Privacy Policy

OpenGain is operated by Dyad Tech, Inc. ("Dyad Tech," "OpenGain," "we," or "us"), located at 6329 Bancroft Way, San Jose, CA 95129, United States. This policy applies to the OpenGain website, hosted service, API, MCP server, and related support.

Questions and privacy requests may be sent to support@dyad.sh. We aim to respond to verified privacy requests within 30 days unless applicable law permits more time.

We collect account details such as your name, email address, profile image, verification status, and authentication-provider identifiers; security information such as session records, IP address, user agent, API-key metadata, OAuth grants, and workspace membership; and content you submit such as SEO questions, URLs, projects, reports, follow-ups, brand names and competitor names, sharing choices, and support messages.

When you connect Google Search Console, we process the selected property, read-only Search Console measurements, account display information, granted scopes, and encrypted OAuth credentials. We process purchase status, amounts, credit grants, Stripe customer and transaction identifiers, refunds, and disputes, but Stripe—not OpenGain—collects full payment-card details.

When you request an AI-visibility analysis or run the AI-visibility grader, we generate prompts from the question and the domain you submit, ask AI assistants those prompts through our evidence provider, and store the resulting answer snapshots—answer text, the sources each answer cites, the engine and reported model, and where your brand or a competitor was matched. These are public consumer answers to prompts we generate; we do not collect your conversations with AI assistants.

We also collect operational logs, provider usage, model usage and cost records, error codes, and evidence needed to produce and validate reports.

We use Google Analytics 4 (GA4) to understand how people find and use OpenGain. GA4 may receive page views, allowlisted product interactions, browser and device characteristics, approximate location derived from IP address, referral source, consent state, and—when you are signed in and analytics is permitted—an opaque pseudonymous User-ID.

We do not intentionally send Google your name, email, workspace name, SEO questions, keywords, submitted domains or URLs, report content, share tokens, OAuth parameters, payment details, or provider responses. We disable Google Signals, advertising storage, advertising user data, ads personalization, and remarketing.

In regions where prior consent is required, GA4 is blocked until you allow analytics. Elsewhere, analytics may be enabled by default with a clear opt-out. We honor Global Privacy Control as a denial when no prior choice exists. You can change your choice at any time through Cookie settings. The choice cookie lasts about six months.

GA4 user-level and event-level retention is configured to 14 months. Standard aggregated reports may remain longer. Google may process analytics information in countries other than yours. A verified deletion request includes requesting deletion of data associated with your OpenGain analytics User-ID using Google's supported controls.

We use information to authenticate users; create and secure workspaces; provide analyses, evidence, reports, APIs, and MCP tools; operate billing and credits; deliver support; prevent abuse and fraud; debug and monitor the service; comply with law; and understand and improve product quality.

Authorized Dyad Tech personnel may review customer inputs and reports on a need-to-know basis for support, security, abuse prevention, and service-quality evaluation. We may use service data to improve OpenGain, but we do not use customer content to train models unless the customer expressly opts in first.

Depending on your location and relationship with us, we process information to perform our contract, with your consent, to comply with legal obligations, and for legitimate interests such as security, service reliability, and product improvement where those interests are not overridden by your rights.

When you connect OpenGain to Codex, Claude Code, ChatGPT, or another MCP client, that client decides what it sends to OpenGain. We receive the arguments included in OpenGain tool calls together with authentication and protocol metadata needed to operate the connection, and return tool results to that client. We do not receive unrelated conversations unless the client includes them in a tool request.

Your use of the AI client is also governed by its provider's privacy terms. OpenGain is independent from, and is not endorsed by, OpenAI or Anthropic.

We disclose information to service providers only as needed to operate OpenGain. Current providers include Vercel for hosting, workflows, object storage, and AI Gateway; PlanetScale for database hosting; OpenAI for model inference; Stripe for payments; Resend for email; Google for authentication, Search Console, and analytics; DataForSEO for search, backlink, and AI-assistant answer evidence, including ChatGPT, Gemini, and Google AI Overviews answers collected on our behalf; and Firecrawl for webpage retrieval.

We may also disclose information during a corporate transaction, to protect users or the service, with your direction, or when legally required. We do not sell personal information or share it for cross-context behavioral advertising, and we do not serve targeted advertising.

We retain account and workspace information while the account is active and as needed to provide the service. Provider payloads are generally retained up to 30 days; fetched webpage artifacts up to 90 days; normalized public-web evidence up to 24 months; Search Console facts up to 16 months; and unlisted share links up to 30 days. AI-assistant answers follow the same buckets: the raw provider payload up to 30 days, and the normalized answer snapshot and its citations up to 24 months. Reports may remain until deletion, but expired evidence is removed or replaced with a retention notice.

Billing, fraud-prevention, security, and legal records may remain longer when reasonably necessary or legally required. Deletion from backups and third-party systems may occur on their normal secure lifecycle.

We use access controls, workspace authorization, encryption in transit, encryption for stored integration credentials, private artifact storage, bounded share links, and monitoring intended to protect information. No security measure can guarantee absolute protection.

Reports are private unless an authorized user creates an unlisted, expiring share link. Shared views omit credentials, provider payloads, internal costs, workspace details, and Search Console metrics unless the user explicitly includes supported connected metrics.

Free AI-visibility grades work differently by design: a grade page is public and search-indexable, and shows the graded domain, its grade, and the AI answers behind it. Grade pages carry no account, workspace, or billing information, and running a grade requires a signed-in account.

Depending on where you live, you may request access, export, correction, deletion, restriction, objection, portability, or withdrawal of consent, and may appeal or complain to a regulator. You may use the privacy controls in your account or email support@dyad.sh. We may verify your identity and authority before acting.

Account deletion revokes access and deletes solely owned workspace content after any required review. If you own a shared workspace, support must first resolve ownership. Content belonging to a shared workspace may remain for its other members while your identity and membership are removed. We retain only information that remains necessary for billing, fraud prevention, security, or legal obligations.

OpenGain is operated from the United States, and information may be processed in the United States and other countries where our providers operate. Where required, we rely on recognized transfer mechanisms or other lawful safeguards.

OpenGain is not intended for anyone under 18, and we do not knowingly collect personal information from children.

We may update this policy as OpenGain changes. We will update the effective date and notify account holders by email before material changes take effect when appropriate.

See our Terms and Conditions or visit Support.