Privacy policy

Who we are

Tailwin is operated by Girard Media (“we”, “us”). For anything in this policy, write to sgirard@girardmedia.com.

We act in two roles. For visitors to tailwin.com and for our customers, we are the data controller. For measurement tools our customers install on their own websites (the crawler tracker, the visitor pixel, the scan widget, the concierge widget), we process data on the customer’s behalf and the customer is the controller. If you visited a site that uses Tailwin and want your data handled, contact that site’s owner first; we assist them with every request.

What we collect from customers and visitors

• Account data. Name, email, and password hash, or your Google account identifier if you sign in with Google. Session cookies keep you signed in.
• Billing data. Payments run through Stripe. We store your plan, subscription status, and Stripe customer reference. We never see or store card numbers.
• Free scan leads. If you run the free AI visibility scan, we store the domain you scanned and the scan result. If you ask for the emailed report, we store the email you provide, and any name, company, phone, or role you choose to add.
• Support and correspondence. Emails you send us.

What our tools collect on customer sites

• Crawler tracker. Records visits by known AI crawlers only: user agent, path without query strings, response status, and country. No cookies, no request bodies, no personal data.
• Visitor pixel. Records human page views: path, title, referrer, and campaign tags. It sets one first-party cookie holding a pseudonymous visitor id, which we store only as a peppered hash. Raw IP addresses are never stored: the address is held briefly in a resolution queue, used to look up the visiting company, then cleared; what remains is a peppered hash. Company lookup uses the providers listed below. Person-level contact details (a name, work email, or title associated with the visiting company) are collected only when the site owner has explicitly enabled that feature, and are stored separately so they can be deleted wholesale on request without destroying visit statistics.
• Scan widget and concierge widget. Collect what a visitor types into them, including an email address if offered. Concierge conversations pass through automatic redaction that strips secrets before storage.

Chrome extension

The extension helps you inspect registered websites and review SEO improvements. Linking a workspace, auditing a page, inserting a prompt into another chat service, and chatting with Tailwin are separate actions with different data flows.

• Link and preferences. The extension sends your scoped access token to Tailwin to authenticate requests and receive your workspace brand, active sites, and permitted settings. The token is kept in local extension storage restricted to trusted extension contexts, not Chrome sync or web-page scripts. Tailwin stores its verification hash and access metadata. Shared chat preferences are saved for your user and workspace. Unlinking clears the local credential; revocation or expiry prevents further authorized requests.
• Public-page audits. When you request an audit, the extension sends the selected registered page URL to Tailwin. Tailwin fetches the public page and retains derived findings. This is an explicit page request, not collection of your browsing history in the background.
• Rendered-page uploads. This separate option captures a sanitized copy of the selected page, including visible text, after you choose capture and confirm the reviewed upload. Forms, editable and hidden content, frames, and executable scripts are excluded. Visible text may still contain private information. Tailwin sanitizes the submission again and retains derived findings labelled as imported browser evidence, rather than the raw submitted HTML. Supported AI chat hosts are excluded from page capture.
• Prompts for another chat service. Optional host access lets the toolbar locate a supported composer. It does not read or back up the host conversation or your existing draft. Reviewed website evidence goes into a prepared prompt. Choosing Insert places it in the host page, where that service can process it under its own terms; Copy places it on your clipboard. Tailwin does not press Send. This path uses the host subscription for generation, though separately approved fresh evidence may incur vendor costs or quota usage.
• Tailwin Chat. Text you type or paste into Tailwin’s own panel, conversation context, and selected tool evidence are sent to Tailwin and the selected configured AI provider or gateway after you review and confirm a model turn. This uses the workspace’s AI allowance. Chat history stays in panel memory and is cleared when you close the panel, choose New chat, or unlink. It is not saved as a Tailwin conversation record. This does not promise that the chosen provider retains no data; its processing terms also apply.
• Recovery and accounting. Trusted session storage can retain token, session, and operation identifiers, but no conversation text or bearer copy. Tailwin keeps operation and receipt metadata, request fingerprints, reviewed tool arguments, and temporary tool-evidence summaries. These support approval, usage accounting, and duplicate-charge prevention. A lost answer cannot be recovered from the server or regenerated automatically.
• Competitor research. After explicit approval, Tailwin fetches the supplied public competitor page and its robots policy, and sends that page URL, market, and language to DataForSEO for page-level keyword estimates. Extracted source text is kept privately for the analysis workflow; the extension receives a bounded evidence summary rather than that source text.
• PageSpeed. An approved speed request sends the public URL and selected device strategy to Google PageSpeed Insights. Tailwin retains the result and receipt, distinguishing laboratory measurements, available field data, and unavailable values. A rendered upload does not make a private page available to Google.
• Toolbar diagnostics. Adapter failure reports contain the supported host name, adapter version, and failure category. The application aggregates those reports without a token, user identifier, conversation, draft, page path, or cookies. Network and hosting services still process requests; this is not a claim that production network logs contain no identifying information.
• Partner logos. Displaying a workspace logo can make an image request to its configured HTTPS host. The request does not send your Tailwin bearer token or a referrer. That image host still receives ordinary network information, such as the requesting IP address.

