How I handle your data.

Who is responsible

Lukáš Rataj, a sole trader operating as L9 Studios, business ID 29687403, V zahradní čtvrti 223/22, 142 00 Prague 4, Czech Republic. I am not registered for VAT. Contact: info@l9studios.ai.

This English notice covers the GEO website and services. It translates the GEO information in the company privacy policy, dated 1 October 2026, with the market field used on the English form.

The quick test

You provide a company name, service, location, customer market, email address and optionally a website. The service, location and market form one customer question. I send it through the APIs of OpenAI, Google and Anthropic, with web search enabled, the current date and approximate location where applicable. Your company name, website and email are not part of that customer question.

An analysis model from Google, or OpenAI if the first model is unavailable, receives the answers and your company name and website. It identifies your company and the other businesses named. These companies act as processors and may retain inputs for a limited period under their paid API terms, as described under paid measurements below.

I save the form details, question, summary result for each service and names of the businesses mentioned in Google Sheets, and send them to my Google Workspace inbox at info@l9studios.ai. The complete answers appear in your browser and are not saved in the lead spreadsheet. The section on other business names below also applies to this test.

For medical practices and providers of care funded by health insurance, I do not run this comparison and save only the form details. The form does not automatically email you. If the daily test capacity has been reached, I send the result manually by email.

If the page link contains source, campaign, variant, segment and market tags, I save those short tags with the enquiry. They describe the entry link and are not proof of your identity or consent. I do not save the full campaign URL or a visitor identifier for this purpose, and do not use advertising cookies.

The test is processed at your request before a possible order, under GDPR Article 6(1)(b). Your permission for me to email you about the result is consent under Article 6(1)(a). You can withdraw it at info@l9studios.ai. Test and measurement enquiry details are kept for up to 12 months from your request. If it becomes an order, the contractual, measurement and accounting retention rules below also apply.

To limit abuse, Supabase stores one-way hashes of the IP address, email, email domain, website and company name, with the request time. These are needed for up to 24 hours. Older records are removed periodically, usually within a few days. The basis is the legitimate interest in operating and protecting the test, under Article 6(1)(f).

Business and agency enquiries

You provide a company or agency name, email address, company or client website, service, country and any region you specify. I save these details in the same Google Sheet and info@l9studios.ai inbox to reply and prepare the scope of work. This form does not run a measurement or send the brief to language models. Each request has its own ID and receipt time to match the spreadsheet and email records.

Asking for a reply is separate from the optional choice to receive Geotify tips and updates by email. Updates are unchecked by default and recorded separately. When selected, I keep the wording and version of that choice with the request time. A test, enquiry or campaign tag does not grant that permission. You can withdraw it at info@l9studios.ai.

The GEOs advisor

GEOs is an automated advisor, not a person. OpenAI receives your question and the preceding messages from the same conversation as a processor, to produce an answer. The basis is the legitimate interest in answering a question you choose to ask, under Article 6(1)(f). Processing can take place in the United States, using the EU-US Data Privacy Framework or standard contractual clauses.

L9 does not store the conversation content; it records the number of tokens used. Under its API terms, OpenAI may temporarily retain inputs for abuse prevention and does not use these business API inputs for model training by default.

For abuse protection and request limits, Supabase stores a one-way hash of the IP address and the request time. The hash is needed for up to 24 hours. Older records are removed periodically, usually within a few days. The basis is the legitimate interest in operating and protecting the advisor, under Article 6(1)(f). Do not enter sensitive personal data or other people’s private information.

Paid measurements

I prepare questions customers might ask about your industry and location, plus questions directly about your business. Those brand questions include its name and website. For sole traders, the business name may contain their personal name. I compare the contact details you provide with the answers locally; I do not send those supplied contact details to the measured services.

I send the current date with each question and, where applicable for a local business, an approximate city and region for the person searching. In the internal tool, I also send the text of your homepage to a language model to suggest competitors to track. It may include contact details you publish on the website. I search public business directories, such as Firmy.cz or Zlaté stránky where relevant to the market, to check the business listing.

Questions are sent through the APIs of ChatGPT (OpenAI), Gemini (Google) and Claude (Anthropic). Measurements carried out on or before 30 September 2026 also used Perplexity AI, Inc. A language model analyses the responses to identify which businesses they name and how. These providers act as processors. Under their paid API terms, they do not normally use inputs for model training and may retain them for a limited period, particularly for abuse prevention and the operation of web search.

For an agreed Google extension, I use the Apify platform to submit customer questions, short service-and-location queries and your exact company name, on its own or with “reviews”. I check AI Mode, AI Overviews and ordinary search results. I do not send the brand questions from the main measurement, such as questions about your contact details, to Google Search. For a Czech-market Seznam extension, I ask the customer questions manually through my account. Google and Seznam.cz, a.s. process those queries as operators of their own services under their terms.

The basis is performance of the contract, under Article 6(1)(b). Do not supply your customers’ personal information as measurement input. I review custom questions manually before the measurement and remove personal information from them. If work on a changes package or subscription involves personal data controlled by you, such as customer reviews, we enter a separate processing agreement under GDPR Article 28.

