Privacy Policy

1. Who we are

Airglow is a product of Miscreants (“we”, “us”). Airglow is analytics for the traffic you can't see: it helps businesses understand the AI agents and automated browsers that visit their websites, and the visits those agents lead to.

We handle two kinds of data, in two different roles:

• Our customers' account data. When you sign up for Airglow, we decide how your account data is used. For this data we are the controller.
• Data about visitors to our customers' websites. When a customer adds Airglow to their website, we process data about that site's visits on the customer's behalf and on their instructions. For this data we are a processor, and the website owner is the controller.

If you visited a website that uses Airglow and have a question about your data, the website owner is the best first contact. We help our customers answer those requests.

2. Data about visitors to our customers' websites

Airglow measures visits through a small script on the customer's website and, where the customer sets it up, a connection that sees requests as they reach the site. Our goal is to tell what kind of traffic a visit is (a person, an AI agent, an automated browser), never who it is.

What we collect

• The pages viewed, and when.
• The referring page or source (for example, a link from an AI answer).
• The browser's user agent string, and request headers that AI agents use to identify themselves.
• Timing, such as how long a page took to load and how a visit moved between pages.
• Signals that suggest a visit is from an AI agent or automated browser, such as known agent network ranges, the network a request came from (for example, a cloud provider) and the approximate country, and patterns in how the page is used.
• Aggregate counts of sharing and copying on a page (for example, that text was copied from a page), not who did it.
• Consent signals on the page, such as a consent banner's answer or a browser's Global Privacy Control setting, so we can respect them.

What we do not collect

• No names, email addresses or user IDs of visitors.
• No device fingerprints.
• We never identify the people or companies who visit our customers' websites, and we do not try to.
• Raw IP addresses are used only in memory to compute a hash with a salt that changes every day. The raw IP address is never stored, and the hash cannot be linked across days.

Session replays

Replays record how a visit moved through a customer's site. Replays are recorded only for visits we score as AI agents or automated browsers, never for people. Replays are on by default, and customers can turn them off at any time. Everything typed into form fields is always masked in the browser before anything is sent to us, and customers can mask or block other parts of their pages.

3. Data about our customers

When you create and use an Airglow account, we collect:

• Account details: your email address, your name, and your workspace or company name.
• Sign-in records: when you sign in and the sign-in links we send you, so we can keep your account secure.
• Website settings: the websites you add, and how you set them up.
• Billing details: your plan, usage and invoices. Card details are handled by our payment processor. We keep only the card brand, the last 4 digits and the expiry date.
• Support emails: messages you send to us and our replies.

4. Google data

You can choose to connect Google Analytics, Google Search Console or BigQuery to Airglow. When you do:

• We ask only for read-only access, one service at a time. We never write to your Google accounts.
• We use the data only to show you your own reports in Airglow, such as how much of your “direct” traffic came from AI agents. We do not use it for advertising, we do not sell it, and we do not use it to train AI models.
• Access tokens are encrypted when stored.
• You can disconnect at any time. Disconnecting revokes our access, deletes the token, and you can choose to delete the imported data too.

Airglow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. AI tests

Airglow lets you test how AI assistants answer questions about your business. When you start a test, we send the prompts you choose, and pages from your website, to the AI providers you select (OpenAI, Anthropic, Google and Perplexity) and record their answers. Data about visitors to your website is never sent to them.

6. How we use data

• To provide Airglow: show reports, replays, issues and test results to our customers.
• To run accounts: sign-in, billing and support.
• To keep Airglow secure and working: preventing abuse and fixing errors.
• To tell you about your account and important changes to Airglow.

We do not sell data, and we do not use data for advertising.

7. Sub-processors

We use a small number of companies to run Airglow:

We will update this list before we add a new sub-processor.

8. How long we keep data

• Google Analytics data: up to 800 days.
• Search Console data: up to 500 days.
• BigQuery events: up to 90 days.
• Agent replays: 30 days by default. Customers can set this between 1 and 90 days.
• Account data: kept while your account is active, and deleted within 30 days of closing it, except where we must keep records such as invoices by law.
• Backups: kept for 35 days, then deleted.

9. Security

Data is encrypted in transit. Access tokens for connected services are encrypted at rest. Each customer's data is kept separate from every other customer's, and only the people who need access to run Airglow have it. No system is perfectly secure, and if a breach affects your data, we will tell you without undue delay.

10. International transfers

Airglow runs on Cloudflare's global network, so data may be processed in countries other than yours. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to or restrict how it is used.

• Airglow customers: email us at support@airglow.so and we will respond within 30 days. You can also delete websites and connected services from your account at any time.
• Visitors to a website that uses Airglow: please contact the website owner, who controls that data. Because we never identify visitors, we usually cannot find one person's visits ourselves, but we help our customers respond to every request.

You can also complain to your local data protection authority.

12. Children

Airglow is a business product and is not meant for children. We do not knowingly collect data from children under 16 for an Airglow account.

13. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will email account holders before it takes effect.

14. Contact us

Questions about privacy, or a request about your data: email support@airglow.so (write to us).

Miscreants, the company behind Airglow.