Privacy Policy

1. Who we are

UserPath is a product analytics service operated by Intenseloop ("we", "us"). Write to [email protected] with any question about this policy.

We handle personal data in two roles:

• For your account (your sign-in, your workspace, the waitlist, your questions to Ask), we decide what is collected and why: we are the controller.
• For the visitors of the sites and apps you track with UserPath, and the people you email with Campaigns, you (our customer) decide what is collected and why: you are the controller and we process that data for you.

2. Signing in with Google

Google is the only way to sign in, on the website and from the CLI or an MCP client. We ask Google for the basic sign-in scopes only (openid, email and profile) and receive your Google account id, your verified email address, your name and your profile picture. We don't receive your Google password or access to any other Google service, except read-only Search Console when you connect an app to it, and sending email from Gmail when you connect it to the Inbox add-on (section 3).

If you are let in, we use these details to create your account, sign you in, and show who you are to you and to the other members of your workspaces. While UserPath is in early access, most people join a waitlist instead: we keep your email, name, Google account id and when you joined and signed in, only to let you in and to tell you when UserPath opens.

3. Google user data

If you connect Google Search Console

An admin can connect an app to Google Search Console. We then ask Google for read-only access to Search Console and receive the properties that Google account can read and, for the one you pick, clicks, impressions and positions by day, page, search query, country and device, and the index status of the app's pages. These are totals Google computes; they identify no visitor.

We show this data only to the members of the app's workspace, next to the app's own analytics, and Ask can read it when a member asks about the app. We keep the access token encrypted, and the Google account's email and name to show who connected it. Disconnecting deletes the token and the imported data, and revokes our access at Google unless that Google account is still connected to UserPath elsewhere (Gmail replies, or another app).

If you connect Gmail to send replies

With the Inbox add-on, a member can connect their Google account so the replies they write in UserPath go out from their own Gmail address. We then ask Google only for permission to send email on their behalf (gmail.send): UserPath can't read, search, change or delete anything in the mailbox. Incoming mail reaches UserPath only through forwarding the member sets up in Gmail (section 7).

UserPath sends a message only when a member sends a reply they wrote or approved, from their address or one of the addresses Gmail lets them send as. Gmail keeps it in their Sent folder, and we keep it with the conversation (section 7). We keep the access token encrypted, and the Google account's email to show who connected it. Disconnecting deletes the token, and revokes our access at Google unless that Google account is still connected to UserPath elsewhere (Search Console, or another app's replies).

Limited Use

UserPath's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use the data we receive from Google (sections 2 and 3) only to sign you in, run your account and workspace, manage the waitlist, show a connected app's search performance to its workspace, and send the replies members write from their connected Gmail.
• We don't sell it, we don't use it for advertising, and we don't use it to develop, improve or train AI or machine learning models.
• We don't transfer it to anyone, except the providers that run UserPath for us (section 12), when the law requires it, or as part of a merger or acquisition with notice to you.
• People don't read it unless you ask us to (for example in a support request), it's needed for security or to comply with the law, or it's aggregated and anonymous for running the service.

You can remove UserPath's access at any time from your Google account's third-party connections, and ask us to delete what we already have (section 15).

4. Backlinks

The Backlinks page shows who links to an app, from the app's own analytics and from public web data. An admin can add a Bing Webmaster Tools key, which we keep encrypted and use only to read the links Bing found to the app's site. The Backlinks add-on and domain ranks come from DataForSEO, to which we send only public domain names and the app's home page address. Neither receives anything about your visitors or members.

To check an app's pages for common SEO problems, our crawler UserPathBot reads the app's own public pages about once a day, as any visitor could. It follows robots.txt, signs in nowhere and reads no personal data.

5. AI search and Outreach

AI search

With AI search on, UserPath asks AI answer engines (ChatGPT, Gemini, Google's AI, Perplexity and, if an admin turns it on, Claude) the questions an app's team tracks, every week, from the countries the app measures, and keeps their answers. The questions and the country go to DataForSEO (for ChatGPT, Gemini, Google and Perplexity) and to Anthropic (for Claude). To read the answers and check what they say about the app, Google's Gemini models receive each answer, the app's name, domain and brand terms, its competitors, the facts the team pins about the app and the text of the app's own public pages. Cloudflare's AI gateway carries what we send to Anthropic and Google. Once a month, DataForSEO also receives the app's domain, its competitors' domains and the topics of its questions, to find other questions people ask AI engines about them.

