Privacy Policy

Last updated: September 14, 2026

1. Who we are

Survelium is a brand visibility monitoring platform operated by ALKPRO SRL, a company registered in Romania under trade register number J2006000258513, tax identification number 18619507, with its registered office at Str. Zefirului nr. 7, bl. I14, sc. 3, ap. 15, Călărași, jud. Călărași, cod poștal 910144, România.

For the purposes of Regulation (EU) 2016/679 (GDPR), ALKPRO SRL is the data controller for the data described below. You can reach us at any time at contact@survelium.com or +40 724 251 574.

This policy covers the services available at survelium.com and survelium.ro, including the web application and its integrations.

2. What data we collect

• Account data — name, email address, password (stored only as a hash), preferred language, sign-up date. If you sign in with Google, we receive your name, email address and Google account identifier from Google.
• Data about the brands you monitor — brand name and domain, description, the competitors you track, the prompts you configure and the results of the analyses. This is typically company data rather than personal data.
• Usage and technical data — IP address, browser type, pages visited, timestamps, and application errors.
• Billing data — company name, tax identification number, billing address, subscription and invoice history. Card details never reach us; they are entered directly with our payment processor.
• Data from optional integrations that you switch on yourself — see section 3 for Google Search Console.
• Communications — the messages you send us and, if you subscribed, your newsletter email address.

3. Google Search Console data

Connecting Google Search Console is optional, done per brand, and can be undone at any time. If you never connect it, nothing in this section applies to you.

The permission we request. We request a single, read-only Google scope: https://www.googleapis.com/auth/webmasters.readonly. We cannot modify, delete or add anything in your Google Search Console account.

What we read. The list of verified properties in your account (so we can show you which property to connect) and the Search Analytics report for the connected property over the last 28 days, at query level: the search term, impressions, clicks, click-through rate and average position.

Why. To turn the real searches through which people find your site into natural-language questions of the kind people ask AI assistants, which you can then monitor in the platform. That is the only purpose.

How it is processed. Queries are fetched live, only at the moment you press the generate button. They are sent in a single call to the language model provider we use for prompt generation (OpenAI or Anthropic, depending on the current configuration), which rewrites them into questions. We do not store the raw queries in our database — we keep only the resulting prompt suggestions and the address of the connected property, so you can tell where a suggestion came from.

How credentials are stored. The access and refresh tokens issued by Google are stored encrypted in our database, are never displayed in the interface and are never shared with anyone.

How to delete them. In the application, under Brand → Integrations → Disconnect: the tokens are deleted immediately. You can additionally revoke access at any time from your Google account at myaccount.google.com/permissions.

Limited Use. Survelium's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: we do not use Google Search Console data for advertising, we do not sell it or transfer it for any unrelated purpose, we do not use it to train generalized artificial intelligence models, and humans do not read it except where you have given explicit consent (for example for support), where it is necessary for security purposes or to comply with applicable law, or where the data is aggregated and anonymised.

4. Legal bases for processing

• Performance of a contract (Art. 6(1)(b) GDPR) — creating your account, running your subscription, delivering the service.
• Consent (Art. 6(1)(a)) — connecting Google Search Console, newsletter subscription. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — keeping the platform secure, preventing abuse, improving the product, and service-related communications.
• Legal obligation (Art. 6(1)(c)) — invoicing, accounting and tax record-keeping.

5. Who we share data with

We do not sell data. We disclose it only to the providers that help us deliver the service, acting as processors under a data processing agreement:

• chroot.ro — application and database hosting (Romania, EU)
• OpenAI, Anthropic, Google, Perplexity — the language model providers that generate and answer prompts; they receive the prompts, the brand context and, for Search Console generation, the queries described in section 3 (United States)
• DataForSEO, Bright Data — collecting the public answers of AI assistants and search engines (United States, EU)
• Stripe — card payment processing (United States, Ireland)
• FGO — invoice issuing (Romania)
• Brevo — newsletter delivery (France, EU)
• Flare — application error monitoring (Belgium, EU)
• Amazon Web Services — storage of generated files (EU)
• Our email provider, for transactional messages such as confirmations, password resets and reports

We may also disclose data to public authorities where the law requires it.

6. Transfers outside the European Economic Area

Some of the providers above are established in the United States. Transfers to them rely on the Standard Contractual Clauses approved by the European Commission and/or on certification under the EU–U.S. Data Privacy Framework, where the provider is certified.

7. How long we keep data

• Account and brand data — for the life of the account, plus 30 days after deletion.
• Google Search Console tokens — until you disconnect or revoke access.
• Invoices and accounting records — 10 years (Romanian Accounting Law no. 82/1991).
• Technical logs — up to 12 months.
• Newsletter address — until you unsubscribe.

8. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise them, write to contact@survelium.com. We answer within 30 days at the latest.

If you are not satisfied, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest, dataprotection.ro.

9. Cookies

We use only cookies that are strictly necessary for the service to work: the session cookie, the CSRF protection token and, if you choose to stay signed in, the "remember me" cookie. We do not use advertising cookies, cross-site tracking cookies or third-party analytics on our own website.

The measurement script our customers can install on their own sites sets no cookies — it uses a temporary value in the browser's session storage so a visit is not counted twice — respects the Do Not Track signal, and does not store visitors' IP addresses.

10. Security

Traffic is encrypted with TLS, passwords are stored using modern hashing functions, and integration credentials are encrypted at field level in the database. Access to production infrastructure is limited to the people who need it.

11. Children

The service is aimed at professionals and companies. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

We may update this policy. The version in force is always the one published on this page, with the last-updated date at the top. If the changes are significant, we will tell you by email or inside the application.

13. Contact

ALKPRO SRL, Str. Zefirului nr. 7, bl. I14, sc. 3, ap. 15, Călărași, jud. Călărași, cod poștal 910144, România. Email: contact@survelium.com, phone: +40 724 251 574.