Privacy Policy

Last Updated: August 31, 2026

Gumshoe.AI, Inc. and its affiliates ("Gumshoe," "we," "our," and/or "us") value the privacy of individuals who use our website, https://www.gumshoe.ai/, and related services (collectively, our "Services"). This privacy policy ("Privacy Policy") explains how we collect, use, and share Personal Information from or about Gumshoe users or their devices. As used in this Privacy Policy, "Personal Information" means any information relating to an identified or identifiable individual. By using our Services, you agree to the collection, use, disclosure, sharing, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service. When you use our Services on behalf of one of our customers, we may process the information you provide to us in accordance with separate contractual terms between us and the applicable customer.

Our Role in Handling Your Information

Gumshoe handles two kinds of information, and our responsibilities are different for each.

Account, billing and marketing information. This includes your name, email address, credentials, sign-in history, billing details, support conversations and how you use the Services. We decide why and how this information is processed, so we are the controller for it. Send requests about this information to us directly at privacy@gumshoe.ai.

Customer content. This is the material your organization puts into the Services and the analysis we generate from it: brands, competitors, topics, prompts, personas and reports. We process it on your organization's instructions under our agreement with them, so your organization is the controller and we are its processor. If you want this information corrected, exported or deleted, ask your organization's administrator. If you ask us instead, we will pass the request to them.

Information We Collect

We may collect a variety of information from or about you or your devices from various sources, as described below. Where applicable, we indicate whether and why you must provide us with your Personal Information, as well as the consequences of failing to do so. If you do not provide your Personal Information when requested, you may not be able to use our Services if that Personal Information is necessary to provide you with our Services or if we are legally required to collect it.

A. Information You Provide to Us

Registration and Account Information. When you sign up for an account or register to use our Services, we may ask you for your Personal Information to create your account, including your email address and any other information you choose to provide to us. If you log in using a third-party account such as Google, we will also receive information from those third-party account providers, such as your first and last name and email address.

User-Provided Information. When you use our Services, we collect the information you submit to the Services, such as search terms, company names, brand and competitor names, website addresses, and any other inputs necessary to generate reports.

Billing and Payment Information. If you purchase a paid plan, our payment processor, Stripe, collects and processes your payment card details. We do not receive or store your full card number. We do receive and store a limited record of your payment method so we can show it to you and bill you correctly, which is the card brand, the last four digits, and the expiration month and year. We also store your customer and subscription records, including plan, billing status, and payment amounts. Stripe processes this information as an independent controller under its own privacy policy in addition to processing it on our behalf.

Communications. If you contact us directly, we may receive other Personal Information about you. For example, when you contact us to learn more about Gumshoe, we will receive your name and email address, and the contents of your message or attachments that you choose to provide to us. If you subscribe to receive marketing or promotional communications for us, then we will collect certain information from you, such as your email address. We use embedded pixels and similar technologies to track your receipt of and interaction with the emails we send you, including whether and when you open them, whether you access any links included in them, your Location Information (described below), and your Device Information (described below), to learn how to deliver a better customer experience and improve our Services. This tracking applies to our marketing email and also to the transactional email we send about your account, your billing, and the security of your account, because our email providers record delivery and engagement for every message. When you communicate with us online, for example through the support chat in our application, we and our support provider receive and store any information you provide, alongside a profile of your account.

Careers. If you decide that you wish to apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience. You may also apply through LinkedIn. If you do so, we will collect the information you make available to us on LinkedIn.

B. Information We Collect When You Use Our Services

Location Information. When you use our Services, we receive your location information. For example, we infer your location information by using your IP address.

Device Information. We receive information about the device and software you use to access our Services, including IP address, device type, device identifiers, web browser type and version, and operating system version. When you sign in, we record the IP address and browser user agent against your session and retain them for as long as that session remains valid, which is up to 60 days.

Email Domain Assessment. When you create an account, we assess the domain of your email address in order to categorize the account and to identify disposable, temporary, or high-risk addresses. The assessment uses public DNS and mail records for that domain together with reference lists we maintain. It does not inspect the contents of your mailbox, and it does not analyze the part of your address before the @ sign. We record the resulting categories, a confidence value, a risk score, and the reasons behind them, and we keep them so that we do not have to repeat the check. We use this assessment to prevent abuse of the Services and to determine eligibility for promotional offers, such as a free sample report. If you believe your address has been categorized incorrectly, email us at privacy@gumshoe.ai and a person will review it.

Usage Information. To help us understand how you use our Services and to help us improve it, we automatically receive information about your interactions with our Services, like the pages or other content you view, referrer information (the website you visited before coming to our Services), and the dates and times of your visits.

Information from Cookies and Similar Technologies. We and our third-party partners may collect Personal Information using cookies, which are small files of letters and numbers that we store on your browser or the hard drive of your computer. They contain information that is transferred to your computer's hard drive. We and our third-party partners may also use pixel tags and web beacons on our Services. These are tiny graphic images placed on web pages or in our emails that allow us to determine whether you have performed a specific action. We use cookies, beacons, invisible tags, and similar technologies (collectively "Cookies") to collect information about your browsing activities and to distinguish you from other users of our Services. This aids your experience when you use our Services and allows us to improve the functionality of our Services.

Below is an overview of the Cookies we and third parties use to collect Personal Information:

• Strictly Necessary Cookies. These keep you signed in and are required to provide the Services. We cannot provide you with our application without them. (__Secure-better-auth.session_token, 60 days; __Secure-better-auth.session_data, a short-lived session cache refreshed as you browse; __session_gumshoe, 30 days. All three are set on app.gumshoe.ai and are not readable by scripts.)
• Analytical or Performance Cookies. We use these to understand how our Services are used, to operate and improve them. (ph_phc_*_posthog, 365 days, set by PostHog; _ga and _ga_*, up to 2 years, set by Google Analytics. These are set at the gumshoe.ai domain level and so apply to both our website and our application.)
• Targeting and Advertising Cookies. We and our online data partners use Cookies and similar technologies to identify website visitors and associate site activity with contact information for marketing and advertising purposes. See "Online Data Partners" below for how to opt out.

Local Storage. Some of these technologies do not use Cookies. PostHog, our support chat provider, and our affiliate tracking provider each store identifiers in your browser's local storage, which does not expire on its own and is not cleared by deleting Cookies. You can clear local storage through your browser's settings for site data.

Analytics Collected Automatically. Our analytics provider records more than page views. It automatically captures your interactions with our Services, including clicks, without us adding tracking to each element individually. It also records sessions, which produces a replay of your visit showing the pages you saw and the content displayed on them, your mouse movement, scrolling, and clicks, together with diagnostic messages your browser logs while you use the Services. Our analytics provider is configured to mask text you type into form fields, so that it is replaced before the recording leaves your browser. We use replays to diagnose errors and to understand where our Services are confusing. We do not use them to monitor individuals. If you would prefer not to be recorded, see "How to Block Cookies and Analytics" below.

First-Party Analytics Domain. We serve our analytics provider through lytics.gumshoe.ai, a domain we control that forwards to PostHog. We do this so that events are not dropped by network-level blocking. Traffic to that domain reaches a third-party analytics provider, not only us.

C. Information We Receive from Third Parties

Information from Third Parties. If you choose to link our Services to a third-party account, we may receive information about you, including your profile information and your use of the third-party account. If you wish to limit the Personal Information available to us from third-party services, you should visit the privacy settings of your third-party accounts to learn about your options.

Other Third Parties. We may receive AI-generated content and analytical insights from third-party AI service providers based on inputs you provide to our Services. These third parties may process your data in accordance with their own terms and policies.

Online Data Partners. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. The provider we use for this is RB2B, which loads on every page of our website and attempts to identify individual visitors by matching them against contact data it and its partners hold. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

Affiliate and Referral Tracking. We run an affiliate program through Rewardful, which loads on every page of our website and our application. If you arrive through an affiliate link, Rewardful records that referral and associates your subsequent signup and purchase with the referring affiliate so that we can pay them.