We keep the answers, the brands they name, the addresses of the pages they cite and the claims they make about the app. UserPathBot reads the public pages answers cite about once a week, the way it reads the app's own pages (section 4). No personal data about your visitors or members is sent to answer engines or to these providers: only the questions you track, the app's and its competitors' names and domains, its public pages and the addresses of cited pages.

Outreach

Outreach helps a team ask the people who run the pages AI answers cite to mention the app, and reach people the team adds by hand by their email address or their handle on X, Bluesky, Mastodon, LinkedIn or Reddit, or finds through public posts that match phrases the team picks. To find whom to write to about a page, we read those sites' public pages (bylines, about and contact pages) and keep only addresses a page shows. When a page shows several, Google's Gemini models receive the page's address and title, the author's name and those addresses with a few words around each, to pick one. A member chooses each email and sends it, from an address on a subdomain of the app's domain or their connected mailbox. Members can connect social accounts, their own or the app's, on X, Bluesky, Mastodon, LinkedIn and Reddit; the networks they connect receive what they send through them (messages, replies and posts) and the searches they turn on. Drafts Ask writes for them send the page or the person (their name, handles and page), why it was picked, the team's note, the contact, the facts the team pins and the emails so far to Anthropic (section 8).

We keep the names, email addresses and handles of the people contacted, the team's notes about them, the public posts that suggested them, whether someone the team added later signed up to the app with their email address, whether someone who followed a link in an outreach message visited the app, signed up or paid, the emails and social messages sent and the replies, the messages and answers members note they sent or received outside UserPath, whether each was delivered, bounced, marked as spam or opened, and unsubscribes. SparkPost sends and receives this email. Every email carries the sender's name, the business name and postal address of the workspace, and a one-click unsubscribe. An address that unsubscribes, marks an email as spam or bounces is never emailed by Outreach again, from any app, and an unsubscribe also takes it off that app's campaigns.

6. GitHub

An admin can connect GitHub to an app so Ask can read the code behind it and propose fixes as pull requests. You choose which repositories UserPath can reach, on GitHub, and can change that or uninstall it there at any time. Ask reads code only in conversations where you turn GitHub on, and writes only when a member confirms a change it drafted: it opens a pull request on a new branch for you to review, and never merges or writes your default branch. If your team has a computer, git on it can clone, pull and push the repositories linked to your apps, with a key UserPath gives it for one repository at a time, good for an hour. A push asks a member first unless your team allowed it.

We store which GitHub account and repositories are connected, the changes Ask drafts and the pull requests they became, but never a GitHub token. Code Ask reads is sent to Anthropic with your question (section 8), and the chat keeps an excerpt of it until you delete the chat. For billing we record each use of a repository (who, which repository, what kind of use and when), without file contents. Disconnecting removes the connection from UserPath; pull requests it opened stay in your repository until you close them.

7. Data our customers collect with UserPath

Our customers add the UserPath script or SDK to their sites and apps, or send events from their servers. For their visitors, UserPath records:

