AI transparency

coExploro provides automated product analysis of publicly accessible SaaS products for research and competitive benchmarking. A user pastes a URL; we produce a product teardown — a structured, scored summary drawn from AI vision extraction, four persona analyses, and a cross-persona synthesis.

This page documents which AI models we use, where your data lives, how human oversight works, and which sub-processors touch your analyses. It is a research-classification disclosure under EU AI Act Article 4. We do not make automated decisions about identified individuals, and we do not profile people.

Each analysis runs through a multi-stage pipeline. The table below lists the model in each role as of the last-updated date above. Provider-side routing may relocate requests to a region selected by the provider — we do not claim single-region routing for third-party model providers.

We analyse only the URLs you submit. For each URL, we visit the page(s) with a headless browser, capture screenshots, and extract observable facts with vision models. We do not crawl pages you did not request.

Submitted URLs must resolve to public HTTP/HTTPS hosts. We reject loopback, private network ranges, link-local addresses, credentialed URLs, and non-standard ports before any browser runs; the same check re-runs immediately before navigation to prevent DNS rebinding.

coExploro is a research-classification tool — it exists to help people compare and understand product surfaces, not to target or profile individuals. We do not extract personal information by design; where a screenshot incidentally captures a visible name or email on a public page, it persists as an image artefact, not as a structured person record.

We do not train AI models on your submissions, on the outputs we produce, or on any data captured during an analysis. We do not sell your analyses. Analyses are transmitted only to the active sub-processors disclosed below (infrastructure vendors and the AI model providers that run the pipeline); they are not shared with any other third parties for advertising, resale, or training.

The third-party model providers we use (Google, Anthropic, OpenAI) receive prompts and, at the extraction and grounding stages, screenshots. Each provider is bound by its own published terms of service, which we treat as the ceiling for provider-side behaviour, not as a substitute for our own commitment. We do not opt into provider-side programmes that would allow customer prompts or outputs to be used for improving shared models. Provider-side request retention is governed by provider terms; we do not control it directly.

The pipeline is deliberately two-tier so that observable facts and interpretative opinions stay separated:

• Extraction (Gemini 3 Flash) — reads the screenshots and returns observable facts only: components seen, layout, visible copy, calls-to-action, and a 7-dimension UX score.
• Persona evaluation (Gemini 3 Flash × 4, in parallel) — four AI analyst roles (Product Manager, Marketing, UX, Designer) evaluate the extracted facts. Personas never see the raw screenshots; they reason over the extraction output alone.
• Synthesis (Claude Sonnet 4.6) — merges the four persona outputs into the final teardown shown on screen.

Every finding carries a reference to the component that produced it, so an opinion can always be traced back to the specific part of the screenshot it is grounded in.

You retain full control of each output. A teardown is a draft for you to read, edit, share, or discard at your discretion; nothing is actioned on your behalf beyond producing the teardown itself.

coExploro makes no automated decisions about identified individuals within the meaning of GDPR Article 22. The pipeline does not profile, score, rank, or select people — it describes publicly visible product surfaces.

• The UX score is heuristic. It is calibrated against the pattern of observable product surfaces; it is not an audited, certified, or industry-benchmarked metric.
• Persona coverage is limited to four roles. Real-world stakeholder diversity exceeds this; treat the outputs as starting points for team discussion, not as a replacement for it.
• English is the only supported interface language at launch. Non-English pages are still analysed, but the narrative outputs are English-only.
• We monitor upstream model drift via observability tooling, but drift detection is not automated. Outputs for the same URL may differ from run to run because the underlying models are stochastic.

We process the URLs you submit and the analyses derived from them. We are the data controller for user-submitted analyses under the GDPR. Every vendor listed below is an active sub-processor; where a data flow depends on environment configuration or only occurs on a specific event — such as starting a paid checkout — the entry says so explicitly.

