Plain English summary: We only collect the information we need to provide our services, deliver your AI Visibility Reports, and run our business. We don't sell your data. We use trusted third parties (like Stripe for payments) who meet UK GDPR standards. You have legal rights over your data and can contact us at any time to exercise them.
1. Who we are
AEO-REX Ltd ("we", "us", "our", "AEO-REX") is a limited company registered in England and Wales.
- Registered company number: 17018571
- Registered address: Flat 4, Thames Tower, Cromwell Street, Birmingham B7 5BH, United Kingdom
- Data protection contact: Shanaz Begum
- Contact email: shanazbegum@aeo-rex.com
- ICO registration: Registered with the UK Information Commissioner's Office, registration reference ZC099609
We are the "data controller" for the personal information you share with us through our website, tools, and services.
2. What this policy covers
This policy explains how we collect, use, store, and protect your personal information when you:
- Visit aeo-rex.com, tools.aeo-rex.com, or agentrex.aeo-rex.com
- Use our free AI visibility scanner or dashboard modules
- Request or purchase an AI Visibility Report, Done For You AEO, or Monthly Watchdog service
- Contact us by email, phone, or through our contact forms
- Subscribe to any future email communications
3. What information we collect
3.1 Information you give us directly
| When | What we collect |
|---|---|
| Free AI Visibility Check | Four fields only: your website URL, your industry, your city or region, and your email address. We do not ask for your name, phone number, revenue or anything else. |
| Free AI Visibility Check — consent record | Alongside those four fields we store your marketing choice (whether you ticked the optional opt-in), the version of the consent wording shown to you, the page you submitted from, and the time of submission. We store this whether you opt in or not, so that a decision to decline is recorded as clearly as a decision to accept. We do not store your IP address or browser user agent with this record. |
| Purchasing a service | Billing name, business name, billing address, email, and payment details (processed by Stripe, see section 6) |
| Contacting us | Any information you include in your message, including name, email, and message content |
| Using our dashboard tools | Business names, website URLs, competitor URLs, and search queries you enter |
3.2 Information we collect automatically
Our hosting provider keeps standard server logs, which include IP addresses, for security and diagnostics. That is ordinary infrastructure logging and happens on every website.
Beyond that, we collect analytics — pages viewed, device and browser type, approximate location, how you arrived — only if you accept analytics cookies. If you reject them, or simply ignore the banner, no analytics script loads at all and none of that is collected. See section 9.
3.3 Information from third parties
To deliver AI Visibility Reports, we collect publicly available information about your business from sources including AI platforms (ChatGPT, Perplexity, Claude, Google AI Overviews, Microsoft Copilot), Google Search, directory listings, Wikidata, Crunchbase, Reddit, Trustpilot, and Google Business Profile. We do not access anything behind authentication without your explicit consent.
If you connect third-party accounts (Google Search Console, Google Analytics, Google Ads, YouTube) to our dashboard, we access only the data you authorise. We do not store credentials; these connections use OAuth via the providers' own authentication systems.
4. How we use your information (and our legal basis)
Under UK GDPR we must have a lawful basis for processing your data. Here is what we do and why:
| What we do | Why | Legal basis |
|---|---|---|
| Deliver your AI Visibility Report | To fulfil the service you requested or purchased | Contract / legitimate interest |
| Process payments | To take payment for our services | Contract |
| Reply to your enquiries | To answer your questions and provide support | Legitimate interest |
| Send service-related emails (report delivery, invoices, account updates) | To fulfil our contract with you | Contract |
| Improve our website and services | To make what we offer better | Legitimate interest |
| Comply with legal obligations (tax records, etc.) | Required by law | Legal obligation |
| Send marketing emails (if applicable) | To tell you about our services | Consent (you can withdraw at any time) |
5. What we don't do
- We don't sell your personal data to anyone, ever
- We don't share your business information with competitors
- We don't send unsolicited marketing emails without your consent
- We don't use your data to train AI models
- We don't publish your report content or business details without your permission
6. Who we share your data with
We only share your data with trusted service providers who help us run our business. Each is contractually required to protect your data and use it only for the purposes we specify.
