Privacy Policy

1. Introduction

inkSTR ("we", "our", or "us") operates the inkSTR platform at inkstr.co. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service, our website, or our free tools.

2. Information We Collect

We collect the following types of information:

• Account information: name, email address, and password (stored as a one-way hash) when you create an account, or your Google account identifier if you sign in with Google.
• Project and business data: property details, business descriptions, author name and bio, content strategies, blog posts, keyword research results, and other content you create or import through our platform.
• Property images: photos you upload to your image library. These are stored in cloud object storage (AWS S3 or Cloudflare R2) and served via CDN.
• PMS data: when you connect a property management system (Hospitable, OwnerRez, Hostaway, Guesty, or Connect by Boostly), we retrieve guest reviews, guest messages, guest names, property listings, and amenity details from that integration on your behalf. This data is used to inform content generation, site FAQs, and property knowledge pages. Excerpts of guest reviews and guest messages are sent to our AI provider (Anthropic) as part of the prompts that generate that content. If you enable guest email sequences, past guests' names and email addresses are also stored and sent to your own Mailchimp account.
• Competitor and market research data: during strategy generation and monitoring, we collect publicly available web content about your market: competitor pages, search results, public reviews of your business and of competing businesses (including reviewer display names and review text), and public forum posts (including Reddit post text and usernames) that match your keywords. We store this content, along with AI-generated relevance labels, so that you can review it in the product.
• Site crawl data: when you provide your website URL, we crawl your sitemap and public pages to assess content maturity, identify existing topics, check for broken links, and generate on-page recommendations.
• Third-party credentials: API keys, OAuth tokens, and access credentials for services you connect (e.g., Wix, WordPress, Hospitable, Google Search Console). These are encrypted at rest using AES encryption.
• Support and assistant conversations: messages you send to the in-app help assistant and the AI strategist are stored with your account so we can improve answers and support you.
• Free tools and onboarding: when you use the website grader, AI visibility checker, domain authority checker, or the self-serve onboarding flow, we store the email address and website URL you enter, the generated results, a keyed hash of your IP address (never the raw address), and your browser type.
• Usage data: server logs, device and browser information, and how you interact with our platform, used to maintain and improve the service. Product analytics is optional and off by default (see “Cookies and Tracking” below).
• Billing information: payment method details are collected and processed by Stripe. inkSTR does not store full card numbers or CVV codes. We receive and store a Stripe customer ID and subscription status.

3. How We Use Your Information

• To provide, maintain, and improve our services.
• To generate AI-powered content strategies, keyword plans, and blog posts on your behalf.
• To publish content to connected third-party platforms at your direction.
• To submit published article URLs to the Google Indexing API for faster search indexing.
• To communicate with you about your account, billing, and our services.
• To send you product updates and educational emails when you use a free tool, request a plan, or subscribe to our newsletter. Every marketing email includes an unsubscribe link and our postal address, and you can opt out at any time.
• To process payments securely through our payment processor (Stripe).
• To detect and prevent fraud, abuse, or violations of our Terms of Service.

4. Third-Party Services

Our platform relies on the following service providers. When you use these integrations, your data is processed by those services according to their own privacy policies. We share the minimum data necessary for each service to function.

Infrastructure

• Railway: hosts our application servers and database in the United States.
• AWS S3 / Cloudflare R2: property images you upload are stored in cloud object storage and served via CDN. Images are accessible via URL and are not access-restricted.
• Cloudflare: bot protection (Turnstile) on public forms, which processes your IP address, and edge storage for the optional SEO snippet.

