How We Handle Your Data

This notice explains what data we collect during an audit engagement, who processes it, where it is stored, and how long we keep it. It supplements our Privacy Policy and the Data Processing Agreement we sign with every client.

What we collect during an engagement

Kick-off questionnaire: your services, brand names, competitor names, and details of key personnel (names, roles, credentials, LinkedIn URLs) that you choose to share.

Website data: a crawl of your publicly accessible website content and technical configuration.

Google Search Console and Bing Webmaster Tools: read-only access you grant us, used to analyse search queries and page performance. We never modify your properties, and access is revoked when the engagement ends.

Analytics data: only where you grant access, and only what is needed for the audit.

Public visibility signals: we look up how your brand appears across search engines, maps and business listings, review sites, knowledge graphs and company registries, and community sites. These providers receive limited data such as your brand name, domain and public URLs.

Competitor benchmarking: we also review publicly available competitor pages.

Anonymised research data

With your instruction under our agreement, we anonymise engagement data so it no longer identifies you or any individual, and use it to improve our methodology and benchmarks. See your Data Processing Agreement for details.

Who is responsible

You remain the data controller of all data you provide or grant access to. AireStream Ltd acts as your data processor, under a signed Data Processing Agreement. We are ICO-registered (registration ZC103113). For our own records (contracts, invoices, contact details) we act as an independent controller under our Privacy Policy.

Who touches your data (sub-processors)

We use a small set of vetted providers. Every AI provider below is used under commercial terms (API or business plans) that prohibit training on your data.

DataForSEO, Ahrefs and Trustpilot receive only limited identifiers such as your brand name, domain and public URLs.

Where a provider is located outside the UK or EEA, we rely on an appropriate UK transfer safeguard: UK adequacy for EEA providers, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum (IDTA) / Standard Contractual Clauses (for example, Ahrefs in Singapore). Copies of the relevant safeguards are available on request.

We give clients at least 30 days' written notice before adding or replacing a sub-processor.

Within AireStream

Only AireStream's directors access client data on a need-to-know basis. We never enter your personal data or confidential information into consumer AI tools. Our internal AI Usage Policy restricts client data to the commercial AI services listed above.

How long we keep it

You can request earlier deletion of engagement data at any time, subject to legal retention requirements.