• Pages: the address, title and referrer.
• Device: browser, operating system, device type, screen size, language, time zone and whether software drives the browser.
• Network and location: the IP address, the network it belongs to (to tell cloud servers from people) and the approximate location derived from it (down to city).
• Interactions: clicks, scrolling, form use (never the text typed into a field or anything from password fields), video play and pause, and whether the page is visible.
• Errors and performance: JavaScript errors, page load timings and Core Web Vitals.
• Custom events and revenue: the events and properties the customer chooses to send, including prices. When the customer connects Stripe, payments also come from there (see below).
• People: when the customer identifies a signed-in user, the id, name, email, picture and properties the customer sends.
• Email: with the Inbox add-on, email the customer forwards to UserPath from their mailbox. We keep an email (its sender, recipients, subject, text and attachments) when it was sent to the customer's support address or is with someone they identified, and discard the rest when it arrives, and the replies sent from UserPath with their attachments. A file too large to keep is recorded only by its name, type and size. Members who turn on Inbox notifications get who wrote and the start of their email by email, and in the browsers they turn notifications on in, encrypted so only that browser can read it. A member who replies to a notification email answers from it: what they wrote goes out (or is kept as a note) like a reply sent from UserPath, without the email it quoted.
• Sending replies: besides a connected Gmail (section 3), a member can connect their Microsoft account (Outlook or Microsoft 365). We then ask Microsoft only for permission to send email as them and to stay connected: UserPath can't read, search, change or delete anything in that mailbox. A reply goes out only when the member sends it, Outlook keeps it in their Sent Items, and we keep the sign-in token encrypted and the account's email to show who connected it. Disconnecting deletes the token; Microsoft doesn't let apps hand access back, so the member also removes UserPath in their Microsoft account. Replies can also go out through UserPath's email from the customer's support address, once the customer adds a DNS record to its domain, with a copy to their mailbox; for these, we keep whether each was delivered, delayed, bounced (with the receiving server's reason) or marked as spam. Or a member can send through their own outgoing mail server: we keep its address, their username and their password, the password encrypted and used only to send that member's replies.
• After a reply: unless the customer turns it off, a reply carries a tiny image, and links in it to the customer's site carry a code naming the reply. We keep how often and when a reply was opened, and each visit through its links (the page and the visitor's random id). The address and browser that load the image tell a person opening it from a mail server fetching it, and aren't kept. A visit through a link doesn't identify the visitor. So the team's own opens don't count, we keep a keyed hash (not the address) of the networks each member used UserPath from in the last 30 days.
• Chat: when the customer turns on the chat on their site, we keep what visitors write in it and the team's replies, like email, with the visitor's random id, the email they choose to leave and when their chat window last showed the chat. Their browser keeps a random token for the chat in local storage. A reply they haven't seen within 10 minutes is emailed to them when they left an email or the customer identified them.

To tell visits apart, the script keeps a random id in a first-party cookie and local storage for up to a year. Traffic from crawlers and other bots is labeled as such.

Campaigns

With Campaigns, a customer emails news to the subscribers of an app. For each subscriber we keep their email address and name, how they agreed to get email (they signed up, bought from the app, have an account with it, or are on a list the customer imported), where they signed up or which list they came from, and the details the customer adds about them. Every campaign carries the business name and postal address of the workspace, why the person gets it and a one-click unsubscribe.

For each recipient we keep whether the email was delivered or bounced (with the receiving server's reason), when it was opened and which links were clicked, with the browser, IP address and approximate country of each open and click, to tell people from mail servers and link scanners. Links to the customer's own sites carry a code naming the recipient, so their visits through those links are kept with the visitor's random id. Unsubscribes are kept for each app and also stop Outreach email to that address, and nobody who unsubscribed is added back by an import or a sync. An address that bounces for good or reports an email as spam is blocked for every app. SparkPost sends campaigns and tells us what happened to each email. Images in campaigns are stored on our content delivery network, run by Cloudflare.

An app's signup form sends us the email address and name a visitor typed, the form they used and their browser's random id. We add them to the app's subscribers and record the signup as an event of that visit. Anyone can type any address, so the name and email are kept only as an unverified claim about that browser, not as who the visitor is.

Connections

An admin can connect an app's own database, or a web address that lists its people, to keep its subscribers in sync. UserPath reads it on a schedule, read-only, from UserPath's own server addresses, which the customer can allow in their firewall. It keeps the fields the customer's query or list returns: people's email addresses and names, their id in the app, whether and when they signed up or opted out, and any other fields as details about each person. We keep the database password or the header sent to the web address encrypted, and a log of each read (how many people were read, added, updated or left, and any error). Removing a connection deletes its credentials and its log. The people it brought in stay, with their opt-outs.

