Privacy policy

Who we are

Tailwin is operated by Girard Media (“we”, “us”). For anything in this policy, write to sgirard@girardmedia.com.

We act in two roles. For visitors to tailwin.com and for our customers, we are the data controller. For measurement tools our customers install on their own websites (the crawler tracker, the visitor pixel, the scan widget, the concierge widget), we process data on the customer’s behalf and the customer is the controller. If you visited a site that uses Tailwin and want your data handled, contact that site’s owner first; we assist them with every request.

What we collect from customers and visitors

• Account data. Name, email, and password hash, or your Google account identifier if you sign in with Google. Session cookies keep you signed in.
• Billing data. Payments run through Stripe. We store your plan, subscription status, and Stripe customer reference. We never see or store card numbers.
• Free scan leads. If you run the free AI visibility scan, we store the domain you scanned and the scan result. If you ask for the emailed report, we store the email you provide, and any name, company, phone, or role you choose to add.
• Support and correspondence. Emails you send us.

What our tools collect on customer sites

• Crawler tracker. Records visits by known AI crawlers only: user agent, path without query strings, response status, and country. No cookies, no request bodies, no personal data.
• Visitor pixel. Records human page views: path, title, referrer, and campaign tags. It sets one first-party cookie holding a pseudonymous visitor id, which we store only as a peppered hash. Raw IP addresses are never stored: the address is held briefly in a resolution queue, used to look up the visiting company, then cleared; what remains is a peppered hash. Company lookup uses the providers listed below. Person-level contact details (a name, work email, or title associated with the visiting company) are collected only when the site owner has explicitly enabled that feature, and are stored separately so they can be deleted wholesale on request without destroying visit statistics.
• Scan widget and concierge widget. Collect what a visitor types into them, including an email address if offered. Concierge conversations pass through automatic redaction that strips secrets before storage.

AI processing

The product’s core function is asking AI engines questions about brands and measuring the answers. Scan queries contain the scanned domain, brand names, and buyer-style questions. They do not contain your account data, your billing data, or your site visitors’ data. Queries are processed by the engine vendors listed below, in some configurations through the OpenRouter gateway. Content drafting features send only the material you ask us to work on.

Service providers

We use these providers to run the service. Each receives only what its function requires: Stripe (payments), Resend (email delivery), Cloudflare (DNS, TLS, content delivery, object storage), Hostinger (server hosting; the databases run on servers we operate ourselves), OpenAI, Anthropic, Google, Perplexity, and xAI (AI engines, directly or via OpenRouter), DataForSEO (search result data). When a site owner enables visitor identification: Happierleads, Snitcher, or Opensend, which receive the visitor’s IP address solely to resolve the visiting company.

Anonymized benchmarks (opt-in)

Workspaces can opt in to contribute measurements to anonymized, aggregated industry benchmarks, such as the median AI-visibility score for an industry. The setting is off by default and controlled by workspace owners and admins in Settings. Aggregates never include names, domains, content, or anything that identifies a business, and are only computed across groups large enough that no contributor can be singled out. Opting out stops future inclusion immediately.

Retention

Measurement history (visibility scores, crawler visits, search positions) is the product, and customers rely on it staying available, so we retain it for the life of the account and delete it when the account is deleted. Free scan leads are retained until you ask us to remove them. Raw visitor IPs are cleared within about a minute of collection, as described above.

Your rights

Depending on where you live (including under GDPR and CCPA), you can ask for access to your data, correction, deletion, a portable copy, or restriction of processing. Email sgirard@girardmedia.com and we will respond within 30 days. We do not sell personal information. If your data reached us through a customer’s website, we will route your request to that customer and help them fulfil it.

Cookies

The full list of cookies and trackers, on tailwin.com and in the embeddable tools, lives in the cookie and tracking notice.

Changes

When this policy changes materially we update the date above and, for account holders, say so by email. Questions and complaints: sgirard@girardmedia.com.