Privacy Policy

Last updated: October 20, 2026

This policy explains what information CTO Platform, Inc. ("CTO.LA", "we", "us") collects on cto.la, why we collect it, and the choices you have. We've written it in plain English.

Who we are
CTO Platform, Inc., operating cto.la
8549 Wilshire Blvd #2383, Beverly Hills, CA 90211
Email: ak@cto.la

What we collect

When you use the AI Visibility Score tool

• The website address you enter and the scan results. We read only that website's public pages, the same way a search engine crawler does, and we respect its robots.txt. We store the address, the score, the findings and the pages we checked, so your result loads again from its private link and so we can prevent abuse.
• Technical data for security. To stop abuse (for example, too many scans, free tool runs or sign-in requests from one place), we store a one-way scrambled ("hashed") version of your IP address and browser type, re-salted daily, and every scan, sign-in request and free tool run requires Cloudflare Turnstile. We don't store your raw IP address.

Only if you ask for the full report

• Your email address and your consent choice (the checkbox), along with the related scan, the website and how you found us (for example, campaign tags in the link you clicked).

Only if you request a call

• Your name, email address and any message you choose to send, plus the related scan if there is one.

Booking a call. When you book a call at cto.la/book, we collect your name, email address, company (optional), any notes you add, your time zone, and the time you picked. Along with your booking we also store your language setting, how you reached the booking page (for example, from our AI website audit), and, if you came from a scan, that scan's ID. We use this only to schedule, confirm, and hold the call, to send you the invite and any cancel or reschedule updates, and to understand which pages lead to calls (legal basis for visitors in the EU, EEA, UK or Switzerland: taking steps at your request before a contract, and our legitimate interest in understanding how people find us). Booking details are stored in our Cloudflare D1 database and invites are sent through Resend, both acting as our service providers. To find open times, we fetch our own calendar, use only its busy and free times, and discard everything else; busy times are cached for up to one hour. We keep booking records for 12 months after the call, or 90 days if the booking is cancelled before the meeting, then delete them.

A copy of the invite and any updates (or, for call requests, a notice of your request), including your notes and time zone, also goes to Aleksey's calendar and mailbox, which are hosted by Proton AG, our email and calendar provider. Those copies stay there as part of our normal business records until Aleksey deletes them, or until you ask us to delete them.

If our calendar is temporarily unavailable, we show a call-request form instead. It collects your name, email address, company (optional) and notes, and we keep them as call-request details, as described above (24 months from your last contact with us).

Bookings use Cloudflare Turnstile for bot protection, as described above. You can ask us to access or delete your booking details at any time.

Only if you ask a question

• Your name, email address and your question. We use them only to reply to you. We don't add you to any mailing list. Please don't include sensitive information (such as health or financial details) in your question. If you're in the EU, EEA, UK or Switzerland, our legal basis is taking the steps you asked for.

If you create an account

• Your email address, when your account was created and when you last signed in. We don't use passwords: you sign in with a one-time link we email you, which expires after 15 minutes and works once.
• Sign-in sessions. When you sign in, we create a session that lasts up to 7 days and store when it started and ends. We may also store a one-way scrambled ("hashed") version of your IP address and browser type with it, to spot misuse. We don't store your raw IP address.
• Your free tool runs. We count how many free runs of our tools you've used, so we can apply the free limit. Before you sign in, we count them against a random ID kept in a cookie (see "Cookies and browser storage"); after you sign in, we count them against your account.
• Your consent choices, if we offer an optional marketing email checkbox: whether you ticked it, when, and which wording you saw.

Our other free tools and the Lab

• Schema Generator. It runs entirely in your browser. What you type isn't sent to us and nothing is stored.
• AI Rollout Check. We use your answers only to show your result. Nothing is stored.
• AI Answer Check (only when the AI Answer Check is live). You enter a company name, city and business category. We send those three details to OpenAI (an AI model provider) and Brave Search (a search engine API) to check how AI tools and search describe that business, and we keep the result for 7 days so repeat checks load faster. To prevent abuse, each check requires Cloudflare Turnstile and is rate-limited using a hashed version of your IP address (re-salted daily); we don't store your raw IP address. Please don't enter information about a private individual.
• The Lab (only when the Lab is live). Before you use a Lab tool, we ask for your email address and remember that you've done this step with a cookie (see "Cookies and browser storage"). We store your email, how many times you've used the Lab, and a hashed version of your IP address to apply a daily limit. What you submit to a Lab tool (for example, text or an image) is sent to OpenAI to generate the result. We use your Lab email only to give you access to the Lab; we won't send you marketing emails unless you separately agree.

