Privacy policy
This policy describes what happens to data when you use nalyzed. It documents what the product actually does rather than restating a template.
Data we process about your account
Authentication runs on Firebase Authentication. Your email address, your display name if you have one, and the profile information Google returns when you sign in with Google are held there. Only the fields the product needs are copied into our database:
- Display name and interface language preference.
- Your workspace membership and role.
- Creation and update timestamps.
Review data processed for analysis
From the Google Maps link you paste we collect only publicly visible reviews that require no authentication to read. Review text, rating, date, language and author attribution are stored as the source presents them, and the analysis pipeline applies personal-data redaction. No CAPTCHA, login or bot protection is circumvented — when a source blocks access the job stops and the dashboard reports it as `blocked`.
Cookies
We set one cookie: the session cookie `nalyzed_session`. It is httpOnly and SameSite=Lax, expires after 5 days, and exists only to keep you signed in. We use no advertising, analytics or tracking cookies, which is why you see no consent banner. Our pages load no fonts, scripts or images from a third-party server.
Retention
A collection job started from a Maps link is deleted automatically after 30 days and collected review records after at most 400 days by Firestore TTL policies. Account and workspace data is kept until you ask us to delete your account, at which point your account, your workspace and the analyses belonging to it are removed.
Who we share it with
We do not sell your data. Google Cloud / Firebase processes hosting, identity and database data; OpenAI processes personal-data-redacted review text for analysis; Postmark receives aggregate-only weekly summaries. OpenAI response storage is disabled and Postmark message retention is set to 7 days. Customer data is never used to train any model.
Security
Session state lives in an httpOnly cookie the browser cannot read, and is verified server-side on every request; a revoked session is refused on the next one. Workspace membership is resolved from the verified user identity, never from the request body. Database rules deny everything by default.
Contact
For questions about this policy or to make a data request, write to kvkk@nalyzed.com.