Privacy Policy

Who is responsible

The controller of your personal data is [legal name], CUIT [tax ID], [address], Argentina, who runs typesearch (“we”, “us”). For anything about privacy, write to privacy@typesearch.ai.

When a customer sends us queries that include personal data about its own users, we process that data on the customer’s behalf and following its instructions; the customer is the controller. Enterprise customers can sign a data processing agreement (DPA) with us.

What we collect

• Account. Your name and email. If you sign in with Google or GitHub, the name, email and profile picture they share with us. Sign-in codes are sent by email and expire after 10 minutes.
• How you found us. When you create an account: the campaign parameters of the link you signed up from (such as utm_source or utm_campaign), the website that referred you, the pages of our website where your visit started and where you clicked to sign up, your approximate country, from your IP address at sign-up, and, if you arrived by clicking one of our ads, the click identifier Google Ads adds to the link (gclid, gbraid or wbraid). It travels with your sign-in code, not in a cookie. We look at it in aggregate, to learn which channels work, and we tell Google Ads which ad clicks led to an account or to a first top-up (the click identifier, the time and, for a top-up, its amount; never your name or email), to measure our campaigns.
• Organization and team. Your organization’s name, the names, emails and roles of its members, and pending invitations.
• API keys. A hash of each key — never the key itself — plus its name, its last four characters, when it was created and last used, and its spend limit.
• Request logs. For each API request: the time, the key, the endpoint, the status, how long it took and what it cost, plus the queries and parameters you sent. The queries and parameters are deleted after 7 days; the rest of the record after 35, to apply spending limits and answer billing questions. You can review them in the dashboard, and they help us fix problems.
• Aggregated usage. Requests and spend per day, key and endpoint, without the content of your queries. Kept while your account exists, for billing and for your usage charts.
• Support messages. What you write to us through the Support page or by email, and our replies.
• Publisher requests. If you send us a request about a site, through our page for publishers or by email: your name, email, organization and role, and the request itself. With the form, also a keyed hash of your IP address and your browser’s user agent, to prevent abuse.
• Billing. Paddle collects your payment and billing details (card, billing address and tax ID if you give one). It shares with us what we need to manage your credit: the amount, date, currency and country of each transaction, your card brand and last four digits, and refunds. We never see or store card numbers.
• Website visits. Page views, referrers, countries, browsers and device types, in aggregate, through Vercel Web Analytics, plus a few clicks with the page where they happened, such as a sign-up button or copying an install command. No personal data goes with them. It doesn’t use cookies and doesn’t follow you from one site to another.
• Technical logs. Like any server, ours and our hosting providers’ record technical data such as IP address, browser and requested URL, to keep the Service secure and fix errors. These logs are kept for a short time.

Why we use it

• To provide the Service (account, keys, requests, credit, support and service emails): because it’s necessary to perform our contract with you.
• To keep it secure and working (preventing abuse and fraud, fixing errors, measuring quality and capacity): our legitimate interest in running a reliable service. Aggregated analytics and measuring our ads rely on it too.
• To meet legal obligations (tax and accounting records, requests from authorities): because the law requires it.
• To send you product news: only if you ask for it. Every such email has a one-click unsubscribe link.

We don’t sell personal data, we don’t use it for advertising, and we don’t build profiles about you.

Queries and the language model

To judge how relevant each result is to your query, we send the query and the candidate articles to a language model through Vercel AI Gateway, which passes them to the model provider. They process them to return the judgment to us. For this reason, avoid putting personal data in your queries unless your use case needs it.

When our index doesn’t have enough results, a language model, also through Vercel AI Gateway, uses your query to work out its topic and suggest news sites that may cover it. We then read those sites ourselves, following their robots.txt. In deep mode we may also use those sites’ own search, with a keyword about the topic, not your full query. No other search provider receives your queries.

Cookies

We only use the cookies the Service needs: one that keeps you signed in to the dashboard, and one that remembers your language. There are no advertising or cross-site tracking cookies, and our analytics work without cookies.

Paddle’s checkout and Cloudflare’s bot check may use their own strictly necessary cookies, or similar technologies, to prevent fraud, under their own privacy policies.

Who processes data for us

We use these providers to run the Service. Each receives only what it needs for its task and is bound by contract to protect it:

• Supabase: the database for accounts, teams, keys (as hashes), usage and logs.
• Vercel: hosting for the website and the dashboard, and cookieless analytics.
• DigitalOcean: hosting for the API servers that run your requests.
• Vercel AI Gateway and the language model providers it routes to: judging the relevance of results to your queries and, when our index falls short, understanding the query to suggest sources to check.
• Paddle: payments, invoices, sales tax and payment support. As Merchant of Record, Paddle is also responsible for the payment data it collects, under its own privacy policy.
• Resend: sending email, such as sign-in codes, alerts and notices.
• Cloudflare: telling people from bots on forms such as sign-in.
• Google Ads: measuring which of our ads lead to new accounts. It receives the ad’s click identifier, the time of sign-up and, if there is one, of the first top-up with its amount; never your name or email.

