This Privacy Policy explains how FILATOR DIGITAL TECHNOLOGIES, trading as Deepage ("Deepage," "we," "us," or "our") collects, uses, and protects personal data when you use deepage.io and the Deepage service (the "Service"). It forms part of our Terms of Service. If you do not agree with this Policy, please do not use the Service.
01 Data we collect
Data you provide
- Account data — name, email address, password (stored hashed), company/brand name, and website URL.
- Billing data — processed by our payment processor, Stripe. We do not store full card numbers; we receive limited billing metadata (e.g., plan, payment status, last 4 digits, country).
- Integration credentials — credentials or tokens you provide to connect your website (e.g., WordPress application passwords, webhook endpoints), your Google Search Console account, your Google Analytics property if you connect one, and, if you connect one, a Gmail account or other mailbox for sending emails you approve (see §07). These are stored encrypted and used only to operate the Service for your account.
- Knowledge base inputs — facts about your business you confirm or edit (e.g., pricing, features, competitors, audience).
- Communications — messages you send us (support, email, feedback).
Data we collect automatically
- Usage data — features used, actions taken in the app and their timestamps, which the Service records as part of running your account; and pages viewed on our public site and your approximate location derived from your IP address, through Google Analytics when analytics is on (see §10).
- Device data — browser type, operating system and IP address, which every request to our servers carries.
- Ad and campaign data — when the matching cookies are on (see §10): how you arrived at deepage.io (referrer, campaign parameters, landing page) through Google Analytics, and, if you arrived from one of our Google ads, the ad click identifier through Google Ads. See our Cookies Policy.
Data we collect from other sources
- Your public website content — to build your brand profile, we crawl the publicly available pages of the website URL you provide. This is read-only and may incidentally include personal data your site displays publicly (e.g., team names, testimonials).
- Google Search Console — if you connect it, we retrieve search performance data (queries, rankings, clicks, impressions) for your site via Google's API, subject to Google's terms.
- Google Analytics — if you connect it, we read sessions by source and landing page from the one property you choose, read-only, to show you visits from AI assistants (see §07).
- AI answer engines — we submit business-related questions about your market to third-party AI services and store the answers to measure brand mentions. We do not submit your personal data in these queries beyond your brand and market context.
The free AI Crawler Check
When you use our free AI Crawler Check, we store the web address you asked us to check and the result of that check — which AI crawlers could reach the site, and whether anything blocked them. We do this so we can report on how common crawler blocking is across the web as a whole. We do not store your email address or the content of any page we look at, and we do not keep your IP address with the result. We never publish or share the individual sites that have been checked, and any figures we publish are anonymous aggregates across many sites, never about one. Anyone can use the tool without giving us any personal information.
We do not knowingly collect data from anyone under 18. The Service is for business use.
02 How we use data
We use personal data to:
- Provide, operate, and maintain the Service (including generating content, publishing to your connected site, and producing your dashboard);
- Process payments and manage subscriptions and renewals;
- Communicate with you about the Service (transactional emails, support, important notices);
- Measure and improve the Service, including analytics on how features are used;
- Understand where our visitors and customers come from, including whether our Google ads lead people to set up Deepage;
- Show our ads to people who have visited our site (remarketing), when advertising is on (see §10);
- Send marketing communications where permitted — you can opt out at any time via the unsubscribe link;
- Detect, prevent, and address fraud, abuse, and security issues;
- Comply with legal obligations.
03 Legal bases (where GDPR or similar laws apply)
Where required, we process personal data on these bases: performance of a contract (providing the Service you signed up for), legitimate interests (security, improving the Service, and analytics and advertising outside the EU/EEA, the UK and Switzerland), consent (analytics and advertising cookies in the EU/EEA, the UK and Switzerland, and marketing emails where required), and legal obligation (tax, accounting, lawful requests). You can withdraw consent at any time; withdrawing does not affect processing that happened before.
