Privacy Policy

usedby needs no account and collects little. This page says what we collect, why, for how long, who handles it, and how to use your rights.

Last updated: October 8, 2026

Who is responsible

The controller of your data is KYX AI, a French simplified joint-stock company (SAS) registered in Paris under number 100 561 836, at 20 rue du Louvre, 75001 Paris, France. For any privacy question, write to contact@usedby.ai.

Information We Collect

usedby needs no account. Here is everything we collect, and nothing else:

Page views (our own analytics)

For each page you open we record: the page (its type, address and slug); an anonymous session id kept in your browser tab; the external site that sent you, if any; your browser’s user agent, with the browser, system and device type read from it; the country of your IP address (not the address itself); your screen size; your time zone; and, when you leave the page or switch tabs, how long it stayed visible and how far you scrolled. This uses no cookie and runs for every visitor; known bots are not recorded.

Errors and blocked requests

When the site fails on our servers, the error and the page are written to our hosting provider’s logs (Vercel). When we block a request because it comes too fast or from a blocked network, its IP address, country, page and user agent are written to the same logs. To apply the request limits, our servers count requests per IP address in memory for up to an hour, without storing them. No error-tracking tool runs in your browser.

Outbound clicks

When you click a link to a tool or a company site, we record the page, the destination, its campaign tags and the anonymous session id.

Suggestions and email (optional)

If you suggest a tool or a company from the search page, we store what you type (the search, the name, the website, the description) and your email address only if you give it, and we send it to our inbox to review it. Older versions of the site also collected email addresses for a newsletter and to unlock analysis results. Those forms are gone; the addresses already given are kept as described under Data retention. The old URL analyzer also logged each request with a masked IP address, the country and city, the browser and the site analysed; those logs are kept too.

What we don't collect: We do not require user accounts, we do not store your IP address in our analytics, and we never sell any data to third parties.

Public Data Sources

usedby shows which companies use which AI tools. Each line comes from a public page that anyone can open:

Vendors’ customer pages and logo walls (“Customers”, “Trusted by”)
Published case studies and named testimonials
Public press releases
Public job posts that name a tool

These pages sometimes name a person, for example the employee quoted in a case study, with their job title. We show that name only as the public page shows it, with a link to the page.

We do not access private systems, read pages behind a login, or use private data.

How we find and check each line: our methodology.

Data Accuracy

We strive for accuracy but cannot guarantee all information is current. Companies and people named on usedby can contact us to request corrections or removal of their data.

Why We Use It

Each use has one purpose and one legal basis under the GDPR:

Our page views and clicks: To count visits and see which pages help readers. Basis: our legitimate interest in running and improving the site.
Google Analytics: Same purpose, with Google’s tool. Basis in the EU, the UK and EFTA countries: your consent, given on the banner.
Errors, request limits and admin sign-in: To keep the site working and to stop abuse. Basis: our legitimate interest in the security of the site.
Suggestions and email: To review your suggestion and answer you. Basis: your consent, since you choose to send it.
Public proof of tool use: To show buyers which companies use which tools, with the public source, including the names quoted in it. Basis: our legitimate interest, and the public’s, in reliable information. You can object at any time.

We never sell or rent personal data, and we use none for advertising. We publish only aggregated numbers, such as how many companies on usedby use a tool.

Cookies & Tracking

We use a minimal set of cookies to operate our platform:

Cookie	Purpose	Duration
gdpr-region	Detects if you're in a GDPR region (EU/UK/EFTA)	1 year
analytics-consent	Stores your cookie consent preference	1 year
_ga, _ga_*	Google Analytics 4: only after you accept in the EU, the UK and EFTA countries; loaded by default elsewhere	2 years
NEXT_LOCALE	Remembers the language you picked	1 year
admin_session	Authentication for admin users (HttpOnly, secure)	24 hours

We also keep three items in your browser’s session storage, never sent as cookies and deleted when you close the tab: usedbyai_session (the anonymous session id), usedbyai_tracked_pages (so a page is counted once per visit) and usedbyai_views (for each page, its view id, when it started and the time and scroll already measured, so a return to it adds up).

GDPR Compliance: If you visit from the EU, the UK or an EFTA country, or if we cannot tell your country, Google Analytics 4 loads only after you click Accept on the banner. If you decline, it never loads. Elsewhere it loads by default. Our own page-view records, described above, do not depend on this choice. To withdraw your consent, delete the analytics-consent cookie in your browser: the banner comes back.

We do not use advertising cookies, social media trackers, or cross-site tracking technologies. You can disable cookies in your browser settings, though this may affect some functionality.

Service Providers

These providers process data for us, under their data processing terms:

VercelHosting and CDN (US servers, worldwide CDN)
Google AnalyticsGoogle Analytics 4: usage analytics (US)
NeonDatabase (US, AWS us-east-1)
Cloudflare R2Image storage (logos) (EU)
ResendSends suggestion notifications to our inbox (US)

Vercel, Google, Neon and Resend store data in the United States. These transfers rely on the safeguards in their data processing terms: the EU-US Data Privacy Framework where the provider is certified, or the European Commission’s standard contractual clauses.

Data Retention

We keep data for the following periods:

Page views, clicks and old URL analyzer logs:25 months from the visit, then deleted. We started recording in January 2026.
Google Analytics data:14 months at most, then deleted by Google
Error and blocked-request logs:Kept in Vercel’s logs for the retention period of our plan, then deleted by Vercel
Company and tool data, including names quoted in public sources:As long as the line is useful to show public proof, or until you ask us to remove it
Admin sessions:24 hours
Suggestions and email addresses:3 years from our last contact with you, or earlier if you ask us to delete them

Our database is hosted on Neon (AWS, United States). Neon keeps a short restore history (6 hours on our plan) and encrypts data at rest.

Your Rights

Under the GDPR, you have the right to:

Access: Request a copy of data we hold about you
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data
Portability: Receive your data in a portable format
Objection: Object to processing based on our legitimate interest, for example to the publication of your name
Restriction: Request limited processing of your data

You can also withdraw a consent at any time. To use any of these rights, write to contact@usedby.ai.

If you think we do not respect your rights, you can complain to the CNIL, the French data protection authority (www.cnil.fr), or to the authority of your country.

Contact Us

If you have questions about this privacy policy or want to exercise your data rights, you can reach us at:

Email: contact@usedby.ai
Response Time: Within one month for GDPR requests

For general inquiries not related to privacy, please use our contact page.

If we change this policy, we update the date at the top of this page. If a change affects how we use your data, we say so on this page.