Privacy policy.

Obelisk is run by The Obelisk App Inc., a Delaware corporation, 131 Continental Dr, Suite 305, Newark, DE 19713, USA ("Obelisk", "we", "us"). Contact us at privacy@theobelisk.app.

• We are the controller for data about the people who use Obelisk and visit our own websites: accounts, sign-in, billing, support, security and how the service is used.
• We are a processor for data our customers put into Obelisk or collect with it: visitors and leads on their websites, the documents they upload, their chats and the data Obelisk reads from tools they connect. The customer is the controller of that data and decides how it's used. Our data processing addendum governs it. If you're one of their visitors or contacts, see "Obelisk tracking on our customers' websites" below.

Your account. Your name, email address, profile picture if you add one or sign in with Google, and how you sign in: Google, an emailed code, a password or a passkey. We store passwords only as one-way hashes and Google sign-in tokens encrypted. We don't receive your Google password.

Sign-in and security. For each signed-in session we store the IP address and browser user agent it came from, so you and we can spot sessions that aren't yours. Sign-in codes expire after 5 minutes.

Your workspaces. Workspace names and branding, the people you invite, their email addresses and roles, and an activity log of sign-ins, connections, keys and membership changes. That log records who did what and when, by ID.

Your sites and audits. The website addresses you add, competitors, audit settings and results: page addresses, status codes, redirects, titles, page text, links, structured data, speed measurements and the issues we find. We keep what your team does with issues and who did it.

Pages we crawl. Our crawler, ObeliskBot, opens public pages the way a search engine does and stores what anyone on the internet can see. It never logs in. Public pages can contain personal data, such as names on a team page, which we store as part of the audit.

Google data you connect. Search Console and Google Analytics data, only if you connect them. See the next section.

Chat, agents and the business brain. Your chat messages and the answers, what agents did and why, actions you approved, and the facts Obelisk learns about your business. Documents you upload to the brain must be PDF, Word or PowerPoint files of up to 25 MB. They're stored privately, read only to build your brain, and never shown or shared outside your workspace.

Connected tools. If you connect WordPress, GitHub, Slack, Linear or Jira, we store the access tokens (encrypted) and the account name, and we read and write only what the actions you use need: posts and pages, files and pull requests in the repository you pick, channels and messages, issues and projects.

Email recipients. If your agents send email, we keep the recipients your team added, their confirmation that they want the email, the messages and delivery records.

Contact enquiries. When you contact us or book a demo: your name, work email, company, website if you add it, the reason for your enquiry and your message.

Support requests. When you email support@theobelisk.app or use Contact support in Obelisk: your message, your account and workspace, the page you were on, and a screenshot if you attach one, so we can help.

Payments. Stripe collects your card details and billing address on its own pages and screens payments for fraud with Stripe Radar, using details about the payment and your device. We never see or store your card number. We keep your plan, seats, subscription status and invoice records.

Abuse prevention. When you sign up, sign in, start a free audit or contact us, Cloudflare Turnstile checks you're not a bot, and we count requests per IP address, email domain and account to enforce daily limits. Those counters use a one-way hash of the IP address, not the address itself. We block disposable email addresses.

Diagnostics. Error reports and performance measurements (load times, request durations, Web Vitals). They carry IDs, counts, categories, timings and browser type only. We keep email addresses, page content, tokens and full web addresses out of them.

Emails we send you. Sign-in codes, invitations, account and billing notices, reports and alerts you set up, and replies to your enquiries. Open and click tracking is off. Reports and alerts you subscribe to carry a one-click unsubscribe.

Cookies. Only the ones Obelisk needs to work. Our cookie policy lists each one.

Obelisk asks Google only for the access each feature needs, when you turn that feature on:

• Sign in with Google: your name, email address and profile picture.
• Search Console: read-only access (https://www.googleapis.com/auth/webmasters.readonly). We read the properties your account can see, which of your pages are in Google's index, URL inspection results, and search performance (clicks, impressions, position and the search queries people used).
• Google Analytics: read-only access (https://www.googleapis.com/auth/analytics.readonly). We read the properties your account can see and daily totals for sessions, users, new users, engaged sessions and key events, broken down by channel, source and medium, landing page, device and event. We don't read data about individual visitors.

