Privacy Policy

Last updated: October 19, 2026

Operator and data controller

s6s.ai
Randstad 20, 1314 BB Almere
KvK: 42088310
BTW-id: NL005486095B61
Contact: [email protected]

1. Overview

s6s.ai, identified above as the data controller ("S6S", "we", "us"), provides AI Visibility monitoring, reports, and evidence-backed recommendations, with an automation layer available for developer use. S6S is currently a founder-assisted private beta. This policy describes how we collect, use, store, and protect your information when you use our website and services at s6s.ai. If we contacted you for an interview or about a pilot, section 12 applies to you.

2. Information We Collect

2.1 Account Information

When you sign in with Google, we receive your name, email address, and profile picture. When you sign in with GitHub, we receive your name, verified email address, and avatar. When you sign up with email and password, we store your name, email, and a bcrypt hash of your password, never the password itself. We also store your sign-in provider and a unique account identifier.

2.2 AI Visibility Data

When you track a brand, run a check, or create a report, we store the brand name, domain, keywords, competitors, target markets, focus areas, selected AI engines, report surfaces, tracked questions, observations, source-readiness signals, recommendations, and report/run history needed to provide the service. For a permitted measurement surface this may include the submitted buyer question, provider response text and JSON, citations, request outcome, token/cost telemetry, and scores or entities derived from that evidence.

To discover your brand and audit your site, we fetch public pages from the domain you enter. To plan tracked questions, we research public search demand for your market: questions people ask and search phrases with their volumes, which we store with the brand.

2.3 Developer Automation Data

If you use the developer automation layer, we store the automations you create, their configuration, execution logs, and run history so you can monitor, debug, and manage them.

2.4 Third-Party Credentials

When you connect external services (Google Sheets, Google Drive, Slack, Discord, Telegram, etc.), we store the OAuth tokens, API keys, or bot tokens needed to provide the connected service. These credentials are encrypted at rest using AES-256-GCM.

2.5 Assistant and AI Chat Data

When you use the Ali assistant or the AI chat builder, we store your chat sessions and messages, and a record of each request and the AI response. These records are linked to your account. We use them to show your history, to provide the service, and to improve the quality of AI Visibility recommendations and developer automation suggestions. There is currently no setting to opt out of this use; you can delete individual chat sessions, or ask us to delete your records (see section 9).

If you use voice input, the recording is sent to OpenAI for transcription.

When Ali guides you through a task on screen, we store which guides you started, skipped, finished or asked to be reminded about later, so that a guide which starts by itself for a new account does not start again, and so Ali can suggest your next guide. The guide follows your progress by reading the page you have open, and what it reads stays on your device.

2.6 Usage and Error Data

We collect basic usage telemetry such as API request counts, report/run metrics, and error logs to operate and improve the service.

We use Sentry for error and performance monitoring. Its script loads on our pages, including signed-in pages. It reports every error, with device and app details, and performance timings for a sample of page loads (about 2%) and server requests (about 10%). Session replay is off. We do not use advertising or analytics trackers.

3. Google OAuth & Google API Data

S6S.ai uses Google OAuth for two purposes: authentication (sign-in) and service integration (connecting Google services to your approved actions).

3.1 Google Sign-In Scopes

When you sign in with Google, we request the following scopes:

openid — Verify your identity
email — Receive your email address to create your account
profile — Receive your name and profile picture for your account

We do not access any other Google data during sign-in.

3.2 Google Service Integration Scopes

When you explicitly connect a Google service to use in approved actions, we request only the scopes necessary for that service. You must grant these permissions separately from sign-in:

https://www.googleapis.com/auth/spreadsheets — Read and write to Google Sheets files referenced by your approved actions
https://www.googleapis.com/auth/drive.file — Access only the specific Google Drive files your approved actions reference

S6S.ai only accesses the specific files and data your approved actions reference. We never browse, index, or scan your Google Drive or other Google data beyond what those actions explicitly require.

3.3 How We Use Google Data

Google sign-in data (name, email, picture) is used solely to create and identify your S6S account.
Google Sheets data is read/written only when an approved action explicitly targets a specific spreadsheet.
Google Drive data is accessed only when an approved action explicitly references a specific file.
We do not use Google data for advertising, profiling, or any purpose unrelated to providing the approved action.
We do not sell, rent, or share Google user data with any third party.

3.4 Google API Services User Data Policy Compliance

Limited Use Disclosure

S6S.ai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google user data to provide and improve the S6S.ai service as described in this policy.
We do not transfer Google user data to third parties except as necessary to provide the service (e.g., a connected action that writes to Google Sheets), with your explicit consent, or as required by law.
We do not use Google user data for advertising or to serve ads.
We do not allow humans to read Google user data unless: (a) you provide explicit consent, (b) it is necessary for security purposes (investigating abuse), or (c) it is required to comply with applicable law.

