Check my site — $19Check — $19

Privacy

Last updated Oct 11, 2026. Version 1.8.

Who controls your information

Kovmere is a service of Content Commerce Labs LLC, doing business as Kovmere. Content Commerce Labs LLC controls the information described on this page. You can reach us through Contact us, by replying to any receipt, order, or report email you have received from us, or by mail at Content Commerce Labs LLC, 100 North Howard Street STE R, Spokane, WA 99201, US.

What we collect

You give us: the website URL, the one-line category, competitor names, the brand name, and — if you enter one — your email address. If your plan includes written fixes, we read the public pages of your own website to write them; there is no form to fill in.

We produce about your site: the sampled answers from the AI engines, every URL those answers cited, what we found when we fetched those pages, and the fetch results for your own pages (status codes, robots rules, page text size).

We collect automatically: IP address, timestamps and request counts, used for rate limiting, spend caps and abuse prevention. We also record a small set of first-party usage events on our own server — a page view of the homepage or the pricing page (and, on a visit that arrived from one of our ads or another link carrying campaign tags, a page view of each of our public pages that visit opens — never your reports, Fix packages, dashboard or account), the start of a checkout, the hand-off to Stripe, a completed purchase (recorded from Stripe's signed webhook), a delivered report and a Check-to-Pro upgrade — together with the campaign tags (utm_source, utm_medium, utm_campaign, utm_term) a link carried, if any. These events carry a daily-rotating hashed visitor id derived from your IP address and browser; the address itself, your email, and any report or question content are not stored on them, and they are never shared with or sent to an analytics vendor.

Order and account records: the Stripe checkout/transaction identifiers for what you bought, your subscription status, the one-time start-link token issued for an order, and — if you unsubscribe or delete your data — a record that your address should not be emailed again. Payment records themselves come back from Stripe; we never see or store your card number.

If you connect a CMS: the credentials you enter on the CMS page (for example a WordPress application password, a Ghost Admin API key, a Webflow or Shopify token) are stored against that one reading so the "create a draft" button can work. They are encrypted at rest with a key held outside the database, used for nothing else, are never written to our logs, and are deleted when you press Disconnect or when the reading's data is deleted. We only ever ask your CMS to create an unpublished record; we never publish.

If you use an Agency workspace: the workspace name, the brand name and logo URL you want shown to your clients, the owner email, and the client websites you add. The workspace opens only for its owner and the team members the owner adds, each logging in with their own email and password.

If your workspace uses the API (only workspaces created under the retired Agency plan can): the webhook URL you register, and the fact of each API call. Webhook deliveries send the job id, site, headline counts and report URL to the URL you chose; once it leaves us it is governed by your own system's privacy practices.

If you contact us: whatever you enter on the Contact us form — your email, the subject you chose, your message, and (if you came from a report or receipt) the job or order it relates to.

What we do with it

We use it to: run and deliver your reading; send you the report link, receipts, order confirmations, alerts and reading summaries; enforce rate limits and spend caps; respond to messages you send us; and operate, secure and improve the service itself. We do not use your submitted content to train a model of our own. Aggregated, de-identified figures may appear in published research studies; we will not identify a specific customer, brand, or domain in a public study without that customer's separate permission.

We do not sell your personal information, and we do not use it for targeted advertising.

Who else processes it

  • OpenAI (United States) — buyer questions and the brand/category context, for sampling answers from the OpenAI web-search API, writing the question set, judging answers, and writing parts of the Fix package. We do not instruct OpenAI to use what you submit to train its general-purpose models; its own retention and data-use terms depend on the API account plan we hold with it, which we have not separately re-verified for every claim on this page.
  • Perplexity (United States) — buyer questions, for sampling answers from the Perplexity Sonar API, under the same no-training instruction and the same caveat above.
  • Google (United States) — buyer questions, for sampling answers from the Gemini API; and, when question selection uses it, search terms from your category, for Google Keyword Planner demand figures.
  • Anthropic (United States) — buyer questions, for sampling answers from the Claude API; and the report and the public pages of your website, for writing the Fix package.
  • DataForSEO — buyer questions, for reading the Google AI Overview that Google shows for each question.
  • Serper — web searches about your business, for finding your listings and the pages AI answers cite when your Fix package is written.
  • Stripe (United States) — checkout, subscriptions and payment records. Card details go to Stripe directly and never reach us.
  • Resend (United States) — delivery of service and promotional email.
  • DigitalOcean (United States) — hosts the site, its database and its backups.
  • Your CMS provider — only if you connect one, and only for the specific draft you press a button to send it.

