Privacy Policy

Last updated 26 October 2026

This policy explains what Site Monkeys collects, why, who it is shared with, and the choices you have. It covers the sitemonkeys.ai website and its waitlist, the free visibility scan, the client dashboard at app.sitemonkeys.ai, and the emails we send.

Who we are

Site Monkeys is provided by Site Monkeys, LLC, a North Carolina limited liability company ("Site Monkeys", "we", "us"). We provide local marketing measurement and planning for small and medium businesses.

Email: help@sitemonkeys.ai
Mail: Site Monkeys, LLC, 30 N Gould St #58147, Sheridan, WY 82801

What we collect

When you run a free scan

• What you type into the scan form: your website address, business name, city and region, number of locations, a description of the business, its main service, how widely it serves, how long it has operated, and, if you choose, the cities you serve, a phone number and a note.
• Your IP address and browser user agent, used to limit how many scans one visitor can run and to block automated abuse.
• If you ask for the full report by email: your name, email address and, if you give it, a phone number.

When you join the waitlist

• Your email address and, if you give them, your name, your business's name and its website.
• If you arrived from one of our ads or links, which campaign it was (its source, medium and campaign name). We do not record ad click identifiers.
• We use these only to email you when a place opens and about your place on the waitlist. You can ask to be removed at any time by writing to help@sitemonkeys.ai.

When you create an account

• Your name, email address and a password. We store the password only as a one-way hash (bcrypt); we cannot read it.
• Your business details: website, phone, city and region, category, main service, service area, number of locations and years in business.
• Your time zone, read from your browser, so dates are shown in your local time.

When you use the dashboard

• The rules you confirm for your account, your answers about how you talk to customers, the requests you send us, and your decisions on approval requests, with who made each decision and when.
• If you connect Google, the information described under "Google user data" below.

Public information about businesses

• To measure a business's visibility we read publicly available information: the business's own website, Google search results, and Google business listings (name, address, phone, website, category, hours, star rating and review count).
• This includes the same public information about competing businesses that appear in those results.
• For reviews in this public information we collect only the star rating and the number of reviews; we do not collect review text or reviewers' names. (If you are a client and connect your own Business Profile, what we read from it is described under "Google user data" below.)

How we use it

• To run scans and produce your report and dashboard.
• To operate your account: signing you in, recording your rules, requests and approvals, and showing the state of your connections.
• To send the emails you would expect: the report you asked for, approval requests and reminders for your account, password-reset emails, and, if you joined the waitlist, word that a place has opened.
• To keep the service secure, prevent abuse, and investigate problems.

We do not sell personal information. We do not use it for advertising. We do not send marketing newsletters. We do not use analytics or advertising trackers on our pages.

Artificial intelligence

Reports, plans and the drafting of your account rules are produced with AI models from Anthropic. The information sent to these models includes:

• what you entered in the scan form, including any phone number and note you gave;
• text from the business's website;
• public search results and public business listing information, including listing details (address, phone, website, star rating and review count) from Google Places;
• the requests you write to us.

We do not send the email address you give for your report to an AI model.

To draft a reply to a review, we send that review (its text, star rating and the reviewer's display name) with your business's approved voice and confirmed details to Anthropic's models. To draft a profile post or update, we send your profile's details. Anthropic's terms do not allow it to train models on this data. Google user data is never used to train AI models.

Who we share it with

We use these service providers to run Site Monkeys. Each receives only what it needs for the task listed.

Provider	What it does for us	What it receives
Railway	Hosting and database	All data we store
Anthropic	AI models that write reports and analyse business information	See "Artificial intelligence" above, including public listing details from Google Places
Google	Business listing data (Places), the Google sign-in and connection, and website icons	Business names, locations and website addresses we look up; for the connection, see "Google user data"
DataForSEO and Serper	Search results, search volumes and listing data	Search terms built from business names, services, places and websites
Cloudflare (Turnstile)	Checking that a scan request comes from a person	Information about your browser and your IP address
Stripe	Payments	Your email and checkout details. Card details are entered on Stripe's own page; we never receive or store them.
Resend	Sending email	Your email address and the message
Sentry	Error reports, when error monitoring is switched on	Technical details of errors
Tailwind (cdn.tailwindcss.com)	Page styling loaded by the dashboard	Your IP address and browser details, as with any web request

We may also disclose information when the law requires it, or to protect the rights and safety of our users or of Site Monkeys.