Active AI model providers

Each pipeline stage has a primary provider and a fallback chain. If the primary call fails, the same stage is retried on the next provider in the chain, which receives the same payload the primary would have received (including screenshots on image-bearing stages).

• Google (Gemini 3 Flash) — primary provider for the extraction stage (receives screenshots and prompts) and the persona evaluation stage (text-only prompts). Secondary fallback for the synthesis stage (text-only). Region: global (per provider).
• Anthropic (Claude Sonnet 4.6) — primary provider for the synthesis stage (text-only prompts). Secondary fallback for the extraction stage (receives screenshots and prompts when invoked) and the persona evaluation stage (text-only). Region: global (per provider).
• OpenAI (GPT-5.4 mini) — first-line fallback for every stage. Receives screenshots and prompts when serving as the extraction fallback; receives text-only prompts at the persona and synthesis stages. Region: global (per provider).

Active infrastructure sub-processors

• Railway Pro — application hosting, PostgreSQL, Redis. Region: US Virginia (us-east4-eqdc4a).
• Cloudflare R2 — screenshot and document storage. Bucket location: ENAM (Eastern North America). No EU jurisdictional restriction is configured for the active bucket.
• Browserbase — headless Chromium sessions for URL capture. Region: multi-region (cloud Chromium).
• Langfuse Cloud — LLM observability: receives per-AI-call trace metadata (model name, stage identifier, prompt / completion token counts including Anthropic cache tokens, latency, fallback status). Input fields are limited to analysis ID and URL origin + pathname (query and hash stripped); raw prompts, model outputs, and user content are not sent. Region: US. Active when LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY are configured; tracing is gracefully disabled otherwise.
• Resend— transactional email delivery for account password reset and email verification. Receives recipient email, the password-reset link or verification link (each containing a short-lived single-use token, including the email verification token), and standard SMTP envelope metadata. No analysis content, no marketing content, no persistent profile data. Delivery region is provider-configurable; account data, email metadata, logs, and API records are stored in the US per Resend's published data-residency documentation. Active when RESEND_API_KEY and RESEND_FROM_EMAIL are configured; when keys are absent, email-dependent auth flows return an explicit 503 and no email is delivered, while local dev and CI can run the rest of the API without sending email.
• PostHog — product analytics: receives client-side usage events (such as page views and feature interactions) and the request IP used for coarse geolocation. URLs are reduced to origin and pathname (query strings and hashes stripped before send), so reset and verification tokens and similar query parameters are never transmitted. No autocapture, no session replay; a person profile is created only for signed-in users and is keyed by account id (your email is not sent as a profile property). Persistence is cookieless (in-memory). Region: US. Active when NEXT_PUBLIC_POSTHOG_KEY is configured for an environment; when unset, analytics is disabled and no events are sent.
• Brandfetch — company-name to website and logo resolution for URL autocomplete. Active when BRANDFETCH_API_KEY is configured and external suggestions are enabled. When you type a competitor name and your saved history has fewer than three close matches for it, our backend (never your browser) sends a sanitized search term to Brandfetch to resolve a matching website and logo — for a pasted URL or domain, the path, query, and fragment are stripped and only the hostname may be sent; no account, history, or analysis data is sent. Region: global (per provider).

Active payment processor

• Paddle— Merchant of Record/payment provider and active sub-processor of payment data for paid checkout. When you start or complete Paddle-managed checkout, Paddle processes the details you enter at checkout — email address, country and, where required, postal code or region, optional business/VAT information, and payment method details — together with checkout, transaction, subscription, tax/VAT, refund, and customer-support records. Payment card details are entered directly into Paddle's checkout and are never stored on coExploro infrastructure. Region: global (per provider).

Retention (active stack).Application and infrastructure logs are retained for 30 days by default. Stored screenshots and analysis records are retained indefinitely at present — automated account-triggered deletion is not yet available. You may request deletion of your analyses, screenshots, or other data held about you at any time via the feedback channel below; fulfilment today is handled manually by the coExploