Last updated: 13 October 2026
This policy explains what personal data DevTune collects, why, who we share it with, how long we keep it and what your rights are. DevTune is operated by PLGeek Ltd.
PLGeek Ltd, C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom. Email privacy@devtune.ai.
We are the controller for the personal data of people who visit our website, hold a DevTune account, contact support, receive our emails or are billed by us.
We are a processor for the data our customers bring into DevTune: the prompts they track, the AI answers and citations we collect for them, the pages we crawl from their site, the crawler and referral logs from their site, the Google, Slack and Cloudflare data they connect, and what they say to and receive from our agents. The customer decides why that data is processed and is the controller for it. We process it only on the customer's instructions and to provide the service.
We offer a data processing agreement to customers on request. Email privacy@devtune.ai.
Google Search Console and Google Analytics 4 connections are optional. DevTune accesses Google user data only after a project manager starts the relevant connection and authorizes the read-only permission shown by Google.
DevTune requests only the Google Analytics and Search Console read-only scopes. We do not request permission to edit Google data, import raw GA4 events, or access individual Google account profile or email data through these connections.
We use Google user data only to provide and improve DevTune's customer-facing features: comparing classic search with AI visibility and AI Traffic, avoiding recommendations that would put search-performing pages at risk, attributing aggregate AI-referred sessions and selected conversions, measuring Results, and producing the project reports or managed-agent analyses a customer requests.
OAuth refresh tokens are stored as encrypted secrets. Imported Google data is stored in the project that authorized the connection, protected by encrypted transport, role-based access controls, and tenant-isolating row-level security.
We do not sell Google user data or use it for advertising, credit decisions, or training generalized artificial-intelligence or machine-learning models. We share it only with service providers acting on our behalf where necessary to provide or improve a customer-requested feature, for security, or as required by law. When a customer asks a DevTune managed agent to analyse project data, the relevant project-scoped aggregates may be sent to the AI model provider solely to produce that requested result.
Disconnecting Google Search Console or Google Analytics 4 stops future syncs and removes the stored OAuth credential. Historical aggregate performance data already imported may remain available to the project until it is removed under our retention or account-deletion processes. You can request deletion of Google-derived data by emailing privacy@devtune.ai.
If we change how DevTune uses Google user data, we will update this policy and provide any notice or consent required before using that data for a new purpose.
To run your prompts, audit pages, draft content and run agents we send requests to AI models. Most requests go through Vercel AI Gateway or OpenRouter, which route them to model providers including Anthropic, OpenAI, Google, DeepSeek, xAI and Perplexity. Tracked prompts are run on AI platforms through Bright Data and cloro, and during onboarding, or where we have configured it for a platform, directly against the OpenAI, Perplexity and Google APIs.
A request contains only what the task needs: the prompt or instruction, the project data it draws on, and page content from your site. We do not use your data to train models. Vercel AI Gateway deletes prompts and responses once a request completes, and OpenRouter states that it does not use inputs or outputs for training and lets us avoid providers that do. Do not put sensitive personal data in prompts or agent instructions.
We process account holders' data to provide the service under our contract with you, including running prompts, audits and agents, and to send service emails about your account. We process customer project data on the customer's instructions under our terms; the customer holds the legal basis for it. Security, fraud and abuse prevention, error monitoring and server logs rest on our legitimate interests. Analytics storage rests on your consent, which you can withdraw at any time. Billing, tax and accounting records are kept to meet legal obligations.
We share data with providers that process it on our behalf. Vercel and Supabase host the service, Inngest runs background jobs, Stripe handles billing, Resend sends email, PostHog and Google Analytics measure usage with your consent, Sentry collects error reports, Arcjet and Cloudflare protect against abuse, Cossistant runs support chat, Mintlify hosts the docs, and Vercel AI Gateway, OpenRouter, Bright Data, cloro, DataForSEO and Firecrawl run the AI, prompt, search-volume and page-fetching work. Each provider's purpose and location is on our Subprocessors page. We do not sell personal data and do not share it for advertising.
We disclose data when the law requires it or to protect our rights, our users or the public.
PLGeek Ltd is in the United Kingdom. Some providers are in the United States. For transfers out of the UK and the EEA we rely on the data processing terms of each provider, which incorporate the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. We have not yet confirmed cloro's data processing terms or the safeguard for its processing in the United States. Our analytics and error monitoring providers hold data in the EU.
These are the periods we apply. Where deletion runs automatically, it is a scheduled job.
| Data | Kept for |
|---|---|
| Account, profile and team membership | While your account exists. Deleted when you delete the account. |
| Projects, tracked prompts, citations and brand mentions from AI answers, AI Traffic totals, audits, actions and results | While the project exists. Deleted when you delete the project or the account. |
| Full text of AI answers | 30 days, deleted daily. The citations, brand mentions and scores taken from each answer stay while the project exists, as do the claims we check, each with the sentences around it. |
| Positioning results for individual AI answers | 13 months, then deleted a month at a time. Daily totals for each claim stay while the project exists. |
| Individual AI Traffic events, such as each crawl, answer fetch or visit | The period your plan sets: 90 days on Plus, 180 days on Pro and Agency, and 365 days on Enterprise unless your contract sets another period. Retired plans keep between 30 and 365 days. Deleted daily. Hourly and daily totals stay while the project exists. |
| Agent instructions, conversations and outputs | While the project exists. Deleted with the project or the account. |
| Connected Google, Slack and Cloudflare credentials | Removed when you disconnect the integration. |
| API request logs | 30 days, deleted daily. |
| Our own AI usage metering records | 12 months, deleted daily. |
| Audit log of privileged administrative actions | 400 days, deleted daily. |
| In-app notifications | Shown for 1 month, then deleted a month later. |
| Hosting request logs | No more than 30 days at our hosting provider. |
| Error reports | Up to 90 days at our monitoring provider. |
| Support conversations | Held by our support provider until we ask for deletion, which we do on request. |
| Billing and tax records | 6 years, as UK tax law requires. |
| Database backups | Up to 30 days, then overwritten. |
API activity logs used for account governance are retained for up to 30 days. Client metadata (IP address and user agent) is only included in these logs when explicitly enabled by configuration.
Every table is protected by row-level security so one account cannot read another's data. Access is role-based, transport is encrypted, privileged actions are logged and connected-service credentials are stored encrypted. No system is perfect; if you find a problem, email privacy@devtune.ai.
Depending on where you live you can ask us to:
Where we rely on consent, you can withdraw it at any time. For analytics, use the Cookie manager in the footer or on the Cookie Policy page.
To exercise any right, email privacy@devtune.ai. Account holders can delete their account from Settings.
If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to the data protection authority where you live.
California residents have the rights to know, delete and correct under the CCPA and CPRA. We do not sell or share personal information for cross-context behavioural advertising.
If your personal data is in a customer's project, for example because you visited their website or used their product, contact that customer. We will help them respond.
The service is not for children under 16 and we do not knowingly collect their data. If you think a child has given us personal data, email us and we will remove it.
We update this page when our practices change. The date at the top shows the current version. If a change needs your consent, we will ask for it.
PLGeek Ltd, C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom. Email privacy@devtune.ai.