Legal

Privacy policy

Last updated: 27 October 2026. This policy covers locan.ai (the website and the free tools) and app.locan.ai (the AI visibility tracker). The short version comes first.

The short version

• The free tools need no account. What you type into a tool goes to our API to make your report and is not stored. On the website each tool asks for your email address for tool updates and one email offering a free month of the tracker, which can reach the address once even if you never confirm it. If you never confirm it, we delete it after 30 days.
• The tracker needs an account. We keep your email address, your name if you add one, an argon2id hash of your password (never the password itself), your sign-ins for 30 days (time, the network of your IP address, browser and device), your workspaces and their members, and what you track: businesses, questions, AI answers, competitors, sources and actions. A sign-up you never confirm is deleted after 30 days.
• To run checks we send your questions and the location of the business to OpenAI, Google and DataForSEO, and business data to Replicate for language-model work. They don't get your name or email address from us.
• Payments go through Stripe, whose Link service sells the plans and packs as the seller. We send Stripe the buyer's email address and the workspace name; we never see or store your card number.
• The tracker sets two cookies, both strictly necessary: one keeps you signed in, and one ties a new sign-up to the browser it started in. The website loads analytics only if you accept them.
• We don't sell personal data and we don't show ads.

Who we are

The controller of your personal data is MB Longterm Solutions, registration number 305997678, VAT number LT100018157112, Liucijanavos g. 94, Vijūkų k., LT-54306 Kauno r.. Write to hello@locan.ai about anything in this policy.

What we collect and why

On locan.ai and in the free tools

Tool inputs. Each tool takes a small input (a business name or Google place, a keyword, a city, categories or services, a review text and rating) and returns a report. Our API processes the input in memory for that request. We don't store tool inputs or reports, and we don't build profiles from them. The LocalBusiness Schema Generator and the Google Review Link & QR Code Generator run in your browser, apart from the optional business lookup.

Daily limits. Each visitor gets a daily limit, which keeps the tools free. We count requests per IP address and day, and the counters are deleted after two days.

Email updates. Every free tool on locan.ai asks for your email address before it shows a result, and the update forms on the site ask for it too (the free tools' API, CLI and MCP server don't). What you get: One confirmation email, then a short note when a free tool ships or improves, or when a guide or the tracker gets a major update, and one email offering a free month of the tracker. One-click unsubscribe. We store the address, the page you entered it on, your IP address, when you signed up and confirmed, and when we sent you the free-month email. The free-month email goes out once, about 24 days after you last entered the address, from Gintaras at hello@locan.ai, with a one-click unsubscribe link. It can reach an address that was never confirmed: that is the one email such an address gets besides the confirmation, and an address that is never confirmed is deleted 30 days after you last entered it. Your browser remembers the address for 90 days so the next tool fills it in (see cookies and browser storage). When you unsubscribe, we keep the address marked as unsubscribed so you get nothing more. Ask us and we delete it.

The free-month link. After a tool result, and in the free-month email, there is a personal link to a free month of the tracker's Basic plan (30 days). It carries a signed code with your email address and the date it was made, in the part of the link that never reaches a server log. The tracker reads it when you sign up with that address and start the free month, and notes that your account came through the link.

Analytics, only if you accept. Google Analytics 4, Hotjar and PostHog show us which pages and tools help and where they break: pages visited, clicks, device, browser and approximate location, and, for Hotjar and PostHog, recordings of how pages are used with typed text masked. Tool inputs are excluded from recordings. Nothing loads before you click "Accept" in the cookie banner.

Email you send us. We keep it as long as we need to answer you and for our records.

In the tracker (app.locan.ai)

Your account. Your email address, your name if you add one, an argon2id hash of your password (we never store the password itself), when you confirmed your email address and last changed your password, the IP address you signed up from, and your Google account ID if you sign in with Google. Google then also tells us your email address and name. Until you confirm your email address, the name you gave and the hash of the password you chose wait with the confirmation link. If you never confirm it, we delete the sign-up and what it holds 30 days after you last signed up or asked for a new link.

Sign-ins. For each signed-in session: when it started and was last used, how you signed in, the network of your IP address (such as 203.0.113.0/24, not the full address) and a short description of the browser and device, such as "Chrome on macOS". Settings lists them so you can sign out other devices. A session ends when you sign out, and after 30 days at the latest. We delete its record 30 days after it started.

Security records. Failed sign-ins, sign-ups, and requests for password resets and confirmation emails, with the email address and IP address, so we can limit attempts and stop abuse. We also count costly requests (business lookups, question generation, questions in the app) per member and workspace. We delete these records after 24 hours. Links in confirmation and reset emails are stored only as hashes. They work once and expire after 48 hours and 1 hour.

Workspaces and members. Workspace names, members' email addresses and roles, who invited whom, and pending invitations with the invited email address. The address of someone you invite comes from you. We use it only to send that invitation and the reminders you ask for. Invitation links expire after 7 days.

What you track. For each business: its name, address, phone, website, category, opening hours, the languages and platforms you pick, and the public details Google Places returns for it. Then the questions, every AI answer we collect (the full text, the links it cites and the businesses it names), scores, competitors, sources, facts and actions. This is mostly data about businesses. An answer can name a person, for example a dentist, and we keep answers as they were written.

Questions you ask in the app. When you ask about a result, your question and the report data it needs go to our language-model provider to write the answer.