How We Use the Information We Collect

We use the Personal Information we collect:

• To provide, maintain, improve, and enhance our Services
• To generate the reports and analysis you request, which requires sending your inputs, such as brand names, competitor names, topics and prompts, to third-party AI model providers
• To improve our Services using aggregated and de-identified data that does not identify you or your organization
• To personalize your experience on our Services such as by providing tailored content and recommendations
• To understand and analyze how you use our Services and develop new products, services, features, and functionality
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support
• To facilitate the connection of third-party services or applications
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you
• To generate anonymized or aggregate data containing only de-identified, non-Personal Information that we may use for any lawful purposes
• To find and prevent fraud and abuse, and respond to trust and safety issues that may arise
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency
• For other purposes for which we provide specific notice at the time the information is collected

We do not train AI models on your data. We do not train AI models on your inputs or on the content of your reports, and we do not build models from customer data.

Legal Bases for Processing European Information

If you are located in the European Economic Area ("EEA") or the United Kingdom ("UK"), we only process your Personal Information when we have a valid "legal basis," including as set forth below.

• Consent. Where we ask for your consent, such as when you subscribe to receive marketing email from us, we process your Personal Information on the basis of that consent, and you may withdraw it at any time.
• Contractual Necessity. We may process your Personal Information where required to provide you with our Services.
• Compliance with a Legal Obligation. We may process your Personal Information where we have a legal obligation to do so.
• Legitimate Interests. We may process your Personal Information where we or a third party have a legitimate interest in processing your Personal Information. We only rely on our or a third party's legitimate interests to process your Personal Information when these interests are not overridden by your rights and interests.

How We Disclose the Information We Collect

• Affiliates. We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.
• Vendors and Service Providers. We disclose information to vendors and service providers retained in connection with the provision of our Services. We maintain a current list of these vendors and what each one receives. If you would like a copy, email us at privacy@gumshoe.ai.
• AI Providers. We send your inputs, and the content of the web pages we retrieve in order to answer them, to third-party AI providers so they can generate your reports. As of the date of this policy those providers are OpenAI, Anthropic, Google (Vertex AI), DeepSeek, Together AI, Perplexity, and xAI. Which provider handles a given request depends on the task. Every one of these requests passes through Portkey, a gateway we use to route and monitor AI traffic, which means Portkey transits your inputs as well.
• Search and Enrichment Providers. To find and retrieve the web pages and search results our reports are built on, we use DataForSEO, Scrape.do, ScrapingBee, and Logo.dev. These providers receive the search terms, brand names, and web addresses involved in your requests, and not your account information.
• Infrastructure Providers. Our application, databases, and backups are hosted on Google Cloud Platform. Our website is served through Cloudflare, and our blog is hosted by WP Engine. We use Temporal Cloud to run background jobs, and its workflow history retains account records including your name and email address.
• Analytics Partners. We use PostHog for product analytics, session replay, and error tracking, and Google Analytics for website analytics. When you are signed in, we send PostHog your account identifier, email address, full name, role, the date your account was created, your IP address, your user agent, and your customer and billing type, so that we can connect product usage to an account. Both providers also receive the automatically collected information described above.
• Other Third Parties on Our Pages. If you sign in with Google, Google receives your sign-in request and returns your email address, name, and profile information. We load Google Fonts on our pages, which means Google receives your IP address on each page load. Our support chat widget loads on every page of our application. Where our application asks you for an address, we use Google's address autocomplete, which receives what you type into that field.
• Payment Processor. We use Stripe to process payments. Stripe receives your name, email address, payment card details, and billing address.
• Support and Communications Providers. We use Zendesk for support, which receives your support messages together with a profile of your account including your name, email address, the organizations you belong to, how many reports and shared projects you have, and when you last ran a report. We use Postmark to send transactional email, including account, billing, and security messages, and Loops to send marketing email. Both receive your email address and delivery and engagement data for the messages they send.
• Sales and Customer Records. We use Attio as our customer record system, which receives the contact details you submit through forms on our website. When a purchase is made, an internal notification containing the buyer's name and email address is posted to our Slack workspace.
• At Your Direction. You can connect Gumshoe to external applications, including AI assistants that support the Model Context Protocol, and you can issue API keys that let your own systems retrieve your data. When you do, information from your account is sent to the application you chose. We do not control that application, and from the moment it receives your data its own privacy terms govern what happens next. You can revoke a connection or delete an API key at any time in your organization settings.
• As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others' rights, property, or safety.
• Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with a corporate transaction.
• Consent. We may also disclose information from or about you or your devices with your permission.