Analytics

• Our own event log (no cookies). On the AI Visibility Score page, your browser sends simple events about how the page is used to our own database, such as "page viewed", "scan started", "result shown", "report requested" and "call requested". They include the website's domain, the step reached, timings, screen width and the referring site. These events carry no ID, cookie, email address or name.
• Google Analytics (site-wide). We use Google Analytics, a service of Google LLC, across cto.la to understand how visitors use the site. See "Google Analytics" below.
• We also count key actions on our site (such as submitting a contact or audit form, or booking a call) and how you first found us (for example, a search engine, an AI assistant, or a link), so we can tell which pages help real people reach us. If you then contact us, we may link this to your inquiry. We don't use it for advertising or share it with ad networks.
• We don't use tracking pixels in our emails, or fingerprinting.

Why we use it

• To run your scan and show you the result.
• To email the full report you asked for, and to reply to your call request.
• To send at most one follow-up email about your report, and only if you ticked the consent box.
• To keep the tool secure and working: rate limits, spam prevention and fixing errors.
• To understand, in aggregate, how the page performs so we can improve it.
• To create and run your account: sending sign-in links and service emails (for example, a notice before we delete an inactive account), keeping you signed in, and applying the free tool limit.
• To run the free tools and the Lab you use, and to limit misuse of them.

If you're in the EU, EEA, UK or Switzerland, our legal bases are:

• Running your scan, emailing the report you asked for and replying to your call request: to take the steps you asked for (contract).
• The one follow-up email: your consent (the checkbox). You can withdraw it at any time with the unsubscribe link or by emailing us.
• Security, abuse prevention, error fixing and aggregate analytics: our legitimate interest in keeping the tool safe and working well.
• Your account, sign-in links, the free tools, the Lab and the free tool limit: to provide the service you signed up for or asked for (contract).
• Rate limits and misuse checks on sign-in, the free tools and the Lab: our legitimate interest in keeping the service secure.
• Optional marketing emails (if offered): your consent (the unticked checkbox). You can withdraw it at any time with the unsubscribe link or in your account.
• Keeping records the law requires: legal obligation.

You can also object to processing based on legitimate interests, ask us to restrict processing, ask for a copy of your data in a portable format, and complain to your local data protection authority.

Where it's stored and who processes it

• Storage: scan results, report and call requests, booking details, account and sign-in data, free-run counts, Lab records and AI Answer Check results (only when each is live), and analytics events are stored in a Cloudflare D1 database run by Cloudflare, Inc. on our behalf. The database is hosted in the United States. Cloudflare processes this data under its Data Processing Addendum.
• Email: we send report emails, booking invites (including cancel and reschedule updates), sign-in links and account emails, and forward report requests, call requests and questions to our team, through Resend, our email service provider. Resend keeps a copy of each email it sends, and its delivery logs, for 30 days, then deletes them.
• Bot protection: every scan, booking and question form requires Cloudflare Turnstile, which checks that you're a person, not a bot. It loads a script and a small frame from challenges.cloudflare.com, and Cloudflare processes signals from your browser (such as browser and device characteristics) to detect bots, as our service provider.
• Email and calendar: Proton AG (Switzerland) hosts Aleksey's email and calendar, including copies of booking invites and updates and any emails you send us.
• Analytics: Google LLC receives Google Analytics data, as described in "Google Analytics" below.
• These providers process data only to provide their services to us, under data processing terms that limit how they can use it. If you're in the EU, EEA, UK or Switzerland, your data is transferred to the United States; those transfers are covered by the EU-U.S. Data Privacy Framework (and its UK Extension), the Swiss-U.S. Data Privacy Framework, and/or the European Commission's standard contractual clauses (with the UK and Swiss addenda where they apply). Proton AG stores data in Switzerland.
• Cloudflare also uses Turnstile signals to improve its bot detection, as an independent controller under its own Turnstile Privacy Addendum.
• AI Answer Check and the Lab (only when each is live): OpenAI and Brave Search receive the details described above, in the United States, to provide their services. Their own terms and privacy policies govern how they handle that data.
• We do not sell your personal information. Our use of Google Analytics may count as "sharing" under California law, so we offer a Do Not Sell or Share My Personal Information link and honor Global Privacy Control signals by turning Google Analytics off for that visitor.
• We may disclose information if we believe in good faith the law requires it (for example, a valid subpoena or court order), or where reasonably necessary to protect the rights, property or safety of us, our users or others. If our business is merged, acquired or sold, information may transfer to the new owner, who must continue to protect it under this policy.