Plans, credits and payments. Every change to a workspace's credits, with the member who caused it. For the workspace's plan: the plan, monthly or yearly, its status, the dates it started, renews, ends or is cancelled, the free month's end, and Stripe's reference numbers. For each payment and pack: the amount, the currency, the status, the dates, the member who paid, Stripe's reference numbers and links to the invoice and the receipt. For the free month we also keep the fingerprint Stripe gives us for the card (not the card number), so each card gets one free month. Stripe collects your card details, billing name and address and VAT number on its own pages, and Link emails the invoices and receipts to the member who paid. We get a short notice when someone confirms a sign-up, starts a free month or a plan, changes or cancels it, buys a pack, or when a payment fails or is refunded or disputed, with the email address, the workspace and the plan.

Email we send you. Account emails (confirming your address, password reset, password changed, welcome, account deleted), invitations and member notices, plan and payment emails (the free month started, the free month ends in 3 days, a payment failed, the plan ended, a pack bought, a refund), an email after each scheduled run, and, to owners and admins, a notice when the credits left cover only one more run or a scheduled run is skipped. Link also emails receipts, invoices and its own free-month reminders. Each member can turn off the run emails in Settings or with the link in each one. We record which of these emails we sent, so a retry never sends one twice.

Pages that answers cite. To check whether a business is listed on the sites AI cites, our servers open those public pages. No personal data of yours is involved.

Why we may use it

• To provide what you asked for (a contract with you): your account, workspaces, plans, credits, runs, the emails about them, and payments.
• Our legitimate interests: security, rate limits and abuse prevention, keeping the service running, one free month per person and card, our notices about sign-ups, plans and payments, and the one free-month email to an address that was entered in a free tool but never confirmed.
• Your consent: analytics on locan.ai and the email updates, including the free-month email. You can withdraw it at any time.
• Legal obligations: invoices and accounting records.

Who processes data for us

We don't sell personal data and we don't share it with advertisers.

Where data is stored

Our servers, database and backups are in the US West (Oregon) region of Amazon Web Services. Most providers above are based in the United States. When personal data leaves the EU, we rely on the provider's standard contractual clauses or its certification under the EU-US Data Privacy Framework.

How long we keep it

• Tool inputs and reports: not stored.
• Usage counters: two days.
• Email updates: an address you never confirm, 30 days after you last entered it; a confirmed one until you unsubscribe. After that, only the address, its unsubscribed status and when we sent the free-month email, unless you ask us to delete it.
• Which email address, workspace and card fingerprint already had a free month: while we offer the free month.
• Your account, workspaces and what you track: while the account and the workspace exist.
• A sign-up you never confirm: 30 days after you last signed up or asked for a new link.
• Sign-in sessions: 30 days. Security records: 24 hours.
• Confirmation, reset and invitation links stop working after 48 hours, 1 hour and 7 days.
• Server logs (requests and errors, which include IP addresses): 30 days.
• Backups: up to 30 days.
• Plans, payments and invoices: as long as tax and accounting law requires.
• Analytics: per the Google Analytics, Hotjar and PostHog settings, currently 14 months or less.

Deleting your account

You can delete your account in the app under Settings, with your password if the account has one. If you own a workspace that has other members, transfer it or delete it first. If a workspace you own has a plan that is still running, cancel the plan in Billing first; it ends at the end of its period. If a run is going on in a workspace that would close, wait until it has finished.

When you delete your account, we sign you out everywhere and at once remove your name, your password hash and your Google link. Your email address is replaced with a placeholder, so the address is free and can sign up again as a new account. Workspaces where you are the only member close with the account. In shared workspaces your membership ends, and what you added stays with the workspace. We send one last email to your address to confirm the deletion.

The closed account keeps its internal ID and the IP address it signed up from, and we keep payment records as long as the law requires. Closed accounts and workspaces stay in our database until we purge them. Write to hello@locan.ai and we purge yours within 30 days.

Your rights

Depending on where you live, you can ask us for a copy of your data, correct it, delete it, get it in a portable format, restrict or object to how we use it, and withdraw your consent. Write to hello@locan.ai and we answer within one month. You can also complain to a data protection authority, in particular in the EU country where you live or work.

You can see and change most of your data yourself: your name, password, sessions and run emails in Settings, and your workspaces, members and locations on their pages in the app.

Cookies and browser storage

The tracker sets two cookies, and both are strictly necessary: one keeps you signed in, and one, set when you sign up, ties the sign-up to the browser it started in. The website sets no cookies unless you accept analytics. The tracker has no analytics and no advertising.

The app also keeps short-lived notes in your browser's session storage (a notice to show after the page reloads, an invitation you are accepting), which is cleared when you close the tab. Payment pages are on Stripe's website, and Stripe sets its own cookies there to prevent fraud. If you use Sign in with Google, Google's sign-in script runs on our sign-in page and may set cookies to remember your choice. Their privacy policies apply to those cookies.

Change your analytics choice for locan.ai at any time in Cookie settings (also in the footer). Declining doesn't affect any tool.

Public business data

The free tools describe businesses with data Google already publishes (name, address, category, review counts, position in results). The tracker stores what AI assistants say about businesses. If a report shows something about your business that Google should not publish, the fix is in your Google Business Profile. Our Google Business Profile guide explains how to correct each field. For anything Locan stores about you, write to hello@locan.ai.

Children

Locan is for businesses and the people who work for them. It is not meant for children, and we don't knowingly collect data from anyone under 16.

Changes

When our processing changes, we update this page and the date at the top. If a change affects account holders, we tell them by email before it applies.