Legal

Privacy Policy

8ight.ai Last Updated: October 25, 2026

Introduction

8ight.ai (“we”, “our”, “us”) operates the website https://8ight.ai and the 8ight.ai SEO content publishing platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

Information We Collect

Information You Provide

• Account information (name, email address) when you sign up
• Website URL and business details during onboarding
• Payment information processed securely through Stripe
• Content preferences and settings you configure in the dashboard

Information Collected Automatically

• Google Search Console data (search queries, clicks, impressions, average position) when you connect your GSC account via OAuth
• Google Analytics data when you connect your GA account
• Usage data such as pages visited, features used, and interaction patterns
• Device and browser information, IP address, and cookies

Google User Data

When you connect your Google account, we access:

• Google Search Console: Search performance data (queries, clicks, impressions, position) for your verified properties. Scope: https://www.googleapis.com/auth/webmasters.readonly
• Google Authentication: Basic profile information (name, email). Scope: openid, email, profile
• Google Business Profile: The business profile you connect, to read and update it (such as posts and business details) at your direction. Scope: https://www.googleapis.com/auth/business.manage
• YouTube: Your channel name, and uploading the videos you choose to your own channel. Scopes: https://www.googleapis.com/auth/youtube.readonly, https://www.googleapis.com/auth/youtube.upload
• Gmail, in 8ight Sales OS: Sending the emails you write or schedule in Sales OS from your own address. Scope: https://www.googleapis.com/auth/gmail.send. Only if you also turn on replies: reading new mail in your inbox to find messages from people in your CRM. Scope: https://www.googleapis.com/auth/gmail.readonly

How We Use Your Information

We use the collected information to:

• Provide, operate, and maintain our SEO content publishing platform
• Generate and publish SEO-optimized articles to your WordPress site
• Display search performance analytics in your dashboard
• Process payments and manage subscriptions
• Send transactional emails related to your account
• Improve our services and develop new features

Google User Data Usage

We use Google user data exclusively to:

• Display your search performance metrics in the 8ight.ai dashboard
• Analyze keyword opportunities for content generation
• Show traffic trends and SEO progress
• Read and update the Google Business Profile you connect, at your direction
• Upload the videos you choose to your YouTube channel, and show you which channel is connected
• Send the emails you write or schedule in 8ight Sales OS from your own Gmail address
• If you turn on replies in Sales OS: find messages from people in your CRM and keep only those, on the matching lead

We do NOT:

• Sell Google user data to third parties
• Use Google user data for advertising purposes
• Share Google user data with third parties except as required to provide our services
• Use Google user data for AI/ML model training, or to develop or improve generalized AI or machine learning models
• Let people at 8ight.ai read your Google user data, except with your permission for support, for security, or where the law requires it
• Store Gmail messages that are not from people in your CRM

8ight.ai’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data Storage and Security

• All data is stored securely on Supabase (hosted on AWS) with encryption at rest and in transit
• Google OAuth tokens are stored encrypted and are only used to fetch data on your behalf
• Payment data is processed by Stripe and never stored on our servers
• We implement industry-standard security measures to protect your data

Data Sharing

We do not sell your personal information. We may share data with:

• Stripe: For payment processing
• Supabase: For data storage and authentication
• Anthropic (Claude AI): For article content generation (only your business description and keywords are shared, not personal data). Gmail content is not shared with AI providers; it reaches an AI assistant only if you connect one to your own Sales OS workspace
• Pexels: For sourcing article images
• WordPress: To publish articles to your connected site
• OpenAI and Google (Gemini): To write and check content, and to measure what AI assistants say about a business (business details and questions, not your personal data)
• AI assistants you connect (such as Claude by Anthropic or ChatGPT by OpenAI): Only the data you ask for through the connector, at your direction. See “Connecting an AI assistant” below
• Vercel: Hosting for parts of our apps, including the connector addresses crm.8ight.ai/mcp and app.8ight.ai/mcp
• Twilio and ElevenLabs: To place, answer and voice phone calls and text messages for the AI receptionist and phone line
• Resend and our email-sending providers: To deliver account emails and the email campaigns you order
• Google Analytics and Microsoft Clarity: To understand how visitors use our website
• Professional advisers, authorities and successors: Where the law requires it, to protect our rights, the safety of others or the Services, or as part of a merger, acquisition or sale of assets, under confidentiality

These providers act on our instructions and may process data outside Canada, including in the United States, where it may be accessible to the authorities of that country under its laws.