How long we keep it

An automatic purge runs every day and deletes data once it reaches the end of these periods:

• Scan results: 12 months, so result links keep working. Cached copies used to speed up repeat scans expire after 24 hours.
• Email, consent, call-request and question details: 24 months from your last contact with us, or until you ask us to delete them.
• Booking records: 12 months after the call, or 90 days if the booking is cancelled before the meeting. Copies of invites and updates in Aleksey's calendar and mailbox are kept until deleted, or until you ask us to delete them.
• Hashed IP and browser data used for rate limits: 30 days.
• Analytics events: 13 months, then deleted or kept only in aggregate form that can't identify you.
• Account: until you delete it, or 24 months after your last sign-in. We email you 30 days before deleting an inactive account; signing in keeps it.
• Sign-in links: deleted 24 hours after they expire or are used. Sign-in sessions: deleted 30 days after they end or you sign out.
• Free-run counts kept against the random cookie ID (before you sign in): 30 days. Counts on your account are deleted with your account.
• AI Answer Check results (only when the AI Answer Check is live): 7 days.
• Lab email and usage records (only when the Lab is live): 24 months from your last use, or until you ask us to delete them.
• Copies of emails held by Resend: 30 days.
• Database backups that may still contain deleted data are overwritten within 30 days.

Emails from us

• If you ask for the full report, we email it to you. If you ticked the consent box, we may send one follow-up email. That's all.
• Every email has an unsubscribe link. You can also email ak@cto.la to stop emails.

Google Analytics

• What it is: Google Analytics (GA4), a service of Google LLC, runs on every page of cto.la. We use it for plain analytics only, and Google acts as our service provider.
• Cookies it sets: _ga (2 years) and _ga_<ID> (2 years). They hold a random ID that lets Google tell visits apart.
• What it collects: the pages you view, how you arrived (the referring site and campaign tags), your device, browser and approximate location, how long you stay, and events on our pages (for example "scan started" or "call requested", including the scanned website's domain). We don't send your name or email address to Google.
• How Google uses it: see How Google uses information from sites or apps that use its services.
• Opting out: install the Google Analytics Opt-out Browser Add-on, block or delete cookies in your browser, or use a browser setting that blocks trackers.
• We don't sell your data. Google Analytics may count as "sharing" under California law, so you can turn it off with the Do Not Sell or Share My Personal Information link or by sending a Global Privacy Control signal.
• Retention: Google Analytics keeps this data for 14 months, set in our Google Analytics settings. This is separate from our own event log, which we keep for 13 months.
• Visitors in the EU, UK, EEA or Switzerland: We use Google Analytics to understand site usage. For visitors in the EU, EEA, UK or Switzerland we only set analytics cookies after you consent. You can change this anytime via Cookie settings.

Cookies and browser storage

• The AI Visibility Score tool itself uses no local storage or session storage; scan and report IDs are kept only in the page's memory while you use it. The free-run cookie below applies only to the tools with a free limit.
• Google Analytics sets the cookies described above, on every page including this one.
• How you found us (analytics, set only with your consent): these are first-party cookies. We never set them if you're in the EU, EEA, UK or Switzerland and haven't opted in, if your browser sends a Global Privacy Control signal, or if you've used the Do Not Sell or Share link.

- ctola_src (cookie, 30 days): records how you first reached cto.la, as a category (AI assistant, Google, other search engine, another website, or direct), the referring site's domain, and whether the visit came from an ad or a tagged link. It stores no ID, page address, email address or name. It is set once and isn't overwritten by later visits. If you send us a call request or another form, we store this category with your inquiry.

- ctola_fs (cookie, deleted when you close your browser): holds only the value 1. It means this browser session has already been counted as one visit, so we don't count it again. We also use it to help tell visits by people apart from automated traffic in our counts.

• Theme choice: we save your light/dark choice in your browser's local storage (ctola-theme), so the site remembers it. It never leaves your device.
• Your Google Analytics choices (strictly necessary): these are not cookies and hold no ID. Each is set only after you make a choice, and never leaves your device.

- ctola-consent (local storage, no expiry until you clear it or change your choice): records your analytics choice if you're in the EU/EEA/UK/CH (granted or denied). You can change it anytime via Cookie settings.