3.5 Revoking Google Access

You can revoke S6S.ai's access to your Google data at any time by:

Removing the Google credential connection in your S6S account settings (this deletes the stored connection)
Visiting your Google Account Permissions page and removing S6S.ai

Revoking access at Google prevents further access but may not notify S6S to remove its encrypted token record. Remove the connection in S6S as well, or contact us to request deletion.

4. How We Use Your Information

We use collected information to:

Provide and operate the S6S.ai service
Plan tracked questions, run checks, create AI Visibility reports, and store recommendations for your tracked brands
Run connected actions on your behalf using your connected credentials
Authenticate your identity and secure your account
Store chat sessions and recommendation history for your convenience
Improve recommendation and suggestion quality using stored assistant and chat records (section 2.5)
Monitor service health, fix bugs, and improve performance
Communicate important service updates

5. Cookies and Local Storage

S6S.ai uses a small number of cookies, all needed for the service to work:

Cookie	Purpose	Duration	Type
`s6s_session`	Authentication session (HTTP-only)	30 days	Essential
`s6s_csrf`	Protection against cross-site request forgery; readable by our pages so they can send it back	24 hours	Essential
`oauth_state`, `gh_oauth_state`	Protection during Google or GitHub sign-in (HTTP-only)	10 minutes	Essential
`oauth_from`, `gh_oauth_from`	Page to return to after Google or GitHub sign-in (HTTP-only)	10 minutes	Essential

In production, cookies are sent only over HTTPS and use SameSite=Lax. We do not use advertising, tracking, or analytics cookies.

Our pages also keep a few interface settings in local storage on your device, such as whether the sidebar is collapsed, your current assistant session, and whether you dismissed the assistant hint. They are not used for tracking.

6. Service Providers and Data Sharing

We do not sell or rent your personal data. We share data only with the providers that operate parts of the service, only for the purposes below, or when you direct us to:

Railway: hosting and database for everything you store in S6S.
Cloudflare: delivers and protects our website. It processes every request to s6s.ai, including your IP address, and network error reports.
OpenAI: buyer questions and market context for ChatGPT measurement; brand and site context to analyse your brand; the text of the AI answers collected in your checks, with your brand name, category, and markets, to identify the brands those answers mention; voice recordings for transcription.
Perplexity: buyer questions and market context for Perplexity measurement; during brand setup, your domain, markets, and brand details (name, category, description, products, and audience) to identify your brand and research its competitors.
Anthropic: brand details (name, domain, category, keywords, competitors, markets, focus areas, and search research) to plan your tracked questions; your brand's industry and markets, to group recommendation outcomes by industry.
Our assistant AI provider (OpenAI or Anthropic, as configured): your messages to the Ali assistant and the AI chat builder, brand discovery from your website, and the AI steps of automations you run.
DataForSEO: keywords, category, and market to research search demand; buyer questions to collect answers shown in ChatGPT and Gemini; your brand and competitor names with your market, searched in web and news results to find external mentions such as discussions, reviews, lists, and articles.
Bright Data: buyer questions and market, as a backup supplier of ChatGPT answers. It is not used while our primary supplier is available.
Apify: brand name, domain, category, products, and competitors when you run question discovery.
Google Search: your domain and brand name, searched during brand discovery.
Bing (Microsoft): your domain and brand name, searched to check whether your site is indexed and whether your brand appears on YouTube and review directories.
Wikipedia (Wikimedia Foundation): your brand and competitor names, searched to check for public reference pages.
Reddit: your brand name, category, and markets, searched to find public discussions and the questions people ask.
YouTube (Google): public search queries about your brand and category, to find external mentions.
Sentry: error and performance data (section 2.6).
Resend: internal operational emails to S6S staff, and account emails to you: a link to confirm your email address when you create an account (or ask for a new one), and a link to reset your password when you ask for it (Resend receives your email address and the message). We do not send marketing emails.
Google and GitHub: sign-in, when you choose them.
Services you connect: when a connected action calls a service such as Google Sheets, Slack, Discord, or Telegram, the data you configured is sent to that service as you directed.
AI providers you configure: if you add your own LLM API key, your chat messages are sent to that provider.
Legal requirements: we may disclose data if required by law, regulation, or legal process.

Several of these providers are based in the United States, so your data may be processed outside the European Economic Area. Before a paid launch we will publish each provider's processing region and the transfer safeguard that applies. You can ask us for the current details at any time.

