Privacy Policy
What Lugh collects when you run a GEO audit or book a call, why we collect it, who else sees it, and how to get it back or get it deleted.
Last updated September 15, 2026 · version 2026-09-15
Who we are
Lugh measures how visible a business is inside AI search answers and turns that into an audit report. This policy covers lughonline.com and the audit, report and call-booking services offered through it.
The controller of the personal data described in this policy is the individual trading as Lugh. You can reach us about anything in this policy at [email protected], and our postal address is available on request at that address. Everywhere this policy says "we" or "us", it means that controller.
The short version
- To run an audit we ask about your business, not about you. Your contact details reach us later: your email address when you ask for the full report, and your name, email and any notes you write if you book a call.
- The business details you type in, meaning the name, description, sector, website and location, are sent to OpenAI, Anthropic and Google, because querying those AI platforms is literally what the audit measures. Do not type anything confidential into the form.
- We also collect technical data automatically: your IP address, a set of anti-bot signals your browser reports when you submit the form, the pages you view, and your language and time zone.
- We set no cookies and we do not track you across other websites.
- You get one report email. Two other emails are optional, each with its own unticked box: a follow-up re-audit about 30 days later, and occasional marketing emails from Lugh. You only get them if you tick the box, and you can stop them at any time from the link in every email.
- You can ask for a copy of your data, or ask us to delete it, by emailing us. We answer within 30 days.
What we collect
There are three points where you give us information, and they are separate. Running an audit does not require an email address, and you can stop before giving one.
| When | What |
|---|---|
| Requesting an audit | Your business name, a short description of what it does, its sector, and optionally its website address and location. Also the language you are reading the site in. |
| Unlocking the full report | Your email address, and a record of each box you ticked, including the time you ticked it and the version of this policy that was on screen. The re-audit and marketing boxes are each recorded separately from the report request, so we can show which of them you actually agreed to. |
| Booking a call | Your name, your email address, and anything you write in the optional notes field. Your browser also tells us its time zone, so we can offer you slots in your own local time. |
The audit form asks about a business. If you are a sole trader, your business name and description may also be information about you personally, and we treat it that way.
| What | Why |
|---|---|
| Your IP address | Rate limiting and abuse prevention. The audit is free and unauthenticated, so without this a single machine could run it thousands of times. |
| Anti-bot signals from your browser | When you submit the audit form we read a small set of technical signals and combine them into a single score that indicates how likely the submission is to be a script. The signals are whether graphics rendering is available, how many browser plugins are present, your screen size, your time zone, your browser languages, and whether the browser reports itself as automated. We also record how long the form was open before submission. These signals are used to score that one submission and are not used to identify or profile you. |
| A security challenge | The audit form runs Cloudflare Turnstile, which checks that a real browser is submitting the form. |
| Aggregate visit statistics | Page views, referrer, country, device type and page-speed measurements, via Cloudflare Web Analytics. This is measured without cookies and without any identifier that follows you between sites. |
| Where you came from | If you reached the booking page from a link in your report or one of our emails, that link carries a tag telling us which link it was, so we know which part of the report is useful. |
See the Cookie and Storage Policy for exactly what is stored on your device.
Your business details are sent to AI platforms
This is the part of the service most worth understanding before you use it.
The audit works by asking the major AI assistants the kind of questions your customers would ask, and checking whether they mention you. To do that we send the business name, description, sector and location you typed into the form to third-party AI providers:
- Anthropic (Claude), to turn your business details into realistic customer questions and to assess how you are described in the answers that come back.
- OpenAI (ChatGPT), queried with those questions to see whether you are mentioned.
- Google (Gemini), queried with those questions to see whether you are mentioned.
All three providers are based in the United States. We use their business APIs, not their consumer products.
If you gave us a website address, we also fetch that page once to check that it is reachable and to read any structured data it publishes. We only request the address you gave us.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Run the audit you asked for and show you the score | Performance of a contract, or steps taken at your request before entering one (Article 6(1)(b)). |
| Email you the full PDF report | Necessary to send the report you asked for (Article 6(1)(b)). Entering your email address and pressing the button is the request. |
| Email you a free re-audit about 30 days later, re-running the same audit so you can see whether your visibility moved | Your consent (Article 6(1)(a)), given through a separate optional checkbox and withdrawable at any time from the link in every email. |
| Send you occasional marketing emails from Lugh with AI visibility tips, news about our services and offers | Your consent (Article 6(1)(a)), given through its own separate optional checkbox, not the re-audit one, and withdrawable at any time from the link in every email. |
| Arrange and hold a call you booked | Performance of a contract, or steps taken at your request before entering one (Article 6(1)(b)). |
| Prevent abuse of a free, unauthenticated service through rate limiting and bot detection | Our legitimate interests (Article 6(1)(f)) in keeping the service available and its costs predictable. |
| Keep server logs, so we can investigate faults and security incidents | Our legitimate interests (Article 6(1)(f)) in running the service securely and being able to work out what happened when something goes wrong. |
| Understand which businesses appear in AI answers, in aggregate | Our legitimate interests (Article 6(1)(f)) in measuring and improving the product. See businesses we never heard from. |
| Measure site traffic without cookies | Our legitimate interests (Article 6(1)(f)) in knowing whether the site works. No identifier that follows you between sites is created. |
The only things on this list we ask your consent for are the follow-up re-audit and marketing emails, each with its own box. Declining either does not affect the report you asked for: you get that either way, and nothing else about the audit changes.