Your Rights and Choices

Location Information. Our Services are a website and a web application, and we do not request precise device location from them. The location information we hold is inferred from your IP address, which we need in order to serve and secure the Services.

Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.

Your European Privacy Rights. If you are located in the EEA or the UK, you may request access to the Personal Information we maintain about you, update and correct inaccuracies, restrict or object to the processing of your Personal Information, have your Personal Information anonymized or deleted, or exercise your right to data portability. Where the request concerns customer content, your organization is the controller, so we will pass your request to them, as described under "Our Role in Handling Your Information." You also have the right to lodge a complaint with a supervisory authority. You may withdraw any consent you previously provided to us at any time and free of charge.

How to Block Cookies and Analytics. You can block Cookies by setting your internet browser to block some or all Cookies, and you can clear stored identifiers through your browser's settings for site data. Please refer to your browser instructions or help screen to learn how to adjust these settings. Blocking Cookies from gumshoe.ai also stops the analytics and session replay described above. Blocking strictly necessary Cookies will sign you out and prevent the application from working.

Do Not Track. There is no accepted standard on how to respond to Do Not Track signals, and we do not respond to such signals.

Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate ("Third-Party Services"). We are not responsible for the privacy practices of these Third-Party Services. We encourage you to read their privacy policies.

Retention

We keep Personal Information for as long as it is necessary for the purposes described in this Privacy Policy, unless we are required by law to keep it for a longer period. Some retention periods are fixed, and those are set out below.

• Signed-in sessions, including the IP address and user agent recorded against them: 60 days.
• The __session_gumshoe cookie: 30 days.
• The PostHog analytics cookie: 365 days.
• Google Analytics cookies: up to 2 years.

Other categories, including reports, retrieved web page content, application logs, database backups, analytics event data and transactional email records, are kept for as long as your organization uses the Services and for a period afterwards. We are working through fixed periods for these and will state them here once they are set.

Deleting Your Account

You can delete your account at any time from your account settings. We will ask you to confirm by email, and when you do we delete your profile, your credentials and your active sessions.

Reports and other content in your organization's workspace are not deleted with your account, because that content belongs to the organization rather than to you. To have organization content deleted, the organization's administrator should contact us at privacy@gumshoe.ai.

Security

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

Where Your Information Is Processed

We host our Services in the United States. Our application servers and primary database run in Google Cloud's us-east4 region, and our backups are held in the United States.

Hosting and processing are not the same thing. Generating a report requires sending your inputs to third-party AI model providers, and those providers run their own infrastructure. Some of them process data outside the United States. The same is true of some of the search and retrieval providers we use. If you need to know which providers are involved in processing your organization's data, email us at privacy@gumshoe.ai and we will tell you.

If you are located in the EEA, the UK or another region with laws governing data collection and use that differ from U.S. law, then using our Services transfers your Personal Information outside of that region, to the United States and to the providers described above.

Children's Privacy

We do not knowingly collect, maintain, or use Personal Information from children under 16 years of age ("Minors"), and no parts of our Services are directed to Minors. If you learn that a Minor has provided us with Personal Information in violation of this Privacy Policy, then you may alert us at privacy@gumshoe.ai.

Changes to This Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share Personal Information previously collected from you through our Services, we will attempt to notify you through our Services, by email, or other means.

Contact Information

Gumshoe.AI, Inc. is responsible for the processing described in this Privacy Policy. As explained under "Our Role in Handling Your Information," we are the controller for account, billing and marketing information, and a processor acting on your organization's instructions for customer content. If you have any questions, comments, or concerns about our processing activities, please email us at privacy@gumshoe.ai.

240 2nd Ave S #300

Seattle, WA 98104