7. Data Security

Third-party credentials and bot tokens are encrypted at rest using AES-256-GCM
Passwords are stored only as bcrypt hashes
API keys are hashed with SHA-256 at rest
Sessions use HTTP-only, SameSite cookies that are sent only over HTTPS in production
Data is encrypted in transit over HTTPS
Security headers enforced: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Secrets are redacted from automation execution logs and outputs
Access to production systems is restricted to authorized personnel

8. Data Retention

Account data: Retained while your account is active. Account deletion removes the account and its associated records from the active database. Report screenshots are not removed by account deletion; they expire automatically, normally within 7 days. Limited backups, provider logs, security records, or records required by law may follow the separate periods described below.
AI Visibility data: The current private beta has no plan-based expiry. Removing a tracked brand hides it from the active product but retains its associated measurement evidence and history. Account deletion or a valid statutory erasure request uses the separate deletion path described above.
Search research: Stored with the brand and reused for up to 30 days before it is refreshed; deleted with your account.
Service improvement: Records retained after a brand is removed may be used to operate and improve the service. This private-beta retention does not override account deletion, a valid statutory erasure request, or other applicable legal obligations.
Developer automation data: The current private beta has no plan-based run-history expiry. Data remains while the automation/account exists unless you delete it. Temporary files produced by automations or report captures expire automatically.
Google OAuth tokens: The stored connection is deleted when you remove it in S6S. Revoking only at Google prevents access but should be followed by removal in S6S or a deletion request.
Assistant and chat records: Retained while your account is active. You can delete individual chat sessions at any time; all remaining records are deleted with your account.
Backups, provider logs, and security records: These may follow separate limited retention periods. Exact schedules and subprocessors will be published before a paid launch.

9. Your Rights

Under the GDPR you have the right to access, correct, and delete your personal data, to restrict or object to its processing, and to receive a copy of it. In particular you can:

Request a copy of the data S6S holds about you
Request an automated export, by email or through the API: a structured subset of account, automation, and AI Visibility records, limited to recent items per category; provider raw output and security-sensitive records are excluded, as are reports, recommendations, and search research
Request account deletion or statutory erasure, by email or through the API; this removes the account and associated records, subject to the limited backup, provider-log, security, and legal retention described in section 8
Remove individual tracked brands from the active product; associated AI Visibility evidence is retained as described in section 8
Delete individual automations, chat sessions, and credentials using the available controls
Revoke third-party service connections and remove the stored connection in S6S
Object to our use of your assistant and chat records to improve the service, by contacting us

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with a data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

10. Children's Privacy

S6S.ai is a business service and is not intended for anyone under 16. We do not knowingly collect personal information from children. If we learn that we have, we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. We will update the date at the top of this page, and tell signed-in users about significant changes in the product. Continued use of S6S.ai after changes constitutes acceptance of the updated policy. See also our Terms of Service.

12. Business Contacts and Interviews

This section applies if you work at an agency or business we contacted, or met, to ask for an interview about how agencies handle client questions on AI search, or to tell you later about a paid pilot.

Who is responsible. s6s.ai, Randstad 20, 1314 BB Almere, KvK 42088310, [email protected].

What we hold. Your name, role, company, business phone number and business email address; the date and channel of each contact and what you agreed to; and, if we talk, notes of the interview. We transcribe an interview only if you agree at the start, and we keep no audio.

Where it came from. Your company's own public website, its public LinkedIn page, business directories such as Trustoo or Sortlist, the public company register (KvK), an event where we met, or a person who introduced us with your agreement. Each record notes its source.

Why, and on what basis.

To ask for and hold an interview, and to learn from it: our legitimate interest in understanding how agencies handle this work (Art. 6(1)(f) GDPR).
To tell you later about a paid pilot: only if you said that's OK.
Transcribing an interview: your consent, which you can withdraw at any time.

Who sees it. Only the founder of s6s.ai works with your details. To do that we use Gmail and Google Calendar (Google) for email and appointments, the phone or video-call service of the call itself, Granola (Granola, Inc., USA) to transcribe an interview you agree to, and Claude (Anthropic), an AI assistant, to keep the contact list and our notes in order. Granola keeps no audio; it stores the transcript and its notes on servers in the USA. Anthropic processes what it receives in the USA or elsewhere outside the EU. Both rely on the EU's standard contractual clauses. Our contact list and our own notes are kept on our own laptop. We don't sell or share your details. Interview findings are reported only without names, unless you agree otherwise in writing.

How long.