If a customer connects Stripe

An admin can connect an app's Stripe account on Stripe's page. UserPath only reads it. We then receive the account's name and, on a schedule, its customers' email addresses and names, their payments and refunds, their subscriptions and the products they're for. For each person, matched to the app's subscribers by email, we keep whether they paid, whether they were refunded, what they paid in total, their subscription's status and plan and when they first paid. We don't keep card or bank details. People who bought get the app's campaigns only while the customer leaves "Customers get product news" on; otherwise Stripe only adds these details to people already subscribed. We keep no Stripe password or token for the account. Disconnecting stops the reads; disconnecting UserPath in Stripe also revokes its access there.

Each customer controls this data. A customer can turn off kinds of automatic events, honor Do Not Track and Global Privacy Control signals, block IP addresses, and export or delete everything stored about one visitor. Customers are responsible for telling their visitors about UserPath, for getting consent where the law requires it, and for emailing only people who agreed to hear from them. If you visited a site that uses UserPath, or get its campaigns, and want to exercise your rights, contact that site (every campaign has an unsubscribe link); we'll help them answer.

8. Ask, the assistant

Ask answers questions about an app's analytics. To answer, it sends your question, the chat so far and the reports it runs to Anthropic's Claude API. Those reports can include the visitor data described in section 7, and code when GitHub is on (section 6). Ask doesn't send your own account details.

With the Inbox add-on, a member can have Ask draft a reply or summarize a conversation. That sends the conversation (the emails and the team's notes), who the person is (name, email, plan, payments) and what they did on the app around their emails to Anthropic. We keep a conversation's summary until a new email arrives, and saved replies until a member deletes them.

We keep your chats until you delete them or the app or workspace they belong to, and record how much each answer used, without its content, to meter usage. Changes Ask suggests only happen when you confirm them.

A routine is an Ask question you schedule. It runs as the person who created it or last changed it, with their access, and every member of the workspace can see its name, prompt, schedule and a short summary of each run; the full answers stay in that person's private chat. If they turn email on, we email them a summary after each run.

Agents are assistants a workspace sets up to do work for it on its own computer in the cloud: a desktop with a web browser, a shell and files. What an agent reads and does there (the pages it opens, the files it works with, what it runs) and the messages in its thread are sent to Anthropic to decide its next step. Members can watch the computer's screen and use it, so sign-ins made on it stay on its disk. We keep an agent's thread until the agent is deleted, the computer's disk until the workspace turns it off, and a picture of its screen from when it last went to sleep. We record how long the computer runs and what each agent's work used, to meter usage.

9. Our own analytics

We use UserPath on userpath.app, the same way our customers do (section 7). When you sign in or join the waitlist, we link your visits to your account or waitlist entry, and we record key actions such as joining the waitlist, contacting support and sending feedback.

10. Support and feedback

When you contact support from the app, we store your message with the context needed to understand it: the page you were on, the error you hit, your browser and, if you leave it on, a screenshot. When you or an agent working for you sends feedback from the CLI or MCP, we store it with basic details about the tool that sent it. We never attach passwords, sign-in tokens or what you typed into a page. We email both to our support inbox and reply to the email you signed in with.

11. Cookies and local storage

userpath.app uses only the cookies it needs, plus those of our own analytics. None are used for advertising.

• Sign-in: keeps you signed in (up to 30 days), and checks that a sign-in or a Search Console, Gmail, Microsoft, GitHub or Stripe connection is the one your browser started (minutes).
• Waitlist: your first name and email for the confirmation page (one day).
• Preferences: the app, workspace, period and filters you used last (up to a year).
• Analytics: our own analytics (section 9, up to a year).

The app also keeps preferences such as your theme, and a copy of reports you viewed so pages load faster, in your browser's storage.

If you turn on browser notifications, the app installs a service worker in that browser to show them, and we store the browser's push subscription (its address at the browser maker's push service and the keys to encrypt notifications for it) and which browser it is.

