How we get our data.
Where every number on your list and in your report comes from, what we keep, who can see it, and how to stop.
The AI answers
Every week we ask ChatGPT, Gemini, Claude and Google's AI answers your tracked questions, each more than once, and record who gets named: you, a rival or no one.
The assistants' own official APIs carry the questions, so each answer is the assistant's, not a screenshot. Google's AI answers (AI Overviews and AI Mode) have no public API: they come through a licensed provider of Google search results.
Google results and business listings
Google positions for your tracked searches, the map pack and the rivals' pages beside you come from a licensed provider of Google search results and business listings, read on each country's own Google.
Your Google Business Profile is read from public listing data (Google has not approved our Business Profile API access yet) and your Yelp listing through Yelp's official API. Bing and Apple get a one-time task because we hold no read access to them.
Your own Analytics
Visits from AI assistants and from Google come from your own Google Analytics and Search Console, connected by you, read only. We never write to either account, and we show nothing we did not read there.
Communities
Threads on Reddit, Quora and the other communities are found through Google's index. When an AI answer cites a thread, we read that one page's title and description. We never log in and never post. Hacker News is read through its public search API.
A reply is yours to post, from your own account, where a community allows it; where a community wants the owner's own words, you get a checklist and write it yourself.
Your website and your rivals' public pages
Your own site, which you connected, is read when you set up, when you ask and about once a month, without checking robots.txt. When we look for competitors we read each one's homepage only; to find a prospect's contact details we read its homepage (sometimes twice), 15 contact-style paths and 1 page an AI model picks. Both read robots.txt first and skip what it asks us to skip. Once a week we also read the pricing page of each competitor you name, again after reading robots.txt.
Some readers do not read robots.txt: the broken-link checker, which only asks whether a link still works (a HEAD request, and a GET only when the server doesn't accept HEAD), and the weekly read of guides and publishers in your field (up to 24 pages a week; a page we read is read again at most once a month, and one we couldn't read is tried again after a week). Directories are reviewed by hand before we compare a listing there.
Every request names Kapiway (KapiwayBot, KapiwayRadar or KapiwayAudit), none retries pretending to be a browser, and none logs in or fills in a form. We never read Google search pages ourselves; Google results come from a licensed provider. We never ask for a picture of a page that refused our reader. When a page can't be read and didn't refuse us, we may ask our data provider for a picture of the public page, which its own browser loads.
What we store
The answers we read from the assistants, the Google positions we record, the listing fields we compared, the pages and replies we drafted, and your approvals. For a thread we keep its title, a short snippet and the link. For a review we keep the reviewer's name, the review and the link. A Yelp review's text is kept for 24 hours after we first fetch it, long enough to draft your reply; then the text is deleted and only the reviewer's first name and the link stay.
Your card is held by our payment processor, never by us. Your 8am email goes out through our email service.
Who can see what
Head office sees every location and every setting. A regional manager sees every location in their region. A location operator sees their own locations and approves their own list. A viewer looks and changes nothing. Team seats cost nothing.
The monthly report has a read-only share link you turn on and off yourself.
How long we keep it
When your plan ends (you cancel, a free trial ends without payment, or a payment is still unpaid 5 days after it failed), you can no longer use Kapiway, but you can still sign in, subscribe again, ask for a copy of your data and ask us to delete your account. We keep your data for 90 days after your plan ends; if you subscribe again within those 90 days everything is still there. After 90 days we delete your projects and their data; pages already published on your site stay on your site. To delete sooner, write to support@kapiway.com or send the deletion request in Settings, and we delete the account and its data and confirm by email. You can ask for a copy of your data the same way.
Where it runs
Kapiway runs on Amazon Web Services in the United States (N. Virginia region). Your data is stored there.
How to stop
Cancel from Settings, then Billing. No calls and no forms. Ask support to delete your data or to export it: support@kapiway.com.
Security basics
You sign in with httpOnly cookies, never a token in the page, and never with a password. Traffic between your browser and our servers uses TLS 1.2 or later. The token a chat assistant uses to reach your list is issued to one user and that user can revoke it. Each outside source of listing, review, community and answer data has its own off switch we can turn off in minutes if a provider changes its terms.