Data Our Customers Put in the Service

When a business uses 8ight to store or contact its own leads, customers or callers (for example in Sales OS, email campaigns or the AI receptionist), that business decides what information is collected and why, and is responsible for having the right to collect it and for giving any notice or obtaining any consent the law requires. 8ight processes that information on the business’s behalf and on its instructions. If you are one of those people, please contact the business directly; we will help it respond to your request.

Connecting an AI assistant (Claude, ChatGPT)

You can connect an AI assistant, such as Claude or ChatGPT, to your 8ight account through one of our two connectors: 8ight Sales OS (address crm.8ight.ai/mcp) and 8ight SEO & GEO (address app.8ight.ai/mcp). This section explains what a connector reads, what it sends to your assistant, what we keep about the connection, and how to end it.

Who decides. Nothing is shared until you sign in on our page and choose Allow. After that, the assistant asks a connector for data only when you ask the assistant something that needs it. A connector works as you: it sees only what your own 8ight account can see, with the same permissions your role has in your workspace.

What the 8ight Sales OS connector reads and returns

• Your CRM records: leads (company name, status, website, phone, email, city, industry, owner, source, notes and custom fields), the people on each lead (name, title, email, phone), deals (name, stage, value, confidence, close date), tasks, and timeline entries such as notes, calls, emails and meetings. Timeline entries can include the text of emails, including replies saved from your connected mailbox if you turned on replies.
• Your workspace: its name and plan, the email addresses of your teammates, your lead statuses, pipeline stages, custom fields, follow-up sequences, and summary counts and reports.
• Changes you ask for: the assistant can create and update leads, contacts, deals, tasks and timeline entries, put a lead into a follow-up sequence, and, if you have connected a mailbox, send an email from your own mailbox to an address already on that lead. A change made this way is treated exactly like a change you make in Sales OS: it is recorded under your name and can trigger your workspace’s automations, sequences, webhooks and integrations. The connector cannot delete anything.
• Many of these records are about other people (your leads and their contacts). As explained in “Data Our Customers Put in the Service”, your business decides what is collected about them and is responsible for having the right to use it, including when it sends their information to an AI assistant or sends them an email through it. When you send email this way, you are the sender, and the laws on commercial email (such as CASL, CAN-SPAM and the GDPR) apply to you as they do to any email you send.

What the 8ight SEO & GEO connector reads and returns

This connector only reads. It cannot change anything in your account or on your website.

• Your sites: the websites on your account, the business name, plan, language, and whether AI answer tracking is on.
• Google rankings: your tracked keywords, their Google position and change, the page that ranks, and how you compare with the competitors tracked for your site.
• AI visibility: for each question we track for your business, whether ChatGPT, Claude, Gemini and Perplexity named your business at the last weekly check, which competitors they named, the links they cited or read, and a short excerpt of the answer; plus our recommended actions and alerts.
• Articles: the articles we published or scheduled for your site (title, address, keyword, date), and their readers.
• Google Search Console: if you connected Search Console in your 8ight dashboard, clicks, impressions, average position, click rate, top pages and the daily trend for your site. This is Google user data: it reaches an AI assistant only when you connect one through this connector and ask for it.

What the assistant receives about you when you connect. If the assistant asks for it, we tell it the email address of your 8ight account, whether that address is verified, and a fixed identifier for your account, so it knows which account it is connected to.

Who receives the data. What a connector returns goes only to the assistant you connected, and through it to the company that runs that assistant (for example Anthropic for Claude, or OpenAI for ChatGPT). From then on, that company’s own terms and privacy policy govern it, including how long it keeps your conversations and whether it may use them to improve its models; you can usually change this in your assistant’s settings. The data passes through our hosting providers (Supabase, and Vercel, which routes the connector addresses) on its way. We do not sell this data, we do not use it for advertising, and we do not use it to train AI models.

What we keep about a connection

• We do not keep a copy of what a connector returns to your assistant. The records it reads stay where they already are in your account.
• A record of the app you connected: the name the app gave itself, its return addresses and when it was registered and last used. An app registration that never completes a connection is deleted after about a week.
• A record of each connection: your email address, your workspace or account, the app’s name, when the connection was made and last used, how many requests it made, its permission scope, and when it ended. We store only scrambled (hashed) forms of the access keys we issue, never the keys themselves. An access key lasts one hour; the key that renews it lasts 90 days from its last use.
• A record of each one-time approval code: the same account details, the app and its return address. A code expires 10 minutes after it is issued and works once.
• For 8ight Sales OS, failed sign-ins on the connect page: the email address that was typed, the reason it failed (for example a wrong password) and the app’s name. We never store the password that was typed.
• Short-lived counters of requests per network address, used to stop abuse. They are deleted when their time window ends, at most within a day.
• Service logs kept by our hosting providers for a limited period, which can include network addresses and, when something fails, an email address and the app’s name.

