Privacy Notice

Effective date: 4 October 2026.

This notice explains what data www.checkmyai.app collects, why, who else sees it, how long we keep it and how to have it deleted. It covers the free check, the request for a full report, the report itself, emails to us and the chat with the @checkmyai_bot Telegram bot.

In short

• There is no sign-up. A check needs the business name, its line of work and the city or "all of Ukraine". If you like, you can add your speciality, the district and the website.
• The result opens at a link. Anyone who has that link can open it.
• We never store your IP address as is, only a fingerprint of it (a hash) for the usage limits, and we delete the hash after 30 days.
• Only the CheckMyAI founder and FOP Hlamazdina O. A. (invoices and payments) have access to the data. We never sell data or share it for advertising.
• If Microsoft Clarity analytics is switched on for the site, it starts only after you click "Allow".

Who is responsible for your data

The data controller is FOP Hlamazdina Olena Anatoliivna (ФОП Гламаздіна Олена Анатоліївна), a sole proprietor in Ukraine. She also sells the full report, issues the invoices and receives the payments. Below, "we". The proprietor's registration details are on the invoice, and we send them by email on request.

The CheckMyAI founder runs the service on her behalf: he receives requests and messages, prepares the reports and answers questions about data. Write to him:

• Telegram: @checkmyai_bot

We process data under the Law of Ukraine "On Personal Data Protection" No. 2297-VI. For people in the European Union the GDPR rules apply as well; see the separate section below.

What data we get and why

The free check

You enter the business name, what it does, the city or "all of Ukraine", and optionally your speciality (what people come to you for), the district and the website. We also know the language of the page.

What happens next:

• We ask ChatGPT by OpenAI (with web search) and Gemini by Google (with Google Search) a few questions the way a customer would. The questions contain what you entered: the business name, its line of work, your speciality, the city, the district and the website. OpenAI also receives an approximate location: city, country and time zone. These companies never get your contact details or IP address from us.
• Our server opens the home page of your website and of up to four competitor websites that the AI named. It visits them itself, identified as CheckMyAI-Scan/1.0, so the site owner sees a request from our server, not from you. We only take the page title, description, main heading (H1), word count and a few signals: whether the page mentions the city and shows prices, a phone number, opening hours, online booking, online ordering or delivery, a request form or a messenger link, and business markup for Google.
• We store the result: what you entered, the AI answers, the sites they referred to, the competitors' names and websites, the website check results, and the time and cost of the requests. AI answers may contain public facts about the business: address, opening hours, phone number, rating.
• The result opens at a link with a random identifier. We do not publish a list of checks, but anyone who has the link can open the result. If someone checks the same business with the same details within 7 days, they see the same result.
• The founder gets a short Telegram message about every finished check: business name, city, website, summary and link.

A business name and public facts about a business are usually not personal data. They can be when a business is named after a person or is run by a sole proprietor. In that case this notice applies to them in full.

IP address and limits

So that one visitor or bot cannot use up the free checks, we count requests per IP address (network): at the moment up to 3 checks and up to 10 report requests a day. For this, the hosting passes us your IP address. We do not record it. We immediately turn it into a SHA-256 hash with a secret key and keep only the first 16 characters. Without the key, the address cannot realistically be recovered from it. The hash is stored with the record of the check or the request, and we delete it after 30 days.

Request for the full report

You leave a Telegram @username, a phone number or an email. Along with the contact we store which check the request is about (business, city, website), the language, the time and the IP hash. The founder receives the request in Telegram and writes to you to arrange the report. We use the contact only for this: no newsletters, no advertising.

The full report and payment

If you order a report, we correspond with you, send an invoice and prepare the report. The invoice needs your name or your company's name. You pay it by bank transfer, and from the bank statement we see the payer, the amount and the payment reference. We never receive or store card numbers.

For the report we ask ChatGPT, Gemini and Claude by Anthropic 24 customer questions and questions about the business itself, each three times, and check the home pages of your website and your competitors' websites the same way as in the free check. The questions contain only business details, never your contact details. The report is prepared on the founder's work computer, not on the website, and sent to you as a PDF file.

