Privacy Policy
Last updated: 3 November 2026
This Privacy Policy explains how Baseline Labs ("Baseline Labs", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit baselinelabs.ai and markupschema.com (the "Sites") or use our products and APIs (the "Services"). It also describes the rights you have over your personal data and how to exercise them.
This document is provided for transparency and is pending final legal review. If anything here conflicts with a signed agreement between us, that agreement prevails.
This document is written in English. Translations into other languages are produced by machine and are provided for convenience only; they have not been reviewed by a lawyer. Where a translation differs from this English text, this English text governs.
1. Who we are
Baseline Labs provides generative-engine-optimisation (GEO) and structured-data tools that help businesses understand and improve how AI models and search engines represent them. For the purposes of the General Data Protection Regulation (GDPR) and the UK GDPR, Baseline Labs is the data controller for personal data processed through the Services. Baseline Labs is based in Galway, Ireland. You can reach us at info@baselinelabs.ai.
2. The data we collect
Information you provide
- Account data - your name, email address, and password (stored only as a salted hash) when you register.
- Social sign-in data - if you register or sign in with Google or GitHub instead of a password, that provider sends us your email address, whether the provider has verified it, and your display name (from GitHub, also your username). We never receive your password for that account. We store the provider name and your identifier with them so we can recognise you next time you sign in.
- Google Search Console and Google Analytics data - if you connect a Google account to one of your sites, we ask Google for read-only access to Search Console and, only if you add it, Google Analytics. We store the email address of that Google account, an encrypted token that lets us keep reading the properties you choose, and the data we import from them: daily clicks, impressions and average position, the search queries and pages behind those figures, and sessions and users by traffic source. We use this data only to show it to you and your team inside Baseline Labs, next to our own measurements of the same site. We do not sell it, use it for advertising, use it to train AI models, or share it with anyone else. You can disconnect at any time from your site page or from your Google account security settings. Disconnecting revokes our access and stops every further import. Imported figures are kept for up to 16 months and are deleted when you remove a site Google link.
- Billing data - your subscription tier and the payment metadata returned by our payment processor. We never see or store full card numbers; card details are handled directly by Stripe.
- Content you submit - the domains, URLs, keywords, brand names, and study configurations you enter to run audits and reports.
- Support communications - the contents of messages you send us by email or through contact forms.
Information we collect automatically
- Usage and device data - pages viewed, actions taken, approximate location derived from IP address, browser and device type, and referring URLs.
- Anonymous audience counts - we count page views before and after cookie consent to understand use of the Sites. We keep the hour, site host, page path without ordinary query parameters, referring host, UTM source, medium, campaign, term and content, whether the link carried a known ad click parameter (never its value), traffic channel and AI source, browser family, device class and whether the request appears to be a bot. This count uses no cookies, browser storage, fingerprint, IP address or hash, full user agent, visitor identifier or session identifier. We cannot link these counts to each other or to an account. We rely on legitimate interests in understanding our audience, keep counts for 13 months, and skip this count when your browser sends Global Privacy Control.
- Visit analytics - only if you accept the "Analytics" category in our cookie banner. Our own tracker, which runs on our servers, records the pages you view on the Sites, the website, search engine or ad that sent you (including any campaign tags and ad click identifiers in the link), your browser, operating system, device type, screen size and language. It keeps a random visitor identifier and a session identifier in two first-party cookies. We do not store your IP address or your full user agent with these records. To tell repeat requests apart within a day we keep a one-way hash of them, made with a key that is destroyed every 24 hours. If you go on to create an account or buy a plan, we link your earlier visits to your account so we know which ad, link or search brought you, and we record the plan and amount of your first payment. Until October 2026 we used the self-hosted tool Umami for this. We have moved that history into our own system, where it follows the same rules.
- Google Analytics 4 - loads on every page in a mode that sets no cookies and sends Google only basic, unidentified measurements. It sets its own cookies only if you accept "Analytics", and stores ad click identifiers only if you accept "Advertising".
- Session recordings - only if you accept "Analytics". Our own recorder, built on the open-source rrweb library, records how a page is used: its layout and text, clicks, scrolling and navigation. Nothing you type into a form field is recorded, payment card fields are not recorded at all, and long strings that look like passwords, keys or tokens are blanked out. Text shown on the page is recorded, including your email address if the page displays it. If you are signed in, the recording is linked to your account so we can reproduce a fault you report. We also keep your browser's user agent and the network block your request came from (explained under "Bots and crawlers" below). Recordings stay on our servers and in our own Cloudflare R2 storage, are never sent to an analytics company, and are deleted after 30 days. Until October 2026 we used OpenReplay, another self-hosted recorder. It has been switched off and its recordings deleted.
- Advertising measurement - only if you accept the "Advertising" category. We load the LinkedIn Insight Tag and the ChatGPT Ads tag from OpenAI so that LinkedIn and OpenAI can tell us which of our ads led to a visit or a signup. Both companies receive data about your visit and handle it under their own privacy policies.
- Logs - request logs and error logs that help us operate the Services securely and diagnose problems.
Traffic reporting on our customers' websites
A customer can install our tracker, WordPress plugin, Cloudflare worker or server module on their own website so that it reports visits to that website to us. For these records the customer is the controller and we process the data on their behalf.
- Bots and crawlers - for a request made by a bot, we store the page requested, the time, the response status, the user agent the bot sent, and the network block the request came from together with the name of the organisation that operates that network. A network block is the first three parts of an IPv4 address (a range of 256 addresses) or the first 48 bits of an IPv6 address. It identifies a network, not a device or a person. We never store the full IP address: the plugin reduces the address to its block on the customer's server before anything is sent, and where another channel sends the address, we reduce it on arrival and discard it. We use the block to check whether a bot really came from the company it names, and whether repeated visits came from the same network. Bot visit records are deleted after 90 days.