Closing the panel or choosing New chat does not delete saved preferences, audit findings, or accounting records. Model quotes are valid for five minutes and tool approvals for ten minutes; temporary chat tool summaries become unavailable after one hour. Expired approvals and summaries are cleaned up during subsequent chat activity, so expiry is not an immediate deletion guarantee. Completed operation identities remain through the issuing token’s expiry; pending or uncertain work retains its reconciliation record. Financial records are separate.

PageSpeed results can be reused for 12 hours without deleting their retained audit history afterward. Competitor analyses become unavailable after 12 hours; expired extracted source text is removed during a subsequent analysis in that workspace. Analysis metadata and charge receipts remain for review. Adapter diagnostic aggregates have a two-day application retention window. These application rules do not describe independent provider retention or infrastructure backup policies.

AI processing

The product’s core function is asking AI engines questions about brands and measuring the answers. Scan queries contain the scanned domain, brand names, and buyer-style questions. They do not contain your account data, your billing data, or your site visitors’ data. Queries are processed by the engine vendors listed below, in some configurations through the OpenRouter gateway. Content drafting features send only the material you ask us to work on.

Service providers

We use these providers to run the service. Each receives only what its function requires: Stripe (payments), Resend (email delivery), Cloudflare (DNS, TLS, content delivery, object storage), Hostinger (server hosting; the databases run on servers we operate ourselves), OpenAI, Anthropic, Google, Perplexity, and xAI (AI engines, directly or via OpenRouter), DataForSEO (search result data). When a site owner enables visitor identification: Happierleads, Snitcher, or Opensend, which receive the visitor’s IP address solely to resolve the visiting company.

Anonymized benchmarks (opt-in)

Workspaces can opt in to contribute measurements to anonymized, aggregated industry benchmarks, such as the median AI-visibility score for an industry. The setting is off by default and controlled by workspace owners and admins in Settings. Aggregates never include names, domains, content, or anything that identifies a business, and are only computed across groups large enough that no contributor can be singled out. Opting out stops future inclusion immediately.

Retention

Measurement history (visibility scores, crawler visits, search positions) is the product, and customers rely on it staying available, so we retain it for the life of the account and delete it when the account is deleted. Free scan leads are retained until you ask us to remove them. Raw visitor IPs are cleared within about a minute of collection, as described above.

Your rights

Depending on where you live (including under GDPR and CCPA), you can ask for access to your data, correction, deletion, a portable copy, or restriction of processing. Email sgirard@girardmedia.com and we will respond within 30 days. We do not sell personal information. If your data reached us through a customer’s website, we will route your request to that customer and help them fulfil it.

Cookies

The full list of cookies and trackers, on tailwin.com and in the embeddable tools, lives in the cookie and tracking notice.

Changes

When this policy changes materially we update the date above and, for account holders, say so by email. Questions and complaints: sgirard@girardmedia.com.