Each of the above processes what we send it under its own applicable terms and data-protection commitments; we disclose to each only what is reasonably necessary for the purpose above. The servers, database and backups behind Kovmere itself run on DigitalOcean in the United States.

Email

Email tied to something you started — your report link, receipts, order confirmations, alerts on a site you subscribed for, reading summaries — is part of the service and is sent as long as your account has an email on file. Promotional follow-up email offering an upgrade is sent only if you tick the box offering it at the point we collect your address; it is never required to unlock a report. Every promotional message carries a postal address and a working unsubscribe link; unsubscribing suppresses that address permanently for promotional mail, and we do not send it to any list again — that suppression record is itself kept indefinitely, precisely so a deleted or unsubscribed address is never re-added.

Retention and deletion

We do not currently run an automatic, time-based deletion job for most of what we hold — the descriptions below are how long each kind of data is actually kept until you ask us to delete it, not a fixed expiry we enforce in code today:

  • Your email address, readings, reports, sampled answers, lists of cited pages, and fix drafts: kept until you delete them from your account (log in), described below.
  • CMS credentials: kept until you press Disconnect on that reading, or until you delete your data — whichever comes first. There is no automatic inactivity-based expiry yet.
  • Paid orders: kept indefinitely as our financial and tax record; deleting your data removes the email address from the order but keeps the order itself, as described below.
  • Contact messages you send us through Contact us are kept so we can follow up on billing, safety, or delivery issues, until you delete them through the deletion flow below (or ask us to delete one by hand sooner).
  • Checkout consent records (which version of these documents you agreed to, and when, for how much, and from which IP address) are kept for as long as the order they belong to. A consent record that is not attached to a purchase — a checkout you started and did not complete — is deleted by the deletion flow below along with everything else. A consent record that is attached to a purchase is not deleted by it: your email address and IP address are removed from the record, and what remains is the version of these documents you agreed to, the date and time you agreed, the plan, the amount and the billing interval, and the order it belongs to. We keep that minimized record for as long as we keep the order itself, because it is the evidence that the charge on that order was authorised — without it we cannot answer a payment dispute about your own purchase, and we are required to be able to.
  • Operational logs (rate-limiting counters and our internal event log, which can include an IP address or email tied to an action you took) are kept indefinitely as an audit trail — the deletion flow below does not delete these rows, but it does scrub your email address out of every one that carries it, replacing it with a placeholder, so the count of past activity survives without your address in it.
  • Backups: our nightly backup script keeps the 14 most recent backups of the database and report files (roughly the last 14 days) before deleting the oldest one. Data you asked us to delete can still exist inside a backup made before your request until that backup is rotated out.

Deleting your data: log in with your email and password, then choose Delete my data in your account. That erases every reading tied to that address — the reading record, its results and sources, its list of cited pages, any fix drafts and stored CMS credentials, share links, sites and their alerts, unspent tokens, any contact messages you sent us and our replies to them, any checkout consent record not attached to a purchase, and the record of your having given us your email on a free report — and cannot be undone. It also scrubs your address out of our internal event log (see above) and adds your address to our do-not-email list: we send it nothing more about what was deleted. If you later buy again with that address, we email you about that purchase as usual.

What survives a deletion request:

  • The order record, with your email removed from it: it is our financial record. The minimized consent record attached to that order stays with it, with your email and IP removed (described above).
  • Stripe's own copy of your payment history, kept under Stripe's privacy practices, not ours. That includes the customer record Stripe holds for you. We do not close it automatically, because the order record keeps a reference to it and that reference is how we answer a payment dispute about your own purchase.
  • Our internal event log, with your email address scrubbed out of every row that carried it (see above), and backups already made, until they age out on the schedule above (roughly 14 days).
  • To have Stripe's customer record closed, ask us through Contact us; we will tell you what that means for a dispute still open on your order.

If you have a live subscription, deleting your data cancels it. We cancel the subscription with our payment provider first and delete second, so a deletion request can never leave you paying for a service that is no longer running. If we cannot confirm the cancellation, we stop and tell you rather than deleting your data while your card is still being charged.