- People - for a person visiting the customer's website, the tracker records the page viewed, the referring website, the browser's user agent and a random visitor identifier kept in the browser's local storage (or in a first-party cookie where local storage is unavailable). No IP address is stored with these records, and the identifier is never used across different websites.
3. How we use your data
- To provide, maintain, and improve the Services and run the audits you request.
- To create and administer your account and process your subscription.
- To communicate with you about your account, security, service changes, and (where you have opted in) product updates.
- To monitor, secure, and troubleshoot the Services and prevent abuse.
- To comply with our legal obligations.
4. Legal bases for processing
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Services and your account | Performance of a contract |
| Billing and fraud prevention | Performance of a contract; legitimate interests |
| Security, logging, and service improvement | Legitimate interests |
| Anonymous audience counts | Legitimate interests |
| Consented visit analytics, session recordings, and advertising measurement | Consent, which you can withdraw at any time |
| Remembering which ad you clicked, so the page you land on shows what the ad offered | Legitimate interests |
| Meeting legal and tax obligations | Legal obligation |
5. Cookies and analytics
Cookies in the "Strictly necessary" group are always on, because the Sites do not work without them. Optional cookies stay off until you choose them in our cookie banner, and you can change your choice at any time:
Turning "Analytics" off stops our consented tracker and recorder straight away and deletes their cookies from your browser. The anonymous page count continues without cookies or identifiers.
| Cookie | Group | What it is for | How long it lasts |
|---|---|---|---|
session | Strictly necessary | Keeps you signed in | Until you sign out, or 3 days |
cc_cookie | Strictly necessary | Remembers your cookie choices | 6 months |
bl_lead | Strictly necessary | Remembers which of our ads you clicked, and nothing else, so the setup page can show what the ad offered after you sign in with Google or GitHub | 1 day |
bl_vid, bl_sid | Analytics | Random visitor and session identifiers for our own visit analytics | 1 year and 30 minutes |
bl_utm, bl_anon | Analytics | The link that first brought you here, and a random identifier for actions such as signing up, so we can tell which sources lead to customers | 30 days and 1 year |
_ga, _ga_* | Analytics | Google Analytics 4 | Up to 2 years |
| LinkedIn and OpenAI cookies | Advertising | Set by the LinkedIn Insight Tag and the ChatGPT Ads tag to measure our ads | Set by those companies. See their own cookie policies |
Session recordings also keep an identifier for the current tab in your browser's session storage, which is cleared when you close the tab.
6. Sharing and sub-processors
We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, including:
| Provider | Purpose |
|---|---|
| Stripe | Payment processing |
| Mailgun | Transactional and account email |
| Google (Sign in with Google) | Social sign-in, if you use it |
| GitHub (Sign in with GitHub) | Social sign-in, if you use it |
| Google Analytics | Aggregate usage analytics |
| Google Search Console and Google Analytics APIs | Reading your own search and analytics figures, if you connect them |
| LinkedIn (Insight Tag) | Measuring our LinkedIn ads, only if you accept "Advertising" |
| OpenAI (ChatGPT Ads tag) | Measuring our ChatGPT ads, only if you accept "Advertising" |
| Cloudflare | DNS, CDN, TLS, and object storage (R2) |
| DataForSEO & OpenRouter | Search and AI-model queries used to run audits |
| Apify | Running the AI-search queries behind fan-out audits, using the domains and keywords you submit |
| Vast.ai | Rented GPU instances that analyse the page content we crawl for you |
| Google Fonts | Serving webfonts; receives your IP address when a page loads |
| jsDelivr | Serving icon and flag stylesheets; receives your IP address when a page loads |
We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety, and property of Baseline Labs, our users, or others.
Baseline Labs use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. International transfers
Our core application and database are hosted in the European Union. Some processing happens outside it, and we would rather say so than round it off. GPU inference - where the page content we crawl for you is analysed - runs on instances we rent through Vast.ai, which sit wherever capacity is available and are not pinned to a region, so they may be outside the EEA. Object storage (Cloudflare R2) is a globally distributed service, so crawled page content, screenshots, and generated schema may be held outside the EEA. Several of the sub-processors listed above are also established outside the EEA.
If you need the transfer safeguards that apply to a specific provider in writing, email info@baselinelabs.ai and we will send you what is in place.
8. Data retention
We keep personal data for as long as your account is active and as needed to provide the Services. Audit results and study data are retained until you delete them or close your account. Some records have fixed limits:
- Visit analytics records: 13 months.
- Session recordings: 30 days.
- Bot visit records on our customers' websites: 90 days.
- Imported Google Search Console and Google Analytics figures: up to 16 months.
- The record of which source brought you to us and your first payment: as long as your account exists.
We may retain certain records longer where required for legal, tax, security, or dispute-resolution purposes, after which the data is deleted or anonymised.
9. Your rights
Subject to applicable law, you have the right to access, correct, delete, or port your personal data; to restrict or object to certain processing; and to withdraw consent at any time. To exercise any of these rights, email info@baselinelabs.ai. That includes having us delete the visit records and session recordings linked to your account or email address. Because we are based in Ireland, our lead supervisory authority is the Irish Data Protection Commission (DPC), dataprotection.ie. You can complain to the DPC, and you also have the right to lodge a complaint with the data-protection authority of the country where you live or work, or where you believe the problem occurred.
10. Security
We use technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), hashed passwords, access controls, and network isolation between services. No method of transmission or storage is completely secure, but we work continuously to protect your data.
11. Children
The Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notifying you directly.
13. Contact us
Questions about this policy or your personal data? Email us at info@baselinelabs.ai.