Where we rely on consent, you can withdraw it at any time, and withdrawing it does not make what we did beforehand unlawful.
We do not make any decision about you by automated means that produces a legal or similarly significant effect. Your GEO score is generated automatically, but it is a measurement we hand to you. It does not decide anything about you.
Emails we send you
- Your report. Once you enter your email address, we generate the PDF and send it to you.
- One re-audit, about 30 days later, re-running the same audit so you can see whether your visibility moved, but only if you ticked the optional box asking for it. If you did not, this is the one email you get.
- Occasional marketing emails from Lugh with AI visibility tips, news about our services and offers, but only if you ticked the separate optional box asking for them.
- A confirmation if you book a call, plus the calendar invitation.
That is the complete list. We do not add you to any list beyond the re-audit and marketing emails you opted into.
You can stop the follow-up re-audit and marketing emails at any time using the unsubscribe link in every email we send you, or by emailing us. It takes effect immediately. We will still send you a confirmation for a call you actively book, and we will still send you a report you ask for afterwards. Those are emails you requested, not ones you subscribed to.
You should also know that a copy of your report email is sent to us. It is how we see which audits have run and follow up on them, and it means your email address and report reach our own inbox as well as yours.
Transfers outside the EEA
The database and servers holding your data are in the EU. The AI platforms the audit queries, and the services we use to send email and hold calls, are in the United States, so the details described above are transferred there.
Those transfers are made under the European Commission’s Standard Contractual Clauses, or under the EU–US Data Privacy Framework where the provider is certified to it. You can ask us for the specifics for any named provider.
How long we keep it
| What | How long |
|---|---|
| An audit in progress | 24 hours. The working copy of your audit, including the raw AI answers, expires automatically. This is why a results link stops working after a day. |
| Your IP address | 30 days. It is kept to prevent abuse, so it is removed once it can no longer serve that purpose, well before the rest of the record. |
| Server logs | 30 days, then rotated away. Email addresses and IP addresses are stripped out of them as they are written. |
| Your audit record and email address | 12 months from our last contact with you, then deleted. |
| A booked call | 12 months after the call. |
| Anything we hold because you consented, which is currently the follow-up re-audit and marketing emails | Until you withdraw consent, and no longer than the periods above. Withdrawing takes effect immediately. A re-audit already in flight is cancelled rather than finished, and no further marketing is sent. |
| Contact details and audit history of a former client | 12 months after the engagement ends. |
| Invoices and billing records | 6 years from the last accounting entry. Longer than everything else on this list, and not by choice. See below. |
| Records of consent and unsubscribes | For as long as we need them to show we handled your choice correctly. An unsubscribe record outlives the rest, because it is what stops us contacting you again. |
The billing row is long because Spanish tax and commercial law require it: article 30 of the Código de Comercio sets 6 years for business records, which is longer than the four years tax law requires, so the longer figure is the one that binds us.
That obligation covers invoices and accounting entries and nothing else. We are allowed to keep those. We are not allowed to treat the permission as covering everything else about a former client, so the rest of their data goes on the shorter period above.
Your rights
Under the GDPR you have the right to:
- Get a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted.
- Restrict or object to how we use it, including objecting at any time to any use we base on our legitimate interests.
- Receive the data you gave us in a portable, machine-readable form.
- Withdraw consent at any time, where we relied on it.
To exercise any of these, email [email protected]. We will respond within 30 days. We may ask you to confirm the request comes from the address we hold, because that is the only way we can tell it is yours. We have no accounts and no passwords.
These rights are free to exercise. If a request is clearly unfounded or repetitive we may charge a reasonable fee or decline it, and we will explain why if we do.
If you think we have handled your data badly, please tell us first. We would rather fix it. You also have the right to complain to a supervisory authority, normally the one where you live or work. In Spain that is the Agencia Española de Protección de Datos (aepd.es). In Ireland, it is the Data Protection Commission (dataprotection.ie). In the United Kingdom, it is the Information Commissioner’s Office (ico.org.uk).
Businesses we never heard from
When we run an audit, the AI platforms name other businesses in their answers. These are the competitors that came up instead of, or alongside, the one being audited. We record those business names so we can measure which businesses AI assistants recommend in a given sector and location.
Those businesses never used Lugh and never gave us anything. What we hold about them is a business name and a count of how often it came up, drawn from what a public AI model said in response to a public question. We hold no contact details for them, and we do not email them.
We rely on our legitimate interests for this, and we keep it proportionate: the data stays internal and aggregate, and it is not published as a ranking or used to contact anyone. For a sole trader, a business name can be a personal name, which is why this section exists.
If your business appears in our records and you would rather it did not, email [email protected] and we will remove it.
How we protect it
The site is served over HTTPS only. Access to the database is limited to the application and to the people who need it. Our servers and database are hosted in the EU by established providers. We review the application for security issues and act on what we find.
No system is perfectly secure. If a personal data breach occurs and it is likely to result in a risk to your rights, we will notify the Agencia Española de Protección de Datos (aepd.es) without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to your rights, we will also tell you without undue delay.
Children
Lugh is a service for businesses. It is not directed at children and we do not knowingly collect data about them. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
Each version of this policy carries a date, shown at the top of this page. If we change it in a way that materially affects you, we will say so. Where we relied on your consent, we will ask again rather than assume the old consent covers the new thing.