Privacy policy.

The short version

• We collect the minimum data needed to run audits and bill you.
• We never sell your data. Ever.
• We never share your data with advertisers.
• If you accept cookies, the third parties listed below see your visit — that list is complete. Decline, and none of them run.
• You can export everything and delete your account at any time.
• We encrypt your data at rest and in transit.

What we collect

Account data (email, workspace name, billing). Usage data (which audits ran, when). Audit data (the domains you analyze and the responses we collected from AI engines).

How long we keep it

Audit data is retained on a per-plan schedule, then archived for 30 days and permanently deleted: Free 90 days, SMB 180 days, Growth and Agency 365 days, Enterprise per contract. Account and billing records are kept while your workspace is active and as long as needed to meet legal and tax obligations. You can delete your account and its data at any time from Settings → Danger zone; deletion cancels any active subscription and removes your Pondral-held data (billing records are retained as the law requires). One thing we can't control: query text already sent to the third-party AI engines at audit time is governed by those engines' own retention policies and cannot be recalled by Pondral.

What we don't

We don't run ad pixels and we don't sell email lists. We don't build an advertising profile of you as an individual, and we don't follow you onto other websites.

Cookies and the third parties who see your visit

Beyond the essential cookies that keep you signed in, we use these, and only these:

• PostHog — first-party product analytics.
• Sentry — error monitoring, which includes masked session replay.

Each of them is a recipient of the data described above, and each one loads only after you consent. You can change that choice at any time via “Cookie preferences” in the footer; withdrawing consent is as easy as giving it. If you never consent, none of them run at all.

Your rights

Pondral, LLC, a Florida limited liability company, is the data controller for your workspace data.

Under GDPR and CCPA, you can request access, correction, export, and deletion. Email privacy@pondral.com. We respond within 30 days.

See also: /compliance for frameworks and DPA, /security for security posture.