Privacy policy

This policy describes what neshat.ai stores when you use the site and the NeshatScan tool, why, and how to have it removed. It is written to be read.

What is stored, and why

When you run a scan

• The website address you typed and the scan results. Kept so the report has a permanent, unlisted link you can share, and so repeat scans of the same URL within fifteen minutes are served from cache.
• A salted hash of your IP address. Used only to limit how many scans one connection can start. The address itself is not stored and cannot be recovered from the hash.
• Where the visit came from. With the scan: the site that linked you here (its address without the query), the campaign tags in the link you followed (utm_source and the like), and the page you landed on. Kept in your browser for the visit (no cookie) and sent only with a scan.
• Scanned domains appear in a daily summary sent to Behnood Neshat, because a business that scans itself may want help, and in the list described below. Beyond those, scan data is used only for the emails you ask for (below), for Monitoring you subscribe to, and for our own research scans described on the crawler page.

When you open the full report

• The full report needs an email address. After a scan, the result page shows the counts, the verdict and which checks passed; the findings, their evidence and the fixes open once you enter an address, right away on the same page.
• What is stored: the address as you typed it, the site you scanned, the time, the site you came from, the campaign tags and the landing page (above), and the salted hash of your IP address. A few records of what happened on the report (the result page viewed, the report opened, a checkout button pressed) are kept with the scan.
• You get one email with the report link. It carries a one-click unsubscribe (“Didn’t ask for this?”) and the postal address.
• Only if you tick the box, which is never ticked for you: five short emails over fourteen days about this report. The report and the first email never depend on it.
• Behnood Neshat sees your address with the scan in a list that only he can open, after signing in, and may write to you personally about this report. The one-click unsubscribe in any email also stops these personal follow-ups.
• An address you enter too often from one connection, or a scan opened by too many addresses, still opens the report, and no email is sent.

When you run the Citation Check

• The check runs on its own when a scan’s result opens, within its daily limits. It reads the business’s name, category and location from the scan of its public website, writes buyer questions from them, and asks those questions to ChatGPT, Gemini, Perplexity and Grok through their APIs. The questions contain no personal data: never your email, your IP address or anything you typed besides the website.
• The questions and the assistants’ answers are stored with the check, so the same site is not asked again for a day and the full check can build on the free one. The salted IP hash limits free checks to three a day per connection.
• If you ask for the full check by email, your email address is stored with it and the result is sent once. It does not start the fourteen-day emails and is not added to any list.

When you send a form or ask for the follow-up emails

• Your name (if given), email address, website address and message, kept so I can reply and so the conversation has context.
• If you ticked the box for the follow-up emails (on the report page, or the same box under “Email me this report” on a report that is open to everyone), you get the report link, then short emails over fourteen days. After a scan that read your page, five: what your top finding means, the self-serve Fix Pack, an automatic re-scan with a diff on day seven, a monitoring option, and one last note (after a clean scan, the first two are about the clean result and keeping it that way). After a scan that could not read your page, which is where “Email me this report” is mostly offered, four, without the Fix Pack and monitoring offers: what your top finding means, what the scan could not see, the re-scan on day seven, and one last note. Every one carries a one-click unsubscribe and a postal address; unsubscribing stops the rest at once. Nothing is sent after day fourteen. No newsletter. Without the box, “Email me this report” sends the report link only.

When you click a link in an email

Links in emails from neshat.ai go through Resend’s click tracking. Resend records the click, and this site keeps which link was clicked, in which email and when, to know which offer was used. That record is tied to the email it was in, and so to the address the email went to. It never holds your device or IP address. It is deleted automatically after twelve months, or by hand with your email address when you ask (below).

When you buy something

• Payments run through Stripe. Your card details go to Stripe and never reach neshat.ai; this site stores your email, the website the purchase is for, the amount, and Stripe’s identifiers for the payment, customer and subscription, so the purchase can be fulfilled, refunded and supported.
• A Fix Pack is generated from a scan of your site and kept at an unlisted link for twelve months. Monitoring re-scans your domain and runs the Citation Check on ten questions weekly until you cancel; both are kept like any other scan.

When you book a call

Booking runs through Cal.com, which asks for your name, email and website address under its own privacy policy. I receive what you enter there.

Cookies

• ns_reports keeps the keys of the reports you opened in this browser, so they stay open when you come back. It lasts one year and holds nothing but those keys.
• After you enter an address, a ten-minute cookie remembers only whether the report email went out, so a reload can still say so. It never holds the address.
• The owner’s sign-in cookie exists only in Behnood Neshat’s own browser, for the list described above.
• All of them are strictly necessary for what you asked the site to do. There is no tracking cookie.

What is not collected

• No advertising or tracking cookies and no cross-site tracking. Vercel Web Analytics counts page views without cookies and without identifying visitors.
• The sound and motion switches use your browser’s local storage: the sound switch notes only that it has been shown, so its first-visit cue does not repeat, and the motion switch keeps your choice, on or off. None of it leaves your device.
• neshat.ai does not use anything you scan or send to train a model.

Who processes the data

• Vercel hosts the site and runs the scan (United States).
• Neon stores scans and form submissions (United States).
• Vercel AI Gateway routes Citation Check questions to OpenAI, Google, Perplexity and xAI (Grok), each under its own API terms.
• Resend delivers email and records clicks on links in it.
• Stripe processes payments (United States).
• Cal.com handles bookings.

Everything this site stores is processed and kept in the United States.

How long it is kept

Three things are deleted automatically: the records of what happened on a report (viewed, opened, a checkout button pressed) and the records of links clicked in emails, each after twelve months, and the owner’s expired sign-in links and sessions. Everything else (scans and Citation Checks, email addresses and what is stored with them, Behnood Neshat’s notes about them, form submissions, purchase records, Fix Packs and Monitoring records) is kept until you ask for it to be deleted, so report links keep working; deletion is done by hand.

Your choices

To see what is stored about you, to correct it, or to have it deleted (a scan, a report link, an email address and everything stored with it, a form submission), write to the contact form with the link or the email address you used. It is done by hand, usually within a few business days, and confirmed by reply.

To stop NeshatScan from scanning a site you control, see how the crawler behaves.

Changes

If this policy changes in a way that matters, the date at the top of this page changes with it and the summary of what changed appears here.

1 October 2026: links in emails from neshat.ai now go through Resend’s click tracking, and this site keeps which link was clicked, in which email and when (see above). “Email me this report” now starts the follow-up emails only when its own box is ticked.