AI Overview Optimizer

GDPR overview

GDPR treatment is unusually concrete for a product this young. The privacy policy runs to twelve sections and dedicates one entirely to data subject rights, listing access, rectification, erasure, restriction, objection, portability and withdrawal of consent, with a stated response time of one calendar month. Three lawful bases are invoked by name: contract performance for account, audit and billing data, legitimate interest for security and performance, and consent for any marketing. Transfers out of the EEA are covered by EU Standard Contractual Clauses, a copy of which is available on request. The supervisory authority is named explicitly as the Irish Data Protection Commission, with its website and mailbox. Both the privacy policy and the terms carry an effective date of 1 August 2025. No data protection officer is named, and no Article 27 representative appears, which is consistent with an Irish-established company.

Who owns the data?

Fat Frog Ventures Ltd, registered in Ireland, is named as the data controller. Users keep every right to the URLs and page content they submit; the publisher takes only a limited, non-exclusive licence to fetch and process that page for the sole purpose of generating the audit. Audit reports belong to the customer for internal business use and may be shared with clients as part of professional services, but may not be resold or commercially distributed as a standalone product. The company states plainly that it never sells personal data to any third party. No postal address is published, and a single mailbox, contact@overviewoptimizer.com, serves legal, privacy and support enquiries alike.

Reuse rights

Six purposes are listed: delivering audit results and history, creating and managing accounts, processing subscription payments and receipts, answering support requests, enforcing monthly usage limits, and detecting fraud or abuse while monitoring performance. The raw content of an audited page is not kept beyond the duration of the audit request; what is stored is the submitted URL, the score and the full result. Server logs covering IP address, browser and pages visited are retained for security only, and the policy states expressly that they are not used for advertising profiling. Marketing messages require explicit opt-in consent that can be withdrawn at any time. Customers may reuse their own audit reports freely inside their business and with their clients, but not as a resold product.

Data retention & training

Hosting summary

The privacy policy names Replit as the host of the application servers and the PostgreSQL database, stating that customer data sits on infrastructure Replit manages. No hosting country or region is declared anywhere on the site. Transfers of personal data out of the EU or EEA are said to rely on EU Standard Contractual Clauses, a copy of which can be requested by email, which implies processing outside Europe without naming where. One technical observation does not come from the publisher and should be treated as an indication only: the domain resolves to an IP address geolocated in San Francisco, United States, on a Railway network, which does not match the Replit statement and may reflect a split between front end and back end or a policy that has not been updated. Analytics are handled by a self-hosted Plausible instance presented as privacy-friendly. The controlling entity is Irish, and Irish law governs the service.