What data does KI Score process?

This article gives you an overview of the data that comes up when you use KI Score, which services it is passed to, and where you can get more information. The full privacy policy at toolkit.kiscore.ai/privacy is authoritative.

The controller is TPWD AG in Berlin. You can reach the data protection contact at datenschutz@tpwd.de.

Account and workspace data

To handle sign-up, sign-in, and account management, KI Score processes:

• your email address and name
• your profile picture, if you upload one
• password verification values, stored only as a hash, plus confirmation and sign-in information
• your workspace assignment, roles, website access, and invitations
• your websites, settings, and plan and usage data

If someone invites you to a workspace, KI Score receives your email address, and possibly your name, from the person who invites you. If you contact support, your contact details and the content of your request are processed. Setup details such as website, brand, and comparison market may be shared internally with the responsible members of the KI Score team.

The dashboard sets cookies for sign-in, the selected website, and interface settings. Your browser loads website icons, for example next to websites and sources, through Google’s favicon service. This sends the domain in question and your IP address to Google.

Prompts and AI services

For monitoring, KI Score processes the details you enter: brands, domains, topics, prompts, competitors, and markets. It also processes the answers, sources, and analyses that result from them.

Your prompts and the context each one needs are sent to OpenRouter for analysis, and to the model providers queried through it. Depending on the feature, other services are involved as well:

• a web search for the AI providers’ answers
• Google PageSpeed for technical checks of your website
• SISTRIX for demand and topic research

Storage and training rules differ from one model provider to the next. KI Score therefore cannot give a blanket guarantee that no provider involved stores content or uses it for training.

Tip: Don’t include unnecessary personal or particularly sensitive data in your prompts and brand details.

Tactics AI, MCP servers, reports, and profile picture

• Tactics AI: Your questions and any attached files are sent to OpenRouter and the model providers queried through it, together with selected figures and prompt texts from your monitoring. Full monitoring answers aren’t included. KI Score doesn’t store the conversation permanently; it’s gone once you reload the page. Your browser reads attached files and sends them along with each question, and KI Score doesn’t keep them.
• Dictation: When you dictate a question, Tactics AI uses your browser’s speech recognition. In Chrome, the audio goes to Google for this, and KI Score receives only the recognized text.
• MCP servers: If an MCP server from another provider is connected in the workspace, the details of each tool call are sent to that server, and its result feeds into the answer. KI Score stores keys and sign-in credentials for these servers encrypted.
• Reports: When reports are delivered, they go by email to the recipients entered. A public link to a report can be opened without signing in. Once the report is deleted, the link stops working.
• Sports portrait: If you create a sports portrait from your profile photo, the photo is sent through OpenRouter to an image model.

Traffic tracking on your website

Traffic tracking is optional. If you set it up, your server sends data about individual requests to KI Score. This can include the URL, page title, timestamp, user agent, IP address, referrer, campaign parameters, and a session ID.

Of this, KI Score stores only detected AI crawlers and AI referrals, meaning visits that reach your website from ChatGPT, Perplexity, and similar services. KI Score does not store visitors’ IP addresses.

As the website operator, you are responsible for collecting this data on your site. That covers the legal basis and informing your visitors, for example in your own privacy policy. If the arrangement counts as processing on your behalf, you need a data processing agreement in place first.

Processing outside the EU

AI, payment, and communication services may process data outside the EU, for example in the United States. KI Score does not guarantee EU-only processing.

Stripe handles payments, and you enter your payment details directly in Stripe’s interface. KI Score sends account, invitation, security, and transactional emails through the Resend service.

To find out which recipients and countries are involved in your processing, and on what basis data is transferred, contact datenschutz@tpwd.de.

Retention and your rights

There are no fixed deletion periods, with one exception: KI Score deletes the raw traffic tracking data, meaning individual AI crawler requests and AI referrals, after 90 days, or after 365 days on the Enterprise plan. Otherwise, how long data is kept depends on its purpose, how long you use KI Score, and legal retention requirements. The privacy policy states: “A time-range filter in the dashboard is not an automatic deletion period.” Older data that a time-range filter doesn’t show has therefore not been deleted.

You have the right to access, rectification, erasure, restriction of processing, and data portability. For these requests, and for questions about specific retention periods, contact datenschutz@tpwd.de. You can also delete your own account yourself in the dashboard.