Contacted, but we didn't talk: 12 months after the last contact.
Interviewed: your contact details and our notes, 24 months after our last contact, checked every year.
Transcripts: deleted at the latest 3 months after the interview (Granola deletes its copy automatically). No audio is kept.
Notes with your name removed: 36 months, or 12 months after this research ends, whichever comes first.
Findings that can't be linked to you or your company: kept.
Proof that you agreed to hear about a pilot: 5 years after the last message based on it.

If you ask us to stop, we delete your details, keeping only what we need to make sure we don't contact you again (that list is checked every 2 years).

Your right to object. You can object at any time to our use of your details, including for direct marketing. Say "stop" on the phone or reply "stop" to any email, and we stop.

Your other rights. Access, correction, deletion, restriction and data portability, via [email protected]. You can also complain to the Autoriteit Persoonsgegevens.

Nederlandse tekst: zakelijke contacten en interviews

Dit deel geldt als je werkt bij een bureau of bedrijf dat wij hebben benaderd of ontmoet om een interview te vragen over hoe bureaus omgaan met klantvragen over AI-zoeken, of om je later te vertellen over een betaalde pilot.

Wie is verantwoordelijk. s6s.ai, Randstad 20, 1314 BB Almere, KvK 42088310, [email protected].

Wat we bewaren. Je naam, functie, bedrijf, zakelijk telefoonnummer en zakelijk e-mailadres; de datum en het kanaal van elk contact en waarmee je hebt ingestemd; en, als we praten, aantekeningen van het interview. We schrijven een interview alleen uit als je daar aan het begin mee instemt, en we bewaren geen geluid.

Waar het vandaan komt. De openbare website van je bedrijf, de openbare LinkedIn-pagina van je bedrijf, bedrijvengidsen zoals Trustoo of Sortlist, het openbare handelsregister (KvK), een evenement waar we elkaar ontmoetten, of iemand die ons met jouw instemming in contact bracht. Bij elk gegeven staat de bron.

Waarom, en op welke grondslag.

Om een interview te vragen en te houden, en ervan te leren: ons gerechtvaardigd belang om te begrijpen hoe bureaus dit werk aanpakken (art. 6 lid 1 sub f AVG).
Om je later te vertellen over een betaalde pilot: alleen als je zei dat dat goed is.
Een interview uitschrijven: jouw toestemming, die je altijd kunt intrekken.

Wie het ziet. Alleen de oprichter van s6s.ai werkt met je gegevens. Daarvoor gebruiken we Gmail en Google Agenda (Google) voor e-mail en afspraken, de telefoon- of videodienst waarmee we bellen, Granola (Granola, Inc., VS) om een interview uit te schrijven als je daarmee instemt, en Claude (Anthropic), een AI-assistent, om de lijst met contacten en onze aantekeningen bij te houden. Granola bewaart geen geluid; de uitgeschreven tekst en de aantekeningen staan op servers in de VS. Anthropic verwerkt wat het ontvangt in de VS of elders buiten de EU. Voor beide gelden de standaardcontractbepalingen van de EU. De lijst met contacten en onze eigen aantekeningen staan op onze eigen laptop. We verkopen of delen je gegevens niet. Uitkomsten van interviews rapporteren we alleen zonder namen, tenzij je schriftelijk anders afspreekt.

Hoe lang.

Benaderd, maar niet gesproken: 12 maanden na het laatste contact.
Geïnterviewd: je contactgegevens en onze aantekeningen, 24 maanden na ons laatste contact; elk jaar bekeken.
Uitgeschreven tekst: uiterlijk 3 maanden na het interview verwijderd (Granola verwijdert zijn kopie automatisch). Geluid bewaren we niet.
Aantekeningen zonder je naam: 36 maanden, of 12 maanden na het einde van dit onderzoek als dat eerder is.
Uitkomsten die niet naar jou of je bedrijf te herleiden zijn: die bewaren we.
Bewijs dat je wilde horen over een pilot: 5 jaar na het laatste bericht op basis daarvan.

Vraag je ons te stoppen, dan verwijderen we je gegevens, op wat we nodig hebben om je niet opnieuw te benaderen na (die lijst bekijken we elke 2 jaar).

Je recht van bezwaar. Je kunt altijd bezwaar maken tegen ons gebruik van je gegevens, ook voor direct marketing. Zeg "stop" aan de telefoon of antwoord "stop" op een e-mail, en we stoppen.

Je andere rechten. Inzage, correctie, verwijdering, beperking en overdraagbaarheid, via [email protected]. Je kunt ook een klacht indienen bij de Autoriteit Persoonsgegevens.

13. Contact

If you have questions about this privacy policy, your data, or how we handle Google user data, contact us at:

Email: [email protected]