Toutmark ("we," "our," "us," or "Company") is an AI citation and AI visibility agency (also known as AI-era SEO). This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.
Scope: This policy applies to customers of Toutmark's services and users of toutmark.com and related services. services are US-only; we serve US jurisdiction exclusively in this phase.
1. Information We Collect
Customer Account Data
- Identification: Full name, email address, company name, business role
- Billing: Name, email, and billing information processed by Stripe — or, for a store billed through the Toutmark app in its Shopify admin, by Shopify, which holds the payment details: we see the store’s plan and charges, never its payment method
- Site Information: Website URLs, domain names, primary CMS/hosting platform
- Brand Data: Mission statements, taglines, voice guidelines, FAQs, team details
- Spokesperson Profile (HARO): For each authorized spokesperson the customer designates: full name, job title, work email, 1–2 sentence bio, narrowly-scoped expertise areas (3–8 topics), optional list of prior publications/podcasts, optional LinkedIn URL, and an optional backup spokesperson record. This is the person we email a journalist's question to, and who writes the response themselves.
- Compliance Contact (Regulated Customers Only): For customers in regulated industries (RIA/BD, healthcare, legal, insurance, finserv-non-securities, crypto, real estate, telehealth, MLM, tax/CPA), we collect a designated Chief Compliance Officer or compliance reviewer's name, title, and email. We do not route journalist responses to them: your firm runs its own compliance review of your spokesperson's words before your spokesperson sends them or emails the journalist themselves.
- Customer Approval Records: Timestamps and channel (dashboard click vs. email reply) of every Approve/Reject/Edit action customers (or their designated reviewers) take on content queued for them. Used both for operational coordination and for regulator-discoverable audit trails.
- Credentials: OAuth tokens and API keys (e.g., Ghost Admin API) you provide directly — encrypted AES-256-GCM in Cloudflare KV storage with 180-day TTL
- Third-Party Review Credentials: Usernames for G2, Capterra — provided via your own direct login flows; we never receive or store passwords
Prospect / Non-Customer Data
- Public AI Visibility Audit Tool: You provide a website URL to receive an AI visibility score; we crawl and analyze the site
- Platform Detection API: Our public endpoint accepts arbitrary URLs for platform detection (used internally during onboarding)
Usage Logs
- Action Logs: Rolling record of last 200 service actions (no hard TTL, stored in KV)
What We Do NOT Collect
- No tracking pixels on toutmark.com or customer sites
- No session replay or heatmaps
- No third-party analytics
- No cookies for tracking purposes (see Cookies section below)
2. How We Use Your Information
To Provide Services
- Publish AI citation content updates to your site through your CMS via authorized OAuth, API token, or plugin install (WordPress, Shopify, Webflow, Ghost, Sanity, Contentful — or by Toutmark drafting universally-visible page changes you publish manually)
- Generate LLM-powered content rewrites, brand-aligned copy, and AI citation structures
- Manage review site accounts (G2, Capterra) on your behalf
- Coordinate HARO journalist queries and social media posting
To Support & Improve
- Respond to support requests from [email protected] or [email protected]
- Debug installation or integration failures
- Develop and tune LLM prompts and brand-routing algorithms
For Billing & Compliance
- Process recurring charges via Stripe (monthly auto-renew), or through Shopify’s billing (every 30 days) for a store billed in its Shopify admin
- Enforce service termination on non-payment
- Maintain unsubscribe lists (CAN-SPAM compliance; indefinite retention)
3. Third-Party Data Sharing
We share customer data with the following services to provide our platform:
Content LLM (used for drafting customer-facing content + Toutmark agent reasoning)
- Anthropic (Claude API): Single content-and-reasoning LLM. All paragraph rewrites, Q&A drafts, education pages, blog posts, audit reports, schema text, and every Toutmark agent's own work routes through Claude. Prompts and outputs are sent to Anthropic servers. See Anthropic's privacy policy. Toutmark does NOT use OpenAI, Google Gemini, or Perplexity for content drafting — they are measurement targets only (see below).
AI Citation Measurement Targets (used to test whether customer brands surface in third-party AI assistants — core product feature)
- OpenAI (GPT-5-mini and text-embedding-3-small only): Toutmark's Monitor agent queries OpenAI's models with brand-test prompts (e.g., "what's the best [category] for [use case]?") and records whether the customer's brand surfaces in the answer. This is core AI citation measurement — we cannot determine whether ChatGPT cites our customers without querying ChatGPT. We do NOT use OpenAI for any content drafting. The only OpenAI models permitted for measurement use are GPT-5-mini (citation queries) and text-embedding-3-small (fact-verification embeddings). See OpenAI's privacy policy.
- Google Gemini (Gemini Flash): Same role as OpenAI for measurement — Monitor agent queries Gemini with brand-test prompts to score visibility in Google's answer engine. Not used for content. See Google's privacy policy.