How long. When a connection ends or its keys expire, we keep its record for 90 days as a security record of who had access to your account, and then delete it. One-time approval codes are deleted about a day after they expire, and failed sign-in records after 90 days. You can ask us at any time to delete these records sooner, and we will.

How to disconnect

• In 8ight Sales OS: open Settings, then AI assistants, and choose Remove next to the connection. You can remove your own; a workspace admin can remove anyone’s. Access ends at once. A teammate’s connections also end when they are removed from the workspace, and when they reset their password with a reset link.
• In 8ight SEO & GEO: remove the connector in your assistant (below), or write to us and we will end it for you.
• In your assistant: remove the 8ight connector in its settings (in Claude: Settings, Connectors; in ChatGPT: Settings, Apps). If the assistant tells us, we end the connection at once. If it does not, the assistant no longer holds the keys; any access key it was issued expires within one hour, and the connection cannot be renewed after 90 days without use.
• By writing to us: at the address in “Contact Us”. We will end the connection and, if you ask, delete its records.

Disconnecting does not delete your 8ight data, and it does not delete anything the assistant already received; ask the assistant’s provider about that.

Questions about this section go to daniel@8ight.ai, or by mail to the address in “Contact Us”.

Advertising accounts (Google Ads and Meta)

If you connect a Google Ads account or a Meta (Facebook and Instagram) ad account, we receive an access token from Google or Meta and read that account's campaigns, ad groups or ad sets, ads, keywords and search terms, and their performance (impressions, reach, clicks, cost, conversions and conversion value), together with conversion and policy settings. We use this data only to show you your ads' performance, to write the check of what works and what wastes money, and to make the specific changes you confirm in our app (pausing or resuming a campaign, or changing a campaign's daily budget). We never change your ads on our own. Tokens and ad data are stored encrypted at rest. We do not sell this data, do not use it for advertising, and do not use it to train AI models; a service provider writes the plain-language summary of your check from figures we computed, under terms that do not allow training on it. You can disconnect at any time in our app; we then revoke our access where the platform allows it and stop reading. To delete the data we hold from your ad accounts, write to daniel@8ight.ai or use the Facebook settings described on our Data Deletion Instructions page; we delete it within 30 days.

8ight's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Calls, Texts and Emails

• Calls handled by our AI receptionist or phone line may be recorded and transcribed so the business can see what was said, and to improve and secure the service.
• Emails and texts sent through our services identify the sender and include a way to opt out. To stop receiving them, use the unsubscribe link, reply STOP to a text, or write to us at the address below and we will suppress your address or number.

Data Retention

• Account data is retained for as long as your account is active
• You can request deletion of your account and all associated data at any time
• Google OAuth tokens are revoked upon account deletion or disconnection
• Published articles on your WordPress site remain under your control
• Records of AI assistant connections are kept as described in “Connecting an AI assistant” above
• We may keep records we are required to keep by law (for example billing, tax and opt-out records), and backups that are deleted on their normal schedule

Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Disconnect your Google account at any time, in your dashboard, in Sales OS settings, or at myaccount.google.com/permissions
• Disconnect an AI assistant at any time, as described in “Connecting an AI assistant” above
• Export your data
• Opt out of non-essential communications

Cookies

We use essential cookies for sign-in and session management, and analytics cookies (Google Analytics and Microsoft Clarity) to understand how our website is used. We do not sell data collected through cookies. You can block or delete cookies in your browser; some features may not work without the essential ones.

Security

We use reasonable administrative, technical and physical safeguards for the information we hold. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials safe. If we learn of a breach that creates a real risk of significant harm, we will notify you and the authorities as the law requires.

Children’s Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our platform.

Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Email: daniel@8ight.ai Website: https://8ight.ai Mail: 8IGHT AI TECHNOLOGY INC., 3657 Lake Shore Blvd W, Etobicoke, ON M8W 1P7, Canada

This Privacy Policy is part of, and subject to, our Terms of Service.

Compliance

This policy is written to meet:

• Google API Services User Data Policy
• Google OAuth 2.0 Policies
• Canadian Personal Information Protection and Electronic Documents Act (PIPEDA)

Operating company: 8IGHT AI TECHNOLOGY INC., 3657 Lake Shore Blvd W, Etobicoke, ON M8W 1P7, Canada. D-U-N-S 243373139 · +1 844-482-4884 · daniel@8ight.ai