We may also disclose data when the law requires it, to protect the rights and safety of our users or our own, or to a company that takes over the Service, which would remain bound by this policy.

International transfers

We are based in Argentina, and our providers process data in the United States, the European Union and other countries. When data leaves your country, we rely on the safeguards the law recognizes: the European Commission considers that Argentina offers an adequate level of protection, and our providers’ data processing agreements include standard contractual clauses for transfers to countries without that recognition.

How long we keep it

• Request logs: the queries and parameters, 7 days; the rest of each record (time, key, endpoint, status, cost), 35 days.
• Queries without results: when a search finds nothing, or only through the fallback, we keep the query in normalized form, with its topic and how many times it was searched, to find sources that cover it. After 7 days it is no longer linked to your account or organization.
• Domains outside our index: when you filter a search by a domain (sources or include_domains) that isn’t in our index, we count it, with how many times it was asked for, to decide which sources to add. After 7 days it is no longer linked to your account or organization; the count, without it, up to a year.
• Aggregated usage: while your account exists.
• Account, team and keys: while your account exists. When you close it, we delete them within 30 days, backups included.
• Support messages: while your account exists or, if you don’t have one, up to two years after the last message.
• Publisher requests: the contact details (and, with the form, the hash of your IP address and the user agent), while the exclusion is in force and for two years after; requests that don’t create an exclusion (licensing, removing results about a person, others), for two years after we close them; the exclusion record (domain, date and reason), for as long as we operate.
• Billing records: as long as tax and accounting law requires; in Argentina, up to 10 years.
• Technical logs: rotated automatically, usually within a few weeks.

Your rights

Wherever you live, you can ask us to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data, except what the law requires us to keep, such as billing records;
• export it in a structured, machine-readable format (portability);
• object to processing based on our legitimate interests, or ask us to restrict it while we look into a request;
• withdraw your consent where we rely on it, such as for product news.

These rights come from the European Union’s General Data Protection Regulation (GDPR) and from Argentina’s Personal Data Protection Law 25.326, and we extend them to everyone.

How to exercise them

Write to privacy@typesearch.ai from the email on your account, or tell us which account it’s about. We may ask you to confirm your identity. It’s free.

We answer within the time the law sets: 10 calendar days for access requests and 5 business days for corrections and deletions under Law 25.326, and in any case within one month.

You can do much of this yourself in the dashboard: edit your profile, revoke keys, remove team members and review your logs.

If you’re not satisfied with our answer, you can complain to a data protection authority: in Argentina, the Agencia de Acceso a la Información Pública (AAIP); in the European Union, the authority in your country.

As required in Argentina: the data subject may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown (Law 25.326, article 14, section 3). The AAIP, as the supervisory body of Law 25.326, has the power to handle complaints and claims from anyone whose rights are affected by a breach of the rules on personal data protection.

Security

Traffic is encrypted with TLS, keys are stored only as hashes, and access to production data is limited to the people who need it to run the Service. No system is perfectly secure: if we learn of a breach that affects your data, we’ll tell you and the authorities as the law requires.

People in the news

Our index covers articles published on public news sites, and those articles can mention people. We process that information on the basis of our legitimate interest in running a news search service and of the public’s right to information. We only return what publishers made public.

For each article, we hold its headline, the description its publisher gives it, its link and its date, for up to 12 months; relevance judgments, which may include a very short excerpt, for 8 days; and the text of the article for 2 days at most, only so we don’t fetch it twice.

If you want results about you removed, use the “Remove results about me” form or write to privacy@typesearch.ai with the links. We review each request case by case, balancing your rights against the public interest in the information, as the law requires, and we answer within the deadlines in How to exercise them.

When a publisher updates an article or takes it out of search results (with noindex), we follow the publisher’s decision.

Publisher requests

When someone sends us a request about a site, through our page for publishers or by email, we keep their contact details (name, email, organization and role) while the exclusion is in force and for two years after, to prove that we honored it.

The exclusion record itself (the domain, the date and the reason) is kept for as long as we operate, so that we keep honoring it.

Children

typesearch is a service for developers and businesses. It isn’t directed at children, and you must be 18 or older to create an account. If you believe a child has given us personal data, write to us and we’ll delete it.

Changes to this policy

We’ll update this page when our practices change, along with the date at the top. If a change significantly affects how we use your data, we’ll email the owners of each organization before it takes effect.

Contact

[legal name] · CUIT [tax ID] · [address], Argentina. Privacy: privacy@typesearch.ai.