AI and research providers

• Anthropic (Claude): article briefs, business context, keyword data, excerpts of connected PMS guest reviews and messages, help-assistant conversations, and collected research content are sent to Anthropic's API to generate content and answers. See Anthropic's Privacy Policy.
• TypeSafe AI (Jev): a decision model used to classify and score, never to write. When enabled, the text of generated articles (before publication), target keywords, article titles, candidate video titles, and your business description and market are sent to TypeSafe's API to check content quality and relevance. TypeSafe does not train on this data. See TypeSafe AI.
• Google Gemini and OpenAI: image descriptions are sent to generate article images, and article topics are sent to check whether AI assistants cite your site.
• Perplexity: your business name, website, target market, and article topics are sent for grounded web research and AI visibility checks, including the public AI visibility checker.
• DataForSEO: keyword and market data requests (including your target keywords, geographic markets, and domain) are sent to retrieve search volume, keyword difficulty, backlink, and ranking data.
• Serper and Firecrawl: search queries and website URLs are sent to fetch public search results, public reviews, and page content used for research.

Publishing and integrations

• Wix and WordPress: when you connect a site, article content and images are published to your blog via that platform's API using credentials you provide.
• Custom webhook / AI-built sites: when you configure a webhook endpoint, article content is sent to the URL you specify. You are responsible for the security and privacy practices of that endpoint.
• Google Search Console, Google Business Profile, Google Indexing API, and Bing Webmaster Tools: OAuth tokens and site URLs are shared with these APIs to retrieve search performance data, manage your business profile, and request indexing of published content. See Google's Privacy Policy.
• Hospitable, OwnerRez, Hostaway, Guesty, and Connect by Boostly: when you connect one of these systems, we retrieve property listings, photos, guest reviews, and guest messages to inform content generation.
• Mailchimp: if you enable guest email sequences, past-guest contacts and campaign drafts are sent to your own Mailchimp account using credentials you provide.
• BrightLocal: if you use our local SEO citation features, business profile details (such as name, address, phone, and categories) are sent to BrightLocal to build and manage local directory listings. See BrightLocal's Privacy Policy.

Billing, email, and analytics

• Stripe: billing and payment processing. Card data is handled entirely by Stripe and never passes through inkSTR servers. See Stripe's Privacy Policy.
• Resend: sends transactional email such as verification codes, password resets, and free-tool reports.
• Loops: sends product updates and educational email. Your email address, name, plan tier, and the tool or page you signed up from are stored in Loops so we can send relevant messages and honor unsubscribes.
• PostHog: if you consent to analytics (see “Cookies and Tracking” below), product usage events, page views, and masked session recordings are sent to PostHog to help us understand and improve the product. When you are signed in, these events are associated with your account. Separately, our servers send PostHog a small set of account lifecycle events (such as signup, subscription changes, and application errors) that do not depend on the browser consent banner. See PostHog's Privacy Policy.
• Senja: our marketing pages load a testimonial widget from Senja, which receives your IP address and browser information when the widget loads.
• Google Fonts: our pages load web fonts from Google, which receives your IP address when the font files are requested.

5. Data Security

We implement appropriate security measures to protect your data, including:

• AES encryption of all API keys and third-party credentials at rest.
• Secure session management with HTTP-only, SameSite cookies.
• HTTPS-only connections with HTTP Strict Transport Security (HSTS).
• Rate limiting on authentication endpoints to prevent brute-force attacks.
• Row-level data isolation: all stored data is scoped to your account and cannot be accessed by other users.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security of data transmitted to or from our platform.

6. Data Retention and Deletion

We retain your account data, project data, connected PMS data (including guest reviews and messages), research data, and support conversations for as long as your account and the related project exist. Deleting a project removes its PMS data, research data, leads, and generated content.

You can delete your account yourself from Account Settings. Deletion is scheduled for 30 days after the end of your current billing period (or 30 days from the request if you have no active subscription), and you can cancel the request during that window. When the purge runs, your projects and their data, PMS connections, support conversations, and subscription record are permanently deleted. We keep a record of domains that have used a free trial to prevent trial abuse, and we keep billing records as required by tax and accounting law.

Free-tool results, newsletter signups, and onboarding sessions that were never linked to an account are retained until you ask us to delete them. You can request deletion of any data we hold about you by contacting hello@inkstr.co.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, to receive a copy of it, and to object to or restrict certain processing. Users subject to GDPR (EU/EEA), UK GDPR, Canadian privacy law, or CCPA (California) may have additional rights including data portability and the right to know what personal data we hold. To review, correct, or request a copy of your information, or to exercise any of these rights, contact us at hello@inkstr.co. We respond within 30 days. If you are in Canada, the EU, EEA, or UK, see Section 8 for the rights that apply to you specifically and for where your information is processed.

