Pesky collects little, keeps it for a reason, and never sells it. This page says exactly what, why, and for how long. Questions: ruz@pesky.ai.

1. Who is responsible

Pesky OÜ, Tallinn, Estonia, is the data controller for pesky.ai. We are an EU company and the GDPR applies to everything below, wherever you are.

2. What we collect, and why

When you run the free scan

The website you typed, the result we showed, when, and whether it came from the cache. We keep this so a shared link shows the same card, so support can see what you saw, and so we can improve the scan.
A short anonymous visitor hash made from your IP address and browser, plus your country and city as our hosting provider reports them. We keep the hash instead of the IP address. It exists to enforce the rate limit and to spot abuse.

When you leave your email

Your email address and which plan you were interested in, when you use “notify me” or submit interest in a plan. We use it to tell you when that thing launches. Nothing else.
Your email address and the site you scanned, when you ask for a copy of a scan result. We email you that copy and add you to the launch list, which the form tells you before you press send. Reply to any email and we take you off.
Your message, if you write to us from the Contact tab, so we can reply.

When you have an account

Sign in with Google: we receive your name, email address, and profile picture from Google to create and sign you into your account. We do not ask for access to your Gmail, contacts, calendar, or files. If a future feature needs more, it will ask you separately, explain why, and you can say no. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
Email sign-in: your email address and a sign-in link or code.
What you tell the welcome guide: the name you want to be called, which persona you picked (pink or blue), and your company's website, which we scan to show you its competitors.
Your plan and billing status. Card details go straight to our payment processor; we see the last four digits and the expiry at most.
The companies you track and the reports we generate for you. That is the product.

Everyone

Product analytics, done by us: which pages you open and which buttons you press (a scan started, a result shared, a plan tapped, and so on), the domain you scanned, your screen size and browser. We record this on our own servers with the same anonymous visitor hash as the scan, so there is no analytics cookie and no analytics identifier in your browser. We use it to see what works.
Page-view counting, done by a cookie-free analytics service: which pages are opened, where visitors come from, and roughly where in the world (country level). It sets no cookie and stores no identifier in your browser; it does not follow you to other sites. The counts it produces are public: there is a Stats link in the footer of every page.
Server logs for security and debugging, kept briefly.

3. What we do not do

We do not sell personal data, and we do not share it with advertisers.
We do not build profiles of the people at the companies we scan. Pesky looks at companies and public websites.
We do not read your inbox, your files, or your private systems.

4. The legal bases

Running the scan, keeping accounts, and billing: performing our contract with you. Rate limiting, security, analytics, and improving the scan: our legitimate interest in running a small service well, balanced against your privacy, which is why the visitor hash replaces the IP address. Launch emails and anything optional: your consent, which you can withdraw by replying or clicking unsubscribe.

5. Who else sees it

Pesky runs on rented infrastructure like every small company. Categories of providers that process data on our behalf: hosting and edge network, database, email delivery, payment processing, our partner (affiliate) program, and the AI model providers that help judge which company is a competitor. Each of them acts only on our instructions under a data-processing agreement. Some are in the United States; transfers rely on the EU-US Data Privacy Framework or standard contractual clauses. Email ruz@pesky.ai for the current list of sub-processors.

To run a scan we send the website address you typed and public text about it to those providers. We do not send your email address or your account details to the AI model providers.

We share data when the law requires it, or to protect Pesky or its users from abuse.

6. How long we keep it

Scan results: one week in the cache; the scan log for up to 24 months, then deleted or anonymised.
Visitor hash, country, city: with the scan log, same period.
Launch-list emails: until the launch email is sent and you have had a chance to unsubscribe, or until you ask.
Account data: while your account exists, then 30 days.
Billing records: as long as Estonian accounting law requires, currently seven years.
Analytics events: 12 months.

7. Your rights

You can ask us what we hold about you, get a copy, correct it, have it deleted, restrict or object to how we use it, and take it elsewhere. Email ruz@pesky.ai; we answer within 30 days and we do not charge for it. If you are unhappy with our answer you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the authority where you live.

8. Cookies

pesky.ai sets no advertising cookies and no analytics cookies or identifiers — the page-view counter above works without either. The cookies it does use:

Signing in: the technical cookies needed to keep you signed in when you have an account.
Partner referrals: the cookie banner covers it (see below). Say yes, and our partner-program provider sets a cookie that remembers which partner's link brought you, so they are credited if you subscribe. It holds the partner's referral code and when you arrived, not who you are, and expires at the end of the program's referral window. If you subscribe, that code goes with your subscription to our payment processor and the partner program, which then sees that a referred customer subscribed, and whether they later cancel. Say no and the partner program's script never loads and sets nothing.

The cookie banner covers both optional things: that cookie and the page-view counter in section 3. In the EU, the EEA, the UK and Switzerland (and wherever we can't tell where you are), neither loads until you say yes. Elsewhere the banner shows first and they load once you carry on browsing, unless you say “No thanks”, which also stops both at any time after; if your browser sends Global Privacy Control, we treat it as a no without asking. We only use the country your connection comes from to decide this, and keep nothing.

Your answer is kept in your browser (not a cookie) so you aren't asked on every page. Change it any time: . Your browser's settings also let you block or clear cookies; the site keeps working, the scan included.

The home page shows three “Featured on” badges, served by the directories that list us (fazier.com, twelve.tools and tinystartups.com). Like any image hosted elsewhere, your browser fetches them from those sites, which see the request. We share nothing with them.

9. Children

Pesky is for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If you think we have, email us and we will delete it.

10. Changes

If this policy changes in a way that matters, we email account holders before the change takes effect and move the date at the top. Old versions are available on request.

11. Contact

Pesky OÜ, Tallinn, Estonia. ruz@pesky.ai.