12. Where data is stored and who handles it

UserPath is hosted in Germany (EU), and we keep backups under our control. These providers handle data for us:

• Hetzner: hosting, including each workspace's computer for agents (section 8).
• Cloudflare: network, security, approximate location from IP addresses, the gateway AI search and Outreach reach AI models through (section 5), and the content delivery network that stores and serves images in campaigns (section 7).
• Google: sign-in, Search Console and sending replies from a connected Gmail (sections 2 and 3), and the Gemini models that read AI search's answers and find Outreach's contacts (section 5).
• Anthropic: the AI behind Ask and agents (section 8), and Claude's answers in AI search (section 5).
• GitHub: repositories you connect (section 6).
• SparkPost: email, including the email customers forward to UserPath, members' replies to notification emails, the replies sent through UserPath's email (chat replies emailed to a visitor among them) and whether each was delivered (section 7), Outreach's email (section 5), and campaigns and what happened to each email (section 7).
• Stripe: customers, payments, refunds, subscriptions and products of a Stripe account a customer connects (section 7).
• Statuz: Intenseloop's social publishing service, for Outreach (section 5): the social accounts you connect, the messages and replies sent through them, the searches for posts you turn on, and replies received.
• Apple, Google, Microsoft and Mozilla: their browsers' push services deliver the notifications you turn on (sections 7 and 11).
• Microsoft: sending replies from a connected Microsoft account (section 7).
• Microsoft (Bing Webmaster Tools): backlink data (section 4).
• DataForSEO: backlink and keyword data (section 4), and AI search's answers from ChatGPT, Gemini, Google and Perplexity and its index of AI answers (section 5).

We don't sell personal data and we don't share it with advertisers. We disclose it only to these providers, when the law requires it, to protect our rights or our users' safety, or to a buyer if UserPath is sold or merged, under this policy.

13. Security

Every connection to UserPath is encrypted, credentials for connected services are stored encrypted, and every request is checked against what the caller may access. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

14. How long we keep data

• Account data: while your account exists.
• Waitlist entries: until UserPath opens to you or you ask us to remove you.
• Chats: until you delete them, or the app or workspace they belong to.
• Analytics events: there is no automatic expiry yet. Customers can ask us to erase an app's events.
• Search Console, backlink and GitHub data: while the app is connected to them or exists. Usage records for billing are kept after that.
• AI search's questions, answers and the checks of the pages they cite: while the app exists. Usage records for billing are kept after that.
• Outreach's contacts, emails, social messages and their delivery: while the app exists. Addresses that unsubscribed, marked an email as spam or bounced are kept so Outreach never emails them again.
• Campaigns' subscribers, the campaigns and what happened to each email: while the app exists. Unsubscribes stay with the app, and addresses that bounced for good or reported an email as spam are kept so no app emails them again.
• A connection (a database, a web address or Stripe), its encrypted credentials and its log: until it's removed or the app is deleted. The people it brought in stay among the app's subscribers.
• A Gmail or Microsoft connection for sending: until the member disconnects it or leaves the workspace.
• A member's own mail server for sending, with its password: until they remove it or leave the workspace.
• A browser's notification subscription: until you turn that browser off, or its push service says it's gone.
• Support requests and feedback: no automatic expiry yet; ask us and we delete them.
• Cookies: as listed in section 11.

15. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct data that is wrong or incomplete;
• Delete your data, including your account or your place on the waitlist;
• Get a copy in a portable format;
• Restrict or object to some processing;
• Withdraw consent where we rely on it.

To use any of them, including leaving the waitlist or deleting your account, email [email protected] from the address you signed in with. You can also complain to your local data protection authority.

In the European Economic Area and the UK, we process your data to provide the service you asked for (contract), for our legitimate interests in running, securing and improving it, with your consent where we ask for it, and to meet legal obligations. In California, you have the right to know, delete and correct, and not to be discriminated against for using these rights; we don't sell or share personal information for advertising.

16. International transfers

UserPath is hosted in Germany. Cloudflare, Google, Anthropic, GitHub, SparkPost, Stripe, Microsoft, Apple, Mozilla and DataForSEO may process data in other countries, including the United States. Where the law requires a safeguard for these transfers, we rely on the ones these providers offer in their terms.

17. Children

UserPath is for people 18 and older. We don't knowingly collect data from anyone younger. If you think a child has given us personal data, write to us and we'll delete it.

18. Changes to this policy

When this policy changes, we'll post the new version here and update the date at the top. For material changes, we'll also email account holders at least 30 days before they take effect.

19. Contact

Privacy questions and requests: [email protected]. The rules for using UserPath are in the Terms of Service.