We can't change anything in your Google account, Search Console or Google Analytics.

How we use it. To show which pages are in Google and how they perform, next to audit findings, in reports and dashboards, and to let chat and agents answer questions about your search and site performance. For that, we send totals and search queries from Search Console and Google Analytics to our AI providers, who process them only to produce your answer and may not train on them.

What we don't do with it. We don't sell it, use it for advertising, use it to train AI models (ours or anyone else's), or let our providers train on it. We don't transfer it to anyone except the service providers that run Obelisk for us, under the same limits. People at Obelisk don't read it, except with your permission, to investigate security issues or abuse, or to comply with the law.

Limited Use. Obelisk's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage. Google tokens are stored encrypted. Each connection belongs to the workspace and site it was made for.

Disconnecting. Open the site's connections in Obelisk and choose Disconnect, or remove Obelisk at myaccount.google.com/permissions. Disconnecting Search Console revokes our access at Google and deletes the tokens. Search Console data already in past audits stays with them so your reports stay complete, until you delete the site or your account, or ask us at privacy@theobelisk.app to remove it. Disconnecting Google Analytics deletes that site's Google Analytics data, and we revoke the tokens once no other site uses them.

Obelisk uses AI models to judge audit checks that need reading comprehension, write summaries and reports, suggest fixes, answer chat questions, run agents and build your business brain.

What we send. Only what each task needs: public text from audited pages and audit findings, your chat messages, brain facts and text from documents you upload, and totals from Search Console, Google Analytics and Obelisk tracking. We never send passwords, payment details or access tokens.

Who processes it. Anthropic runs the language models. DeepInfra turns text into search vectors so the brain can find relevant facts. Both work under commercial terms that bar them from training models on our data. Anthropic keeps inputs only for a limited time to monitor abuse. DeepInfra doesn't store them after answering.

What to expect. AI output can be wrong. Obelisk shows its sources where it can, and agents change your connected tools only when you approve an action or within the autopilot limits you set. We don't use AI to make decisions about you that have legal or similarly significant effects.

Our customers can add the Obelisk tracking script to their websites. If you visit one of those websites, the business that runs it is the controller of your data and Obelisk processes it on their behalf. Questions about how a website uses your data are best sent to that business. We'll help them answer.

Before you choose in the website's cookie banner, the script stores nothing on your device: no cookies, no local storage. It sends the page you're on (its address without most of its query string), the page title, the website that sent you there, your browser language and screen width, campaign tags in the address (such as utm_source, gclid, fbclid and msclkid), how far you scroll, links you click to other websites, and the fact that you submitted a form, with the form's field names but none of the values you typed. To count your visit without cookies, our server combines the website, your IP address and your browser's user agent with a random value that changes every day, and keeps only the resulting one-way code. We never store your IP address. The daily value is deleted when the day (UTC) ends, so the code can't link your visits across days. We keep the names of your browser and operating system and a device type, not the full user agent.

If you accept analytics cookies, the script sets a first-party cookie, _obk_id, on that website. It holds a random ID and lasts 390 days. If the website also uses Google Analytics, the script reads Google's _ga cookie and sends us its client ID. If you accept partway through a visit, the pages you saw earlier in that visit are joined to it.

Contact details. Only after you accept, and only from the fields the website has mapped as email address and name, the script sends us those two values when you submit a form. If the website identifies you after you sign in, we receive its customer ID for you and, if it sends them, your email and name. The business can record whether you became a customer and the deal's value.

Across the business's websites. With your consent, links between a business's websites carry a short _obk code with your random ID, valid for 2 minutes and removed from the address bar when the page loads.

Changing your mind. Withdraw consent through the website's cookie banner or settings. The script deletes _obk_id and goes back to counting visits without cookies. Data already collected stays with the business until it deletes it.