04 Sharing and disclosure
We share personal data only with:
- Service providers (processors) who help us run the Service — e.g., cloud hosting, payment processing (Stripe), email delivery, security checks (Cloudflare Turnstile), analytics (Google Analytics, when analytics is on), and AI model providers used to generate content and measure citations. Each is bound by contractual data-protection obligations and processes data only on our instructions.
- Google Ads — when advertising is on (see §10): Google's tag records your visits to our public pages so we can show our ads to people who have visited our site (remarketing) and so Google can build audiences for our campaigns; and when you finish setting up your first website, your browser tells Google Ads that the setup was completed, with a random identifier we create for that event and the ad click identifier if you came from one of our ads. We do not send your name, email address or website, and we do not use enhanced conversions. Google's use of this data is also governed by Google's own policies.
- Third-party services you connect — e.g., your WordPress site, your webhook endpoint, Google Search Console — as directed by you.
- Legal and safety recipients — where required by law, legal process, or to protect the rights, safety, or property of Deepage, our users, or others.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.
A current list of key subprocessors is available on request at hasan@deepage.io.
05 International transfers
We are based in Dubai, United Arab Emirates, and our service providers may process data in other countries (including the United States and the European Union). Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses or equivalent mechanisms.
06 Data retention
We retain personal data for as long as your account is active and as needed to provide the Service.
When a website’s subscription ends, that website becomes read-only and we keep its project data for 60 days. You can reactivate or export during that window. After 60 days we permanently delete it — your brand profile, content plans, drafts, stored AI answers, citation history and Search Console history. We send a reminder email 10 days before the deletion date. Deletion is permanent and cannot be reversed.
We keep your account record (name, email, login) and billing records after that, so you can return to Deepage and because tax and accounting law requires us to retain invoices — and otherwise where longer retention is required for legal, security, or dispute purposes. Content already published to your own website is not ours to delete and remains yours. Backups are purged on a rolling cycle, so a copy may persist in backup storage for a short period after deletion.
07 Google data
Google Search Console and Google Analytics
If you connect Google Search Console, Deepage reads, read-only, the search performance of the site you connect (queries, pages, clicks, impressions, average position) and the indexing status of pages we published for you. If you connect Google Analytics, Deepage reads, read-only, sessions by source and landing page from the one property you choose, to show you visits from AI assistants. We use this data only to provide features you see in Deepage: your dashboard, the articles we plan for your site, and the questions we track for you. Where a feature needs it, your search queries or landing pages are sent to our AI model providers to plan that work; they are never used to train models, never sold, and never used for advertising. Your Google access tokens are stored encrypted. You can disconnect either connection at any time, and we delete the data with your account as described in §06.
Gmail
This part applies only if you connect a Gmail account to Deepage, so that emails you approve can be sent from your own address. Connecting Gmail is switched off for now. It covers the information Deepage receives from Google through the Gmail API.
Gmail: what Deepage asks Google for, and why
- Send email from your account (
gmail.send) — used only to send emails you have approved in Deepage: a first email and, if nobody replies, up to two follow-ups in the same thread. Deepage never sends an email you have not approved. When you connect, it also sends one test email from your account to your own address, to confirm the connection works. - Read email (
gmail.readonly) — used only to read replies in the email threads Deepage started for you, so that a reply stops the follow-ups and you can see it in Deepage. Deepage opens a thread only by the ID it recorded when it sent the first email in it, and uses it only if the thread contains an email Deepage sent. No other email is read. Deepage never lists, searches or opens anything else in your mailbox, and never marks, labels, moves or deletes your email.
When you connect, Deepage also reads your Gmail address from your account, to send from it. Nothing else from your account is used.
Gmail: what we store, and for how long
- Your Google authorization — the refresh token Google issues to Deepage (short-lived access tokens are never stored), encrypted, and your Gmail address. Kept until you disconnect.