Cloudflare Turnstile

The scan form is protected by Cloudflare Turnstile. Turnstile's use of your information is governed by the Cloudflare Turnstile Privacy Addendum and Cloudflare's privacy policy.

Google user data

A client can connect their Google account so we can check access to their Google Business Profile and Google Search Console.

• What we request: your Google account email (sign-in), permission to manage your Business Profile (business.manage), and read-only access to Search Console (webmasters.readonly).
• What we read today:
  • your Google account email;
  • the list of Business Profile accounts you can access;
  • the list of Search Console sites you can access.
  Only a Search Console site that matches your business's website is used for your business. When none matches, the connection check records the addresses of the sites Google listed, so we can show you why; that record is deleted when you disconnect. Once Google approves our access and you have a paid plan, we also read, for the Business Profile that is your business's (matched by its Maps listing or your website; a profile that is not your business's is never used): the profile's details (name, address, phone, website, categories, hours, service area, description, services and attributes), and its reviews, including each review's text, star rating, date, the reviewer's display name as Google shows it, and any reply. We use these only to keep your profile complete, to draft replies to your reviews, and to publish the posts, photos, profile updates and replies your plan includes. Replies to complaints are published only after you approve them. You can also choose to approve every reply before it is published. We never post a review, hide a genuine review, or contact a reviewer except by the public reply.
• How we use it: only to provide features you have asked for. Today that means showing you, in your dashboard, which Google services are connected and working for your business. It is never used for advertising, never sold, never used to decide credit or lending, and never used to create, train or improve AI or machine-learning models. It is shared with another company only where that is needed to provide a feature you asked for (see "Artificial intelligence" above), for security, to comply with the law, or as part of a merger or sale of the business after asking for your consent. Our staff do not read it except with your permission, for security, or where the law requires.
• How we store it: the refresh token Google issues is encrypted (AES-256-GCM) with a key kept outside our database. Short-lived access tokens are used and discarded, never stored.
• Disconnecting: the account owner can disconnect Google from the dashboard at any time. Disconnecting asks Google to revoke our access, and deletes our copy of the token and the connection checks whatever Google answers. If Google does not confirm the revocation, the dashboard says so and asks you to remove Site Monkeys' access in your Google Account settings. We keep a record that the connection existed (the Google email, permissions and dates). You can also remove access from your Google Account settings at any time.

Site Monkeys' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is published at developers.google.com/terms/api-services-user-data-policy.

Cookies and browser storage

• sm_scan_unlock: remembers which scan reports you have unlocked, for 90 days.
• sm_google_oauth and sm_google_return: used for 10 minutes while you connect Google, then cleared.
• Your browser's local and session storage hold your sign-in session for the dashboard and your progress through sign-up (never your password).

We use no advertising or analytics cookies.

How long we keep information

We do not yet delete information automatically. Scan results, the details given with them, account information and logs are kept until they are deleted at your request or we no longer need them. Waitlist details are kept while you are on the waitlist. To ask us to delete information about you or your business, write to help@sitemonkeys.ai.

Security

• Information travels over encrypted connections (HTTPS).
• Passwords are stored only as hashes, and Google tokens are encrypted.
• Each client's data is kept separate from every other client's.
• Every action our staff take in the admin tools is logged.

No system is perfectly secure, and we cannot guarantee absolute security.

Your choices and rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it, by writing to help@sitemonkeys.ai. Depending on where you live, you may have further rights under local law, including the right to complain to a data protection authority.

Children

Site Monkeys is a service for businesses and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes to this policy

When what we collect or how we use it changes, we update this page and the date at the top. If a change materially affects clients, we will tell them before it takes effect.

Questions: help@sitemonkeys.ai