We use tracking data only on the business's instructions. We don't sell it, use it for advertising, use it to train AI models or combine it across customers. Obelisk tracking doesn't read Do Not Track or Global Privacy Control signals; your choice in the website's cookie banner controls it.

Where we rely on legitimate interests, you can object, as explained under "Your rights". We don't sell personal data, share it for cross-context behavioural advertising, or use it for advertising.

Service providers. We use a small set of companies to run Obelisk: Amazon Web Services (hosting, storage and email), Anthropic and DeepInfra (AI), Sentry (error monitoring), Stripe (payments and fraud screening) and Cloudflare (bot checks). DataForSEO supplies keyword and backlink data and receives only domains and keywords, and Google measures page speed from public addresses. Each gets only what it needs. The subprocessors page lists them with their purposes and locations.

Services you connect. When you connect Google, WordPress, GitHub, Slack, Linear or Jira, we exchange data with them on your instructions. Their own privacy policies apply to what they hold.

Your team and your clients. People in your workspace see its data according to their roles. If you share a report link, anyone with the link can see that report until it expires or you turn it off.

Legal and safety. We disclose data if the law requires it, or to protect people, other websites or Obelisk from harm or fraud. We tell the affected customer unless the law forbids it.

Business transfers. If Obelisk is part of a merger, acquisition or sale of assets, data may transfer to the new owner, who must keep honouring this policy.

All traffic to Obelisk is encrypted with TLS, and the database, file storage and backups are encrypted at rest. Access tokens for connected tools are additionally encrypted with versioned keys. Every request is checked against your workspace, and requests for another company's data are answered as if it doesn't exist. Our crawler and calls to customer websites go through a proxy that blocks private network addresses. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the authorities as the law requires.

We store Obelisk's data in the United States (AWS us-east-1, Northern Virginia). Error and performance data is stored in Sentry's EU region. Our AI providers process data in the United States. When we transfer personal data from the European Economic Area, the UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, with the UK Addendum and the Swiss amendments where they apply. Email privacy@theobelisk.app for a copy of the safeguards.

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct it;
• delete it;
• give it to you, or another company, in a portable format;
• stop or limit how we use it, including objecting to uses based on legitimate interests;
• withdraw consent you gave, without affecting what we did before.

How. You can edit your profile, disconnect Google and delete your account in Obelisk. For anything else, including a copy of your data, email privacy@theobelisk.app. We'll confirm who you are, usually by asking you to write from your account's email address, and answer within 30 days. If you're in the EU or UK and unhappy with our answer, you can complain to your data protection authority.

If your data came through one of our customers (for example you visited a website that uses Obelisk tracking, or you're named in a customer's documents), ask that business first: they decide what happens to it. If you contact us, we'll pass your request to them and help them answer. Customers can delete a person and everything linked to them from Leads.

US state privacy rights. If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another state with a consumer privacy law, you have the rights above as your state's law provides them. In the last 12 months we collected these categories of personal information for the purposes in "How we use your data and why": identifiers (name, email address, IP address, account IDs); commercial information (plan and invoices); internet activity (sessions, usage and, for our customers, website visits); professional information (company and role, when you give it); and inferences only in the form of aggregated statistics. Sign-in credentials, the one sensitive category we hold, are used only to sign you in and keep your account secure. We don't sell personal information or share it for cross-context behavioural advertising, and haven't in the last 12 months. You can use an authorised agent, whom we'll ask to show your permission. If we decline your request, you can appeal by replying to our answer, and we'll respond within the time your state's law allows. We won't treat you differently for using your rights.

Obelisk is a business tool for adults. It isn't meant for anyone under 18, and we don't knowingly collect data from children under 16. If you believe a child has given us personal data, email privacy@theobelisk.app and we'll delete it.

If we change this policy in a way that matters, we'll email account owners and show a notice in Obelisk at least 14 days before the change takes effect. The date at the top shows the current version.

The Obelisk App Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Privacy questions and requests: privacy@theobelisk.app. Legal notices: legal@theobelisk.app.