Getting a copy instead: the same link that offers deletion also offers a download of everything we hold under your address, as a single file. It covers the same records the deletion flow covers.

Report and share URLs are unguessable but unauthenticated: anyone you send one to can open it. Changing anything, your account and Agency workspaces need a login with your email and password; we keep only a salted hash of the password, never the password itself. A 6-digit code is emailed only to verify your address when you create the account, to reset a password and to confirm a new login email. Do not forward a link you would not forward the contents of.

Cookies and tracking

Google Ads measurement. On our public pages (the home page, pricing, checkout, examples, articles and legal pages; never your reports, Fix packages, dashboard or account) we use the Google Ads tag from Google LLC to measure whether our ads lead to purchases. It may set Google's advertising-measurement cookies, such as _gcl_au, and _gcl_aw when you arrive from a Google ad. It sends Google the address of the page without its private parts. When a payment completes, the confirmation page tells Google that a purchase happened, its amount and a short order reference. It never sends your email, your website or anything from your reports. We run it with Google's restricted data processing and with ad personalisation turned off, so it measures our ads and is not used to build advertising profiles or remarketing lists. It does not load at all if your browser sends a Global Privacy Control signal. For visitors in the European Economic Area, the UK and Switzerland it runs without cookies. The same Google tag also reports page visits to our Google Analytics account, under the same limits. We use no other analytics script, advertising pixel or cross-site tracking. Our own conversion funnel is measured server-side from the first-party usage events described above.

Besides Google's measurement cookies above, four cookies exist in this product, all first-party and strictly functional, none used for tracking:

  • Admin session: a short-lived signed cookie for our own operator, set only when our own operator logs in to the admin pages. You will never receive it.
  • kv_session: keeps this browser logged in for 30 days from its last use.
  • kv_fresh: lasts ten minutes and lets you delete data, change your team or change your login email right after you log in or confirm it is you.
  • kv_pending: while you create an account, ties the 6-digit code to the browser that chose the password; removed once the account is created.

The last three are set only if you log in or create an account (optional for buying and reading your reports; needed to change them or to manage your data). They contain only an opaque account identifier, an expiry and a signature — no name, no email, no browsing data — are marked HttpOnly and Secure, are sent only to this site, and are removed when you log out. A visitor who does not log in or create an account receives none of these four.

What we do read is first-party and comes out of the request itself: if you arrive from a link that carries utm_ campaign tags, we read those tags, and we read the Referer header your browser sends and the page you landed on, so we can tell which campaign, search engine or referring site brought you. That is the same request data the "What we collect" section above already discloses (IP address, timestamps and request counts) put to one more stated purpose — measuring which channel works — and nothing about it follows you anywhere else: no cookie is set, nothing is stored in your browser, we do not read anything from a previous visit, and we do not sell it or use it for advertising. When a visit arrives carrying one of those tags or an outside referring site, we write one row into our internal event log recording the channel, the page you landed on and the same daily-rotating hashed visitor id the usage events above carry; a visit with no tag and no outside referrer records nothing at all. If you then run a reading or buy something in that visit, the same campaign and referrer fields are stored on that reading or order; we keep them for exactly as long as we keep the reading or order they are attached to (see "Retention and deletion"), and the deletion flow described there removes them along with it, while the event-log row is kept and scrubbed on the same terms as every other operational log row described above. Stripe's own checkout pages, which are hosted by Stripe and separate from ours, may use their own technologies once you leave our site, as described in Stripe's own privacy materials.

Do Not Track and US state privacy rights

We do not sell your personal information, and we do not use it for targeted advertising. The Google Ads measurement described in Cookies and tracking runs with restricted data processing and builds no advertising profile, and it does not load when your browser sends a Global Privacy Control signal.

International visitors

Kovmere is operated from the United States, and the processors listed above are US companies. If you are located outside the United States, including in the EU or UK, your information will generally be processed in the United States. We have not completed a full assessment of every cross-border data-protection requirement that may apply to a specific country, so if you require a particular data-protection commitment before you can use the service (for example, a signed data-processing agreement or a documented transfer mechanism), contact us through Contact us before you buy.

Contact

Reply to any email you have received from us, to your receipt, or use Contact us.