Privacy Policy

Who we are

Sunnyvale AEO is the operating name used by Jonah Samarron, a sole proprietor based in the South Bay, California. In this policy, "Sunnyvale AEO", "we", "us", and "our" refer to that business.

We provide AI visibility audits and Answer Engine Optimization services to medical spas in the South Bay. This policy covers the website and those services. It does not cover third-party sites we link to, which have their own policies.

Information we collect

Information you give us directly:

• Audit request (intake form): your business name, city, website URL, email address, phone number, and an optional reason for reaching out.
• Checkout: your business name and email address. Card payments are processed by Stripe; we do not receive or store your full card number.
• Anything else you send us, for example when you reply to our emails or share access to your website so we can deploy the work.

Information we collect automatically:

• Your IP address, which we use to rate-limit form submissions (to prevent abuse) and which is included in the internal notification we receive when you submit a request.
• Standard technical and usage data (such as browser and device type, pages viewed, and performance metrics) collected by our hosting and analytics providers to operate, secure, and improve the site.

How we use your information

• To prepare and deliver your audit and to provide the services you request.
• To contact you about your request, your audit, and your engagement.
• To process payments and manage your subscription (through Stripe).
• To operate, secure, debug, and improve the website and our services.
• To comply with legal obligations and enforce our agreements.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

How we share your information

We share information only with service providers that help us run the business, and only as needed for them to perform their function for us:

• Stripe, for payment processing and subscription billing.
• Supabase, which hosts the database where we store your request and client records.
• Resend, which delivers our transactional and onboarding email.
• Telegram, which delivers an internal notification to our team when a new request or order arrives (this notification includes your IP address).
• Our internal lead-management system (referred to as SKUNA), which we use to track and follow up on audit requests.
• Vercel, which hosts the website and provides the analytics and performance tooling described below.
• SerpAPI, a search-data provider we use to measure how a business appears in Google AI search results during an audit. It receives the business name and website URL you submit, not your contact details.

We may also disclose information if required by law, to protect our rights or safety or those of others, or in connection with a business transfer. The providers listed above are the processors we currently use.

Analytics and cookies

We use Vercel Analytics and Vercel Speed Insights to understand aggregate traffic and to measure how quickly pages load. These tools are privacy-friendly: they do not use cookies or collect personally identifiable information to track you across sites. They help us improve the site.

How long we keep your information

We keep your information for as long as needed to provide the services you requested, to maintain our business records, and to comply with our legal obligations, after which we delete or de-identify it. In general, we keep audit requests and leads that do not become clients for up to 24 months, and we keep client records for up to 7 years after an engagement ends to meet tax and other legal recordkeeping obligations.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to:

• Know the personal information we collect about you and how we use and share it.
• Request access to a copy of that information.
• Request that we correct inaccurate information.
• Request that we delete your information, subject to legal exceptions.
• Not be discriminated against for exercising these rights.

Because we do not sell or share your personal information for cross-context behavioral advertising, there is no opt-out of sale to make. To exercise any of these rights, contact us using the details below. We will verify your request before acting on it, as the law allows.

How we protect your information

We use reasonable administrative and technical measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

Our website and services are intended for business owners and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of the page. Material changes will be reflected here before they take effect.