Effective version: 2026-09-29-beta-3
This policy describes information processed by DiscoverGraph during the public beta. The operator is the DiscoverGraph operator.
Information you provide
- account email address and password hash when you register;
- invite-beta access metadata such as a hashed invitation token, optional invite email restriction, expiry/usage state and the account that consumed an invite;
- public URLs submitted for scans and competitive audits;
- report feedback and optional comments;
- product-workspace action status and optional notes you choose to save;
- if you voluntarily enroll a registered product in the Calibration Program: product-specific consent records, optional owner-confirmed product facts, and calibration-run metadata/results;
- contact-form email, category, subject and message.
Operational information
- scan status, timestamps, quota/attempt accounting and worker telemetry;
- for anonymous quota enforcement, an HMAC-derived actor key based on the connection IP address; the raw IP is not stored in the daily quota table;
- fetched public-page metadata, findings and report evidence;
- session cookies needed for login, CSRF protection and recent anonymous scans.
Invite-beta access
During a controlled invite beta, DiscoverGraph can use hashed invitation tokens and basic invitation metadata to limit registration to approved testers, prevent link reuse beyond the configured allowance and understand cohort size. Full invite codes are not stored in plaintext after creation.
How information is used
We use this information to provide reports, operate quotas and abuse controls, authenticate users, troubleshoot reliability, compare rescans, respond to support/security/privacy messages, and improve beta calibration. Registered recurring calibration is opt-in and product-specific. Registered scan evidence is not enrolled into recurring calibration merely because you have an account. Anonymous scan evidence/results may be retained and used for scanner testing/improvement after the pre-submit notice, but an anonymous scan does not authorize future recurring scans.
Calibration Program and improvement use
For registered users, recurring calibration requires an explicit product-level opt-in confirming authority for recurring bounded public scans. You can withdraw that consent from the Product Workspace. Optional owner-confirmed facts may be used as ground-truth signals to evaluate scanner accuracy. For anonymous users, only evidence/results from the scan they submitted may be used for calibration under the visible anonymous-scan notice; the target is not automatically enrolled for recurring scanning. See Calibration Program & Improvement Consent.
External services
When PageSpeed enrichment is configured, the submitted public URL can be sent to Google PageSpeed Insights. When optional AI Marketing Analysis is requested and configured, DiscoverGraph sends a compact sanitized evidence package to the configured OpenAI service; the design does not intentionally send raw fetched HTML to that AI analysis. External providers process data under their own terms and privacy practices.
Retention
Beta scan/report, account, feedback and contact records are retained as needed to operate, troubleshoot and improve the service. Retention periods may change during beta. Registered non-admin users can use the self-service Account page to delete their live account, owned application data, calibration participation records and linked live calibration runs. You can also contact us for privacy requests. Operational backups, if configured by the host/operator, may age out according to the deployment backup process rather than being edited in place.
Security
Passwords are stored as password hashes. We use server-side sessions, CSRF protection, bounded crawling and access controls, but no online service can promise absolute security.
Your choices and requests
You can choose not to request optional AI analysis. Registered calibration participation is optional and can be withdrawn per product at any time. Registered users can delete their live account and owned DiscoverGraph data from the Account page. You can request access, correction or other deletion help where applicable by using the privacy contact form. We may need to verify the request.
Changes
This policy can change as the beta evolves. The legal version shown above identifies the text accepted by new accounts at registration.