AI services cite that brand. SELISE GEO does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

Where applicable privacy law provides rights relating to automated decision-making or profiling, SELISE will provide the required information and allow individuals to exercise those rights.

12. Your Privacy Rights

Depending on the jurisdiction in which an individual is located and the law applicable to the processing, the individual may have rights to request access to personal data held about them, obtain information about how personal data is processed, request correction of inaccurate or incomplete personal data, request deletion of personal data, request restriction of processing, object to certain processing, obtain data portability where applicable, and withdraw consent where processing is based on consent.

Individuals may also lodge a complaint with a competent data protection authority.

These rights are subject to applicable legal conditions and exceptions. To exercise a privacy right, an individual may contact SELISE using the details in Section 16. SELISE may request information necessary to verify the identity or authority of the person making the request. A request may also be made through an authorised representative, where permitted by law.

Where the GDPR applies, SELISE will respond without undue delay and within one month of receiving the request. Where the Swiss FADP applies, SELISE will generally respond within 30 days. Where permitted by law, the response period may be extended where necessary, and SELISE will inform the requester accordingly.

SELISE will normally respond free of charge, except where a fee may be charged or a request may be refused under applicable law.

13. Regional Privacy Information

13.1 Switzerland

Where the Swiss Federal Act on Data Protection applies, SELISE processes personal data in accordance with the applicable principles of lawfulness, good faith, proportionality, purpose limitation, accuracy and data security. Individuals may have rights under Swiss law, including rights to obtain information concerning personal data processed about them and to request correction or other appropriate remedies.

Where personal data is disclosed outside Switzerland, SELISE will apply the safeguards required under Swiss law. SELISE Group AG may be contacted using the details in Section 16.

13.2 European Economic Area

Where the GDPR applies, an individual may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent and complaint to a competent supervisory authority, subject to applicable limitations.

Where processing is based on legitimate interests, an individual may have the right to object on grounds relating to the individual’s particular situation. Where processing is for direct marketing, the individual has the right to object to such processing at any time.

Where SELISE obtains personal data indirectly, including through AI-generated responses or publicly available sources, and acts as controller, the information requirements under Article 14 GDPR may apply, subject to any applicable exemption.

EU Representative: SELISE Group AG has appointed SELISE Deutschland GmbH, Tal 44, 80331 Friedrichstraße 79, 10117 Berlin, Germany, as its representative in the European Union under Article 27 GDPR.

13.3 United Kingdom

Where UK data protection law applies, SELISE processes personal data in accordance with the UK GDPR, the Data Protection Act 2018 and applicable amendments.

Individuals may have rights of access, rectification, erasure, restriction, objection, data portability, withdrawal of consent, subject to applicable limitations.

14. Children’s Privacy

SELISE GEO is intended for adults and is not directed to persons under 18 years of age. You must be at least 18 years old to create an account or subscribe to SELISE GEO.

SELISE does not knowingly collect personal data from persons under 18 for the purpose of providing account-based services. If SELISE becomes aware that such personal data has been collected in circumstances not permitted by law, SELISE will take appropriate steps to delete or otherwise deal with that data in accordance with applicable law.

15. Changes to this Privacy Policy

SELISE may update this Privacy Policy from time to time to reflect changes to SELISE GEO, changes to processing activities, changes to service providers, changes in legal or regulatory requirements or improvements to privacy practices.

The revised Privacy Policy will state the date on which it was last updated. Where required by applicable law, SELISE will provide additional notice of material changes.

16. Contact Details

Should you have any queries regarding this Privacy Policy or SELISE’s processing of personal data, please do not hesitate to contact us at:

SELISE Group AG

The Circle 37, 8058 Zürich-Flughafen, Switzerland

Email: privacy@selisegroup.com

SELISE’s Data Protection Officer may be contacted at legal@selisegroup.com