We do not sell your personal data and we do not share it for cross-context behavioral advertising.

8. International Users and Cross-Border Transfers

inkSTR is operated from the United States. Regardless of where you are located, your personal information is stored and processed in the United States, and is handled by the sub-processors listed in Section 4, several of which also operate in the United States or process data globally. While your information is in another country it is subject to that country’s laws, which can include lawful access by that country’s courts, law enforcement, and national security authorities. We use the safeguards described in Section 5 to protect it, but we cannot exempt it from those laws.

Canada (PIPEDA). If you are in Canada, the Personal Information Protection and Electronic Documents Act applies to our handling of your personal information. We rely on your consent to collect, use, and disclose it for the purposes set out in this policy, and we collect only what those purposes require. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice — withdrawing consent for processing that the service depends on means we can no longer provide the service to you. You have the right to access the personal information we hold about you, to ask for a correction if it is inaccurate or incomplete, and to ask how it has been used and to whom it has been disclosed. Contact hello@inkstr.co to make a request; we respond within 30 days. As described above, your personal information is transferred to and processed in the United States by inkSTR and its sub-processors.

Accountability. The individual accountable for our compliance with PIPEDA can be reached at hello@inkstr.co. If you are not satisfied with our response to a privacy question or complaint, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

Commercial email (CASL). We send marketing email to Canadian recipients only where Canada’s Anti-Spam Legislation permits it: with your express consent, given by checking the opt-in box on one of our sign-up forms, or on the implied consent that arises when you send us an inquiry — for example, entering your email to unlock a content plan or a free-tool result — which we rely on for no longer than the six months CASL allows. Every marketing email we send identifies inkSTR, includes our mailing address, and carries a one-click unsubscribe link that we honour promptly. Transactional messages about your account, billing, or a service you asked for are not marketing email and are sent regardless of your marketing preference.

Quebec. inkSTR does not currently serve markets in Quebec, and the platform is available in English only.

Mexico (LFPDPPP). inkSTR serves Mexican destinations for operators based in the United States and Canada, and the platform is available in English only. Where a connected property-management system supplies guest reviews or messages from people in Mexico, that information is processed in the United States on behalf of the operator who holds the guest relationship, as described in Section 4, and is used only to inform the content we produce for that operator. If you are in Mexico and believe inkSTR holds personal information about you, you may exercise your rights of access, rectification, cancellation and opposition under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares by contacting us at the address in Section 11; we respond within the periods that law sets, and you may also contact the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).

EU, EEA, and UK. If you are in the EU, EEA, or UK, we process your personal information on the basis of your consent and of our legitimate interest in operating and improving the service, and we transfer it to the United States as described above. You have the rights set out in Section 7, including access, correction, deletion, portability, and the right to object to or restrict processing, and you may lodge a complaint with your local supervisory authority.

9. Cookies and Tracking

Necessary cookies. We use HTTP-only session cookies for authentication. These are required for the service to function and cannot be disabled while using the platform.

Product analytics (optional, off by default). With your consent, we use PostHog to collect product usage analytics, including page views, feature interactions, and masked session recordings (text inputs are masked), to understand how the product is used and to improve it. Analytics is disabled for every visitor until you accept it via the consent banner; if you decline, no analytics cookies, page-view tracking, or session recording run in your browser. When analytics is enabled and you are signed in, these events are associated with your account (for example, your email, name, and plan) so we can analyze usage and support you.

We do not use third-party advertising cookies. You can change your analytics choice at any time:

Do Not Track. Our site does not respond to browser “Do Not Track” or Global Privacy Control signals, because analytics is already off unless you opt in through the consent banner.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. For material changes, we will notify you by email or via an in-app notice.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at hello@inkstr.co.