Privacy Policy

Chris George Ltd (trading as Competaris) is the data controller for personal data processed through competaris.com and the Competaris application (the Service). This policy explains what we collect, why, who we share it with, how long we keep it and the rights you have. It applies to visitors, account holders and to individuals whose publicly available information appears in our research outputs.

Privacy questions, rights requests and complaints: privacy@competaris.com.

Account data. Name, email address and a salted hash of your password (we never store the password itself), account settings, plan and credit balance, and the date you accepted our Terms.

Billing data. Payments are processed by Stripe. We receive and store your Stripe customer and subscription identifiers, plan, billing status, invoice history and, for display, the card brand and last four digits. We never receive or store full card numbers.

Research inputs and outputs (“Content”). Idea descriptions, app or website links you add, keywords, competitor selections, notes and tags, Ask AI messages, and the reports, rankings, scores and answers we generate for you. Please do not include personal data about other people in your inputs unless necessary.

Usage and technical data. IP address, browser and device information, pages and features used, timestamps, error logs, and per-request records of AI usage (model, token counts, cost) used for metering, abuse prevention and security. Our hosting and edge providers keep short-lived access logs.

Communications. Emails you send us and transactional emails we send you (delivery and open status may be recorded by our email provider).

Cookies and local storage. We use only strictly necessary storage: your session or API token (so you stay signed in), your theme preference, and Stripe's fraud-prevention cookies on checkout pages. We do not currently use advertising or third-party analytics cookies. If that changes we will update this policy and, where required, ask for consent first.

To produce competitor analysis, we collect publicly available information from app stores, public websites and web-search results: app and company names, descriptions, prices, ratings, public reviews, developer names, and website content. Some of this can contain personal data, for example a developer's trading name or the display name of a person who posted a public review.

We process such data on the basis of our legitimate interests (and those of our customers) in market research and competitive analysis, which we have assessed as not overriding the interests of the individuals concerned because the data is already public, is used for business analysis rather than decisions about the individual, and is minimised: we quote reviews only in short excerpts, do not build profiles of reviewers, and do not attempt to identify them.

If information about you appears in the Service and you want it corrected or removed, contact privacy@competaris.com. We will respond within one month and remove or correct data unless we have a compelling legitimate ground to retain it.

• To provide the Service (create and secure your account, run analyses you request, deliver reports, chat answers and rank tracking, meter credits, provide support). Lawful basis: performance of a contract.
• To bill you (subscriptions, invoices, tax records, fraud prevention). Lawful bases: contract and legal obligation.
• To keep the Service secure and prevent abuse (rate limiting, detecting multiple free accounts, investigating misuse). Lawful basis: legitimate interests.
• To improve the Service, including debugging, measuring accuracy of estimates and calibrating heuristics using aggregated or de-identified data. Lawful basis: legitimate interests.
• To send service messages (account, billing, security, material changes to terms). Lawful bases: contract and legal obligation. These are not marketing and cannot be opted out of while you hold an account.
• To send product news only if you opt in; you can withdraw consent at any time via the unsubscribe link. Lawful basis: consent.
• To comply with law and to establish, exercise or defend legal claims. Lawful bases: legal obligation and legitimate interests.

Your research inputs and the public data we collect are sent to our AI provider (OpenAI) through its API to generate outputs. Under our agreement, this data is not used to train OpenAI's models and is retained by OpenAI only for abuse monitoring for a limited period. We do not send your name, email or billing details to the AI provider.

Outputs are produced by automated processing, but we do not make decisions that produce legal or similarly significant effects about you solely by automated means. Outputs are research aids for your own decisions.

To keep the Service fast and affordable, we keep a semantic cache of generated research. A cached report may be served to another customer whose request is materially similar. Cached research contains public market information and never contains your identity, account data, notes or chat messages.

We do not sell personal data and do not share it with advertisers. We share data only with the service providers (processors) below, who act on our instructions under written contracts, and with authorities or advisers where the law requires or permits.

We may also disclose data to comply with a legal obligation, to enforce our Terms, to protect the rights, property or safety of us, our users or others, or to a successor in connection with a merger, acquisition or sale of assets (you will be notified of any change of controller).

Our primary servers are located in the Netherlands (European Union). Some providers listed above process data in the United States. Where personal data leaves the UK or the European Economic Area, we rely on adequacy decisions (including the EU-US and UK-US Data Privacy Framework where the provider is certified), the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures such as encryption in transit and at rest.

• Account and Content: for as long as your account is open, then deleted or anonymised within 30 days of closure.
• Encrypted database backups: rotated automatically and deleted within 14 days.
• Server, security and AI-usage logs: up to 90 days, longer only if needed for an active security investigation.
• Billing records and invoices: 6 years after the transaction, as required by UK tax and accounting law.
• Semantic cache of generated research (no personal data about you): up to 12 months, then regenerated.
• Emails and support correspondence: up to 2 years after the matter closes.

We protect data with TLS encryption in transit, encrypted storage, hashed passwords, least-privilege access to production systems, private networking between services, firewalling, automatic security updates and audit logging. No system is perfectly secure; if we become aware of a personal-data breach that is likely to result in a risk to you, we will notify you and the relevant authority as required by law.

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased (for example by closing your account), subject to legal retention duties;
• restrict or object to processing based on legitimate interests, including profiling;
• receive data you provided in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent, without affecting prior processing;
• complain to us directly, and we will acknowledge within 30 days and respond without undue delay;
• lodge a complaint with a supervisory authority, in the UK the Information Commissioner's Office (ICO), or your local data-protection authority in the EEA.

California residents. We do not sell or share personal information for cross-context behavioural advertising. You may request access to, deletion of, or correction of your personal information and will not be discriminated against for exercising these rights.

To exercise any right, email privacy@competaris.com from the address on your account. We may ask for information to verify your identity. We respond within one month, extendable by two further months for complex requests, and requests are free unless manifestly unfounded or excessive.

The Service is intended for business users aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the Service, our providers or the law change. We will post the new version here with an updated date and, for material changes, notify account holders by email or in the Service before they take effect.

Chris George Ltd (trading as Competaris). Privacy requests: privacy@competaris.com. General enquiries: hello@competaris.com. See also our Terms of Service.