"Contact" via Telegram

The "Contact" link opens the @checkmyai_bot bot. When you start the bot, the founder gets a message with your Telegram name and username. The bot passes your messages, photos and files to the founder and sends the founder's reply back to you. To do that, it passes your Telegram chat ID along with each message. These messages are not stored on our server; they stay in the Telegram chats. Telegram itself processes data under its own privacy policy.

Microsoft Clarity analytics

Only if analytics is switched on for the site and you clicked "Allow" in the bar at the bottom of the page. Clarity records how you use the site: which pages you open, where you click, how you scroll, plus device type, browser and approximate location based on your IP address. This becomes session recordings and heatmaps that help us make the site easier to use. Clarity sees what the page shows, including the business name and the check result. What you type is hidden from the recording, and we hide the contact field separately as well.

Technical logs

Our host, Vercel, sees technical data for every request: IP address, browser, page address and time. It keeps short logs under its own rules to keep the site running and secure. Our code does not write your contact details or IP address to logs.

Legal basis

Each purpose rests on one of the bases in Article 11 of Law No. 2297-VI:

• Running the check and showing the result at its link: performing the service you asked for.
• Keeping the result, showing it again within 7 days, telling the founder about checks: our legitimate interest in seeing how the service works and not paying twice for the same check.
• IP hash for the limits: legitimate interest in protecting the service from abuse and overspending.
• Request for the full report: steps you ask for before entering into a contract.
• The full report and correspondence about it: performing the contract.
• Invoices and bookkeeping: an obligation under tax law.
• Messages to the bot: replying to your enquiry about the service, otherwise our legitimate interest in answering people who write to us.
• Microsoft Clarity: your consent. Without it the script does not load.
• Hosting logs: legitimate interest in a secure, stable site.

If processing rests on our legitimate interest and you object to it, write to us: we will weigh your reasons and stop if they outweigh our interest.

Who else receives data

Only the CheckMyAI founder and FOP Hlamazdina O. A. (invoices and payments) have access to the data. We use these services:

An accountant and the tax authorities may see invoices and payments where the law requires it. We pass data to public authorities only when the law obliges us to.

Transfers abroad

Some of the services work outside Ukraine. The Vercel and Upstash servers are in Frankfurt (Germany), OpenAI, Google, Anthropic and Microsoft are US companies, and Telegram is a company outside the EU.

Under Article 29 of Law No. 2297-VI, EU countries provide adequate data protection. Data goes to the US and other countries only when the service you ask for cannot be provided otherwise (asking the AI questions, passing your request to the founder) or with your consent (Clarity). These companies commit to protecting the data in their data processing terms.

For every finished check the founder gets a short Telegram message: the business name, city, website, summary and the link to the result, without your contact details or IP address. The basis is our legitimate interest in seeing how the service works.

We pass requests and messages through Telegram because that lets us reply quickly. We have no other channel, so if you do not want your contact to go through Telegram, do not leave it in the form.

How long we keep data

• Check results: 12 months from the date of the check. Then an automatic job that runs every day deletes them, and the link stops working.
• IP hashes: 30 days, then the same daily job deletes them. We never store the IP address itself, only a hash made with a secret key. The limits look at the last 24 hours, so the hash is not needed for long.
• Requests for the full report: 12 months from your last request about that check, then the same daily job deletes them. If you become a customer, the periods for the report apply from then on.
• Messages to the founder in Telegram, and bot chats: the founder deletes them by hand within 12 months. Correspondence with a customer is kept as long as the report.
• Technical bot counters keyed by your Telegram chat ID (to limit spam): up to 24 hours, then they expire on their own.
• The full report and the AI answers behind it: 12 months after we send the report. That is how long we answer questions about the report and handle refund claims.
• Invoices and payment records: as long as Ukrainian tax law requires.
• Your analytics choice: in your browser until you change it under "Analytics settings" or clear the site's data.
• Clarity data: Microsoft keeps session recordings for 30 days and aggregated statistics for up to 13 months.
• Vercel logs: a short period under Vercel's rules.