- ctola-dnss-optout (local storage, no expiry until you clear it): set to 1 when you use the Do Not Sell or Share link, and turns Google Analytics off.

- Global Privacy Control: if your browser sends a GPC signal, we read it on each visit and turn Google Analytics off. Nothing is stored for it.

• Strictly necessary cookies (no consent needed, including in the EU, EEA, UK or Switzerland):

- __Host-ctola_session (cookie, HttpOnly, Secure, up to 7 days): keeps you signed in. It holds a random session reference that our server checks; it's deleted when you sign out or it expires.

- __Host-ctola_si (cookie, up to 7 days): set to 1 while you're signed in, so pages can show your account menu instead of booking prompts. It holds no ID or personal information and is removed when you sign out or delete your account.

- __Host-ctola_trial (cookie, HttpOnly, Secure, 30 days): a random ID used only to count your free tool runs before you sign in. It isn't used for analytics or advertising, isn't sent to Google, and isn't linked to your name or email.

- lab_gate (cookie, HttpOnly, 7 days): remembers that you've passed the Lab email step so you aren't asked again. It holds a random value.

Your choices and rights

You can ask us to see, correct or delete the personal information we hold about you, or to stop emails, by writing to ak@cto.la with the email address you used. We'll respond within 45 days. If we need more time, we'll tell you why within that period and may take up to 45 more days. If you're in the EU, EEA, UK or Switzerland, we'll respond within one month (30 days in Switzerland), extendable for complex requests as the GDPR, UK GDPR or Swiss data protection law allows; if we need more time, we'll tell you why. We may need to verify that the request comes from you.

Your account. You can delete your account at any time from your account page or by emailing ak@cto.la from your account's address. Deleting it removes your account, sessions and free-run history from our database straight away and signs you out everywhere; copies held by Resend and in our backups are deleted within 30 days. You can also ask for a copy of your account data. We'll send it as a file you can read and reuse (JSON) within the response times above.

California residents (CCPA/CPRA)

We provide this information and honor these rights voluntarily for all California residents, whether or not the California Consumer Privacy Act applies to us.

• Categories collected in the last 12 months: identifiers (name, email address, account ID, hashed IP, and the Google Analytics cookie ID); internet or network activity (pages viewed and tool events on cto.la); commercial or professional information you choose to provide (your website, the message in a call request, or a question you send); and inferences limited to your website's scan results.
• Sources: you directly, your browser (including through Google Analytics and Cloudflare Turnstile), and the public pages of the website you ask us to scan.
• Purposes: as described in "Why we use it".
• Sale or sharing: we do not sell personal information, and we have not done so in the last 12 months. Our use of Google Analytics may count as "sharing" for cross-context behavioral advertising under California law. You can opt out with the Do Not Sell or Share My Personal Information link, and we honor Global Privacy Control signals by turning Google Analytics off for your browser. We do not knowingly collect the information of anyone under 16.
• Sensitive personal information: we don't collect it.
• Disclosures for a business purpose: we disclose identifiers and internet activity to our service providers (Cloudflare for hosting, storage and bot protection; Resend for email; Proton AG (email and calendar hosting); Google for analytics; and, only when the AI Answer Check or the Lab is live, OpenAI and Brave Search for those tools) only to run the site and tools.
• Retention: see "How long we keep it".
• Your rights: to know or access, delete, and correct your personal information, to opt out of sale or sharing (we don't sell; you can opt out of Google Analytics "sharing" as described above), to limit the use of sensitive personal information (which we don't collect), and not to be discriminated against for using these rights.
• How to exercise them: email ak@cto.la. You may use an authorized agent; we may ask for proof of authorization and verify your identity. You can also write to us at the postal address above.
• Global Privacy Control: if your browser sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information, and we turn Google Analytics off for your browser.

Security

We use encrypted connections (HTTPS), store hashed rather than raw IP addresses, keep scan results behind unguessable private links, and limit who on our team can access the data. No system is perfectly secure, but we work to protect your information. Accounts have no passwords: sign-in links are single-use and expire after 15 minutes, and we store only scrambled versions of them.

Children

cto.la is for businesses and isn't directed at children under 16.

Changes

If we change this policy, we'll update the date at the top. If a change is significant, we'll say so clearly on this page.

Contact

CTO Platform, Inc., 8549 Wilshire Blvd #2383, Beverly Hills, CA 90211 · ak@cto.la