| Provider | Purpose | Location |
|---|---|---|
| Anthropic (Claude) | Running the AI Visibility Check. Receives your website URL, industry and city only — never your email address. | USA |
| OpenAI | Live AI answers check, only if you confirm your email and ask for it. Receives your industry and town inside three test questions. Never your email address or business name. | USA |
| Perplexity | Live AI answers check, only if you confirm your email and ask for it. Receives your industry and town inside three test questions. Never your email address or business name. | USA |
| Google (Gemini) | Live AI answers check, only if you confirm your email and ask for it. Receives your industry and town inside three test questions. Never your email address or business name. | USA |
| Resend | Sending your report. Receives your email address and the report itself. | USA |
| MailerLite | Marketing email list. Receives your email address and a source tag, and only if you tick the optional opt-in. If you do not opt in, nothing is sent to MailerLite. | EU (Lithuania) |
| Supabase | Database holding the consent record described in section 3.1 | EU |
| Netlify | Website and form hosting | USA / global CDN |
| Stripe | Payment processing and invoicing | Ireland / USA (UK-adequate) |
| Google Analytics | Understanding website usage. Only loads if you accept analytics cookies — see section 9. | USA |
| HMRC, accountants, professional advisors | Legal, tax, and compliance obligations | UK |
If you confirm your email and ask for a live check, we send your industry and town to OpenAI, Perplexity and Google to run three test questions each. We do not send your email address or business name. These companies may process this in the United States.
This list names every processor that receives personal data from the free check. If we add one, this list changes before the processor does.
We may also disclose your information if required by law, court order, or to protect our legal rights.
7. International data transfers
Because we work with clients worldwide and use some service providers based outside the UK (for example, Stripe and some AI platforms), your data may be transferred outside the UK. When this happens, we rely on one or more of the following safeguards:
- Transfers to countries the UK government has deemed adequate (such as EU/EEA countries)
- UK International Data Transfer Agreement or Standard Contractual Clauses with the receiving party
- The UK-US Data Bridge extension for certified US providers
You can ask for a copy of the safeguards we use at any time by emailing us.
8. How long we keep your data
We would rather tell you exactly what happens than quote a schedule we do not enforce. There is no automated deletion job running on our systems. What follows is what is actually true.
| Type of data | Where it is held | How long |
|---|---|---|
| Client records and reports | Our own storage and accounting records | 7 years after the end of our business relationship, because HMRC requires it |
| Payment and transaction records | Stripe and our accounting records | 7 years, because HMRC requires it |
| Free check consent records | Our Supabase database | Kept until you ask us to delete them, or until we review and clear old records. We do not currently delete them on a fixed timetable. |
| Enquiries that don't become clients | Our email and form records | Kept until you ask us to delete them |
| Marketing email list | MailerLite | Until you unsubscribe. Unsubscribing removes you from the list; we do not need to be asked twice. |
| Website analytics | Google Analytics | Google's own retention setting, currently up to 26 months. Only collected if you accepted analytics cookies. |
Deletion on request is honoured, always. Email shanazbegum@aeo-rex.com asking us to delete your data and we will do it, and confirm when it is done. You do not need to give a reason, and it will not affect anything else. This is your right under UK GDPR and it costs you nothing to use it.
9. Cookies and tracking
Our website uses cookies and similar technologies. We use three types:
- Essential cookies: Required for the site to function (you cannot opt out of these)
- Analytics cookies: Help us understand how visitors use our site so we can improve it
- Marketing cookies: Used to measure the effectiveness of our advertising (if applicable)
You can manage your cookie preferences through the cookie banner on our website or by adjusting your browser settings. Blocking essential cookies may prevent parts of the site from working.
10. Your legal rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right to be informed: this policy explains what we do with your data
- Right of access: request a copy of the personal data we hold about you
- Right to rectification: ask us to correct inaccurate or incomplete data
- Right to erasure: ask us to delete your data (subject to our legal obligations to retain records)
- Right to restrict processing: ask us to pause processing while we investigate a concern
- Right to data portability: request your data in a portable format
- Right to object: object to processing based on legitimate interests or direct marketing
- Rights relating to automated decision-making: we don't make solely automated decisions that significantly affect you
- Right to withdraw consent: withdraw consent at any time for anything you previously consented to
To exercise any of these rights, email shanazbegum@aeo-rex.com. We will respond within one month.
11. How we protect your data
We use appropriate technical and organisational security measures including encrypted connections (HTTPS), secure password policies, access controls, regular backups, and reputable hosting and payment providers. No system is 100% secure, but we take your data seriously.
If we ever experience a data breach that affects your rights, we will notify the ICO within 72 hours and notify affected individuals where legally required.
12. Children's data
Our services are intended for business owners aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have collected data from a minor, please contact us and we will delete it.
13. Complaints
If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Phone: 0303 123 1113
14. Changes to this policy
We may update this policy from time to time. When we make significant changes, we will update the "last updated" date at the top and, where appropriate, notify clients by email. We recommend reviewing this page periodically.
15. Contact us
For any privacy-related questions:
- Email: shanazbegum@aeo-rex.com
- Post: Data Protection, AEO-REX Ltd, Flat 4, Thames Tower, Cromwell Street, Birmingham B7 5BH, United Kingdom
© AEO-REX Ltd 2026 · Company No. 17018571
Evolve or become extinct.
Your competitors are already asking AI to send them customers. See where you stand in two minutes.
4 of 4 November builds left.November is full. Book December now. Fix It Together: 12 seats.