- Perplexity: Same role for measurement — citation scoring against Perplexity's answer engine. Not used for content. See Perplexity's privacy policy.
- DataForSEO: Measurement only — retrieves the Google AI Overview shown for your target query so we can report whether you are cited in it. Google publishes no API for this, so the query text is sent to DataForSEO, who return the overview and its sources. Your target query is the only thing shared: no account data, no personal data, no site content. Not used for content drafting. See DataForSEO's privacy policy.
Data Enrichment & Research
- Apollo.io: Email addresses and domain names sent for lead enrichment (returns name, title, company, LinkedIn URL)
- Jina Reader + Firecrawl: URLs sent for content scraping (your own site URLs and prospect audit URLs)
- Tavily + Brave: Search queries for search result analysis and citation tracking
Communications & Email
- SendPulse: Outbound email campaigns; recipient email, subject line, and HTML body are sent to SendPulse servers
- NeverBounce: Email-address verification before outreach is sent and on prospect intake. Only the email address itself is shared with NeverBounce; no message content, no other PII.
AI-Text Detection
- Pangram Labs: AI-generated drafts are scored before publishing to make sure they don't read as obviously machine-written. Only the draft text is sent to Pangram; no account or PII data.
Infrastructure, OAuth Brokerage & Hosting
- Cloudflare: Hosting, DNS, email routing, KV (key-value storage), and edge compute. Cloudflare privacy policy.
- Stripe: Billing and payment processing. Stripe privacy policy.
- Shopify: For a store that installs the Toutmark app, Shopify bills the plan and the one-time onboarding fee, and tells us the store’s name, owner email, primary domain and plan. When the app opens for a store with no Toutmark account yet, Shopify also tells us the email the person using it signs in to Shopify with, which we use only to find a signup they started on toutmark.com under that address. Shopify privacy policy.
- Composio: OAuth broker that orchestrates scoped actions to Canva, LinkedIn, X, and Google Sheets on your behalf (we also use it for our own internal Slack, which receives none of your content)
Complete Subprocessor List: For the authoritative, up-to-date list of all third-party service providers we share data with, see toutmark.com/legal/subprocessors.
Review Sites & Knowledge Bases
- Wikidata: Entity edits via bot password; your brand name, descriptions, aliases, and URLs may be sent
- Google Sheets (via Composio): Directory and prospect data stored in shared sheets
Forms & Intake
- Tally: Intake form submissions routed to our systems
Press & PR
- HARO / Connectively / Cision: Inbound journalist queries sent to [email protected]. When a query clears our fit gate, we email your designated spokesperson a link carrying the journalist's question and the verified facts relevant to it, and your spokesperson writes the response themselves. When your spokesperson presses Send, the response they wrote goes to the journalist by email from [email protected], under their name. A question the journalist takes on their own site is answered there by your spokesperson, and your spokesperson may instead email the journalist themselves; then we send nothing.
- Spokesperson-written gate (binding): Nothing goes to a journalist under your name unless your spokesperson personally wrote it and sent it. There is no automatic-submission mode for journalist responses, on any plan. Regulated customers run their own compliance review of their spokesperson's words before the spokesperson sends them or emails the journalist themselves. Toutmark has no approval step of its own here, and never writes, edits, approves or sends anything the spokesperson has not sent.
None of these third parties are permitted to use your data for their own marketing or analytics purposes. We provide them only the minimum data required to perform their specific function.
4. Data Retention & Deletion
We follow this retention schedule in our Cloudflare KV storage:
enrichment:*— 30 days (email enrichment from Apollo.io)oauth_state:*— 10 minutes (single-use OAuth state tokens)rewrite_cache:*— 30 days (cached content rewrites)cms_install:*— 180 days (OAuth tokens and API keys)action_log— rolling last 200 entries, no hard TTLunsubscribed:*— indefinite (CAN-SPAM compliance)haro:queries:*,inbound:emails:*— 90 days (raw inbound HARO digests + email bodies)customer_approval_queue:*— purged on customer Approve / Reject / Edit, OR auto-archived to expired branch when deadline passesaudit_log:*(non-regulated customers) — 90 daysaudit_log:*(regulated customers — RIA/BD, healthcare, legal, insurance, etc.) — 7 years, longer if applicable regulator requires (SEC Rule 204-2, FINRA, state bar). This longer retention reflects books-and-records obligations the customer's regulator places on outbound advertising and communications. Regulated customers are notified at onboarding that records about their content will be retained on their behalf for this period and may be furnished to their compliance team or regulator on request.