Your rights

Under Article 8 of Law No. 2297-VI you have the right to:

• know what data about you we process, where it comes from, why, and to whom we pass it;
• access your data and get a copy;
• have inaccurate data corrected;
• have data deleted, including a check result or a request;
• object to the processing of your data;
• withdraw your consent to Clarity at any time under "Analytics settings" at the bottom of the page. This does not make processing before the withdrawal unlawful;
• know how automated processing works and be protected from an automated decision that has legal effects for you;
• complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

To use a right, write to us on Telegram at @checkmyai_bot. If it is about a check, include the link to the result. We may ask you to confirm the data is yours, for example by writing from the contact you left. We reply within 30 days.

We do not make decisions about you based solely on automated processing that have legal effects for you. A check result describes what AI says about a business; it does not assess you.

You can complain to the Ukrainian Parliament Commissioner for Human Rights: 21/8 Instytutska St., Kyiv, 01008, ombudsman.gov.ua. It is easier for us to help if you write to us first.

If you are in the European Union

For people in the EU we also follow the EU General Data Protection Regulation (GDPR).

• Bases under Article 6 GDPR: the check, the request, the report and replies to enquiries — a contract and steps before it (Art. 6(1)(b)); keeping the result, notifying the founder, the IP hash and hosting logs — legitimate interest (Art. 6(1)(f)); invoices — a legal obligation (Art. 6(1)(c)); Clarity — your consent (Art. 6(1)(a)).
• On top of the rights listed above, you can restrict processing, receive your data in a machine-readable format and object to processing based on our legitimate interest. We reply within one month.
• Data that goes to the US is covered by the European Commission's decision on the EU-US Data Privacy Framework, where the company is certified, or by the Commission's standard contractual clauses (SCCs) in these services' data processing terms. We pass requests and messages through Telegram because otherwise we could not reply to your request quickly (Art. 49(1)(b) GDPR). The short Telegram message to the founder about every finished check (business name, city, website, summary and link, without your contact details or IP address) rests on our legitimate interest (Art. 6(1)(f) GDPR).
• You can complain to the data protection authority in the EU country where you live, work or where the breach happened. In Poland, for example, it is the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

Cookies, localStorage and Clarity consent

The site sets no cookies of its own. The language comes from the page address, not from a cookie.

If analytics is switched on for the site, a bar about Clarity appears at the bottom. Your choice ("Allow" or "No, thanks") is kept in your browser, in localStorage under the key aipick:analytics. It is not sent anywhere. If your browser does not let us store the choice, it lasts while the tab is open.

Only after "Allow" does the Clarity script load from clarity.ms, and Microsoft sets its own cookies, including _clck and _clsk. We deny advertising use in Clarity's consent settings.

To change your choice, click "Analytics settings" at the bottom of the page: the bar will appear again and you can choose differently. If Clarity was already running, the site tells it at once that there is no consent, and without new consent the script does not load. You can also clear the data for www.checkmyai.app in your browser settings.

Children

The service is made for business owners and staff. It is not meant for children, and we do not knowingly collect their data. If you are under 16, please do not leave us your contact details. If a child has sent us their data anyway, write to us and we will delete it.

How we protect data

The site works over HTTPS only. Keys to the database and the AI services are kept in the hosting's protected settings and never reach the browser. IP addresses are stored only as hashes. Only the CheckMyAI founder and FOP Hlamazdina O. A. (invoices and payments) have access to the data.

Changes

If we change this notice, we will update the date at the top. The current version is always on this page.

This notice is written in Ukrainian; this is a translation. If the two differ, the Ukrainian text prevails.

Contact

• FOP Hlamazdina Olena Anatoliivna, Ukraine
• Telegram: @checkmyai_bot

How the service works and how we sell the full report is set out in the Terms of Use.