What I keep and for how long

I keep the questions, service answers and analysis, screenshots from manual checks, report and CSV data on the work computer. When the internal tool is used, questions, answers and reports are also stored in Supabase. Some older measurements also have reports and answers in a private GitHub repository. These records support corrections, comparable repeat measurements and evidence of what was delivered. Apify retains the results of its runs for a limited period under its own terms.

Measurement records are kept for up to 12 months after report delivery, or for the duration of a subscription and 12 months after it ends. They are then deleted. Deletion is currently handled manually.

Client personal data is kept for the duration of the contractual relationship and three years after it ends, in case of contractual claims. Accounting documents and billing details are kept for 10 years under the accounting requirements described in the company policy. The basis for accounting records is a legal obligation, under Article 6(1)(c).

Names of other businesses in the report

Service answers often name other businesses in your industry and location, including sole traders whose personal name is part of their business name. I take those names as returned by the services and include them so you can see whom the answers name instead of you. They are not independently verified.

For some measurements, I prepare a list of competitors in advance. A language model suggests them from your website, and I may add public search results or information you supply. The list helps identify competitors in answers and is also supplied to the model preparing questions and proposed changes. I do not insert competitor names into the customer questions, except for up to three competitors you name for separate comparison questions. I do not ask those comparison questions for medical practices or providers of care funded by health insurance.

The basis is L9’s and the client’s legitimate interest in understanding how these services describe the market, under Article 6(1)(f). These are the names under which the people publicly trade. I do not inform each person individually because this would involve disproportionate effort, under Article 14(5)(b). This notice provides that information publicly.

I do not use other businesses’ details to contact them. I share them with the client receiving the report and the processors described below. The client receives a file and, for some orders, a report page on the L9 domain that search engines do not index. Under the service terms, the client may use the report only for their own purposes.

If you trade under a name that appears in a client report, you can object at info@l9studios.ai. I will assess the objection and remove the information from the stored report unless there are overriding compelling legitimate grounds to retain it.

ChatGPT ad management

If I manage ChatGPT advertising for you, the ad account is held in your business’s name with OpenAI Ireland Ltd. OpenAI is a separate controller for the account, payment details and ad impression data under its Advertising Terms and privacy policy. I access the account as your authorised ad manager and can see campaign information and aggregate statistics. Under its rules, OpenAI does not give advertisers the content of ChatGPT conversations or users’ personal information. I use account data to perform the contract, under Article 6(1)(b).

If OpenAI measurement code is installed on your website, you operate it and it should run only after the visitor’s consent. I can help with the wording of the cookie information.

Email, WhatsApp and this website

When you contact me by email or WhatsApp, I process your contact details and message to handle the enquiry, under Article 6(1)(b), while it is being handled and for up to three years from the last communication. WhatsApp is operated by Meta Platforms Ireland Ltd. A contact link opens your own app; you send the message yourself.

The GEO page does not set cookies. Contact clicks are counted without cookies or IP addresses, as daily totals by channel, page position and campaign code. A short campaign code may be added to a prepared contact message; you can remove it. The WhatsApp message passes through the redirect server but is not stored there. Hosting providers keep normal technical logs. Your browser remembers your animation preference and, until the tab is closed, whether the advisor introduction was shown.

Providers and international transfers

The GEO processing uses the following providers as relevant to the service: Vercel Inc. for hosting; Supabase Inc. for database storage; Google Cloud Platform and Google Workspace for infrastructure, Sheets and email; OpenAI Ireland Ltd. and OpenAI, L.L.C. for ChatGPT, answer analysis and the advisor; Google Ireland Ltd. and Google LLC for Gemini, answer analysis and, in the internal tool, PageSpeed Insights and search suggestions; Anthropic PBC for Claude; and Perplexity AI, Inc. only for the older measurements described above.

Apify Technologies s.r.o. provides the platform and the tools run on it for extended Google checks. GitHub, Inc. stores a private code and measurement settings repository, including some older reports and answers. Meta Platforms Ireland Ltd. operates WhatsApp. Resend Inc. sends transactional emails. Functional Software, Inc. (Sentry) provides application error monitoring. The company privacy policy lists providers for L9’s other services as well.

Personal data is not sold or passed to third parties for commercial purposes. Transfers to the United States rely on the EU-US Data Privacy Framework for certified providers, or otherwise the European Commission’s standard contractual clauses under Article 46(2)(c).

Your rights and data security

You can request confirmation of whether I process your data and a copy, correction of inaccurate or incomplete data, deletion subject to GDPR conditions, restriction of processing, or portability in a structured, machine-readable format where applicable. You can withdraw consent and object to processing based on legitimate interests. Write to info@l9studios.ai.

You can also complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, or the competent supervisory authority.

The company policy describes the security measures: encrypted HTTPS/TLS communication, access to personal data limited to authorised people, and regular security updates and patches.