- Replies to the emails Deepage sent — for each reply: the sender's address, when it arrived, its message ID, and the first 300 characters of the new text of the reply (earlier quoted messages are removed). The full reply stays in your Gmail; Deepage does not keep a copy of it. Kept until you disconnect Gmail, delete your account, or your data is deleted 60 days after your subscription ends (§06).
- The emails Deepage sent for you — their text, recipient and time, and the IDs Gmail gave them, so a reply can be matched to the right email. Kept with your account data (§06).
- A do-not-email list — if someone replies asking not to be contacted, or an email bounces, we keep their address and the reason, so no further email from Deepage goes to them. Kept with your account data (§06), including after you disconnect.
- Spacing between emails — so the same person is not emailed repeatedly by different Deepage customers, we keep a one-way keyed hash of each recipient's address and the time it was last emailed. It cannot be turned back into the address and contains nothing from your mailbox.
Gmail: what we never do
- We never sell Gmail data and never use it for advertising.
- We never use Gmail data to train AI models — ours or anyone else's.
- Reply text is not sent to any AI provider. Deepage recognises a reply, an automatic reply, a bounce or a request to stop with fixed rules, not with an AI model. The emails themselves are written with an AI provider (Anthropic) from information about your business and the page the email is about — never from your mailbox.
- No person at Deepage reads your Gmail data, unless you ask us to (for example, for support), where it is needed for security or to investigate abuse, or where the law requires it.
- We do not share Gmail data with anyone except the providers that host Deepage's servers and database, under contract, or where the law requires it.
Gmail: disconnecting
You can disconnect Gmail in Deepage at any time. When you do, Deepage revokes its access at Google and deletes the stored authorization and every reply it recorded. The record of emails already sent and the do-not-email list stay with your account data, as described above. You can also remove Deepage's access from your Google Account at myaccount.google.com/permissions. If you connect a mailbox with an app password instead of Gmail, the same rules apply: only replies in threads Deepage started are read, stored as above, and deleted when you disconnect.
Google API Services User Data Policy
This covers all Google data above: Search Console, Analytics and Gmail. Deepage's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
08 Security
We apply technical and organizational measures appropriate to the risk, including: encryption of credentials at rest, encryption of data in transit (TLS), logical isolation of each customer's data, access controls, and monitoring. No system is perfectly secure; you are responsible for keeping your account credentials confidential.
09 Your rights
Depending on your location, you may have rights to: access the personal data we hold about you; correct inaccurate data; delete your data; receive a copy in a portable format; object to or restrict certain processing; and withdraw consent where processing is based on consent. UAE residents have rights under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021); EU/EEA and UK residents have rights under the GDPR/UK GDPR; other jurisdictions may provide similar rights.
To exercise any right, email hasan@deepage.io. We may need to verify your identity. If you are in the EU/EEA or UK, you may also lodge a complaint with your local supervisory authority.
10 Cookies and tracking
We use cookies and similar technologies as described in our Cookies Policy. In short: essential cookies to run the site and app, and Google Analytics and Google Ads (measurement and remarketing). In the EU/EEA, the UK and Switzerland (or if we cannot tell where you are), nothing optional runs until you choose in our cookie banner. Elsewhere both are on by default. Wherever you are, you can change or withdraw your choice at any time from Cookie settings at the bottom of every page; turning one off deletes its cookies on deepage.io. If your browser sends a Global Privacy Control signal, advertising, including remarketing, stays off.
11 Marketing communications
If you sign up or request materials from us, we may send you product and marketing emails. Every marketing email contains an unsubscribe link. Transactional emails (billing, security, service notices) are sent regardless, as they are necessary to operate your account.
12 Third-party links and services
The Service links to and interoperates with third-party services (e.g., Google, WordPress, AI answer engines, community platforms). Their privacy practices are governed by their own policies, which we encourage you to review.
13 Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by email or in-app notice before they take effect. The "Last updated" date at the top reflects the current version.
14 Contact
FILATOR DIGITAL TECHNOLOGIES, trading as Deepage
Dubai, United Arab Emirates
Email: hasan@deepage.io