| Category | We keep it for | Why that long |
|---|---|---|
| Account details, team contacts, your site content and drafts, target queries | Active subscription + 12 months | So a returning customer resumes rather than restarts. Deleted automatically at 12 months, or within 30 days if you ask sooner. |
| Citation measurements (which AI engine cited you, and when) | Anonymised at 12 months | The query text and competitor names are removed; only the engine, the date and whether a citation occurred remain. What is left identifies nobody, so it is kept as an industry benchmark. |
| Billing and subscription records (invoices, payments, plan changes) | 7 years | Tax law. The IRS period of limitations runs to 6 years where income is substantially understated and 7 for bad-debt claims; 7 years covers both. Not deletable on request — this is a legal obligation, not a choice we are making. |
| Unsubscribe and suppression records | Indefinite | CAN-SPAM. It is the only way to guarantee we never email you again; deleting it is how a suppression list fails. |
| Our audit log of actions taken on your account, including a record of any deletion | 7 years | It is how we can demonstrate what happened and that a deletion was carried out. Deleting the evidence of compliance defeats the point of it. |
| Signed authorisations (spokesperson, HARO, auto-approval) | 7 years | These record the legal basis on which we acted for you, and are kept the way a signed contract is. |
| Regulator-mandated audit logs (RIA/BD, healthcare, legal, insurance) | 7 years, or longer if your regulator requires | Books-and-records obligations your regulator places on advertising and communications (e.g. SEC Rule 204-2, FINRA, state bar). Retained regardless of cancellation and furnished to you or your compliance representative on written request. |
If you cancel. We keep your account data for 12 months after cancellation, then delete it automatically. We hold it that long on purpose: the work Toutmark does compounds, and your citation history, target queries and published pages are what let you pick up where you left off rather than start again. Around month 11 we email you to say the deletion date is coming, so you can export your content or restart before it happens. You do not have to wait for that clock — ask us to delete sooner and we will, under the next paragraph.
If you ask us to delete. On an explicit deletion request — whether or not you have cancelled — we purge your personal data and your work product within 30 days.
What survives either route. The rows in the table above marked 7 years or indefinite. Everything else goes. We are not keeping those because we want to — each one is either a legal obligation or the record proving we met one — and we would rather say that plainly than describe a deletion as total when it is not.
Taking it with you. You can download everything we hold for your account — your details, your team, every page we published, anything still in your approval queue, and your full citation history — from Settings in your dashboard, at any time, without asking us. Our internal notes about your account are not in that file; email [email protected] and we will send you a complete copy including those.
5. Your Privacy Rights
US Residents (CCPA)
If you are a California resident, you have the right to:
- Know: What personal information we collect and how we use it
- Delete: Request deletion of data we have collected (with limited exceptions)
- Opt-Out: Opt out of the "sale" or "sharing" of personal information (we do not sell data; any third-party sharing for business purposes may be considered a "sharing" under CCPA)
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To submit a CCPA request, contact [email protected] with "CCPA Request" in the subject line.
EU / UK Residents (GDPR / UK-GDPR — Future)
Live Phase is US-only. When we expand to EU/UK jurisdictions in our Live Phase, we will process data under GDPR/UK-GDPR legal bases (primarily contract performance and legitimate interest) and provide DPA (Data Processing Agreements) for enterprise customers. Until then, EU/UK residents should not provide personal data.
Canada (PIPEDA — Future)
PIPEDA compliance will be implemented upon expansion to Canadian operations.
Australia (Privacy Act — Future)
Australian Privacy Act compliance will be implemented upon expansion to Australian operations.
6. Cookies & Tracking Technologies
We do not use tracking cookies, analytics cookies, or session-replay pixels on toutmark.com or customer sites. We may use essential cookies (e.g., to maintain your login session) but will not use third-party analytics or tracking tools.
7. Children's Privacy (COPPA)
Toutmark services are not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will promptly delete it. Parents or guardians who believe their child has provided information should contact [email protected].
8. Data Breach Notification
In the event of a confirmed data breach affecting your personal information, we will notify you without unreasonable delay via email to the address on file. Notification will include the nature of the breach, the data affected, steps we are taking to remediate it, and recommended precautions.
9. International Data Transfers
Live Phase operates exclusively in the US. Our infrastructure (Cloudflare) may have global presence, but customer data remains subject to US law and is not transferred outside the US in this phase. Upon expansion to other jurisdictions, we will implement Standard Contractual Clauses or other lawful transfer mechanisms.
10. Contact for Data-Subject Requests
To exercise any privacy rights, request data deletion, or raise a privacy concern:
- Data-Subject Requests: [email protected]
- General Support: [email protected]
Mailing Address:
2712 N Ardmore Avenue
Manhattan Beach, CA 90266
USA
11. Updates to This Policy
We may update this Privacy Policy at any time. The "Last Updated" date at the top of this page will reflect the most recent revision. Continued use of Toutmark services after an update constitutes your acceptance of the new terms.
- v1.1 — September 26, 2026: Billing through Shopify (Sections 1–3): a store billed in its Shopify admin is billed by Shopify, which holds its payment details, and what Shopify tells us when the Toutmark app is installed and opened.
- v1.0 — April 23, 2026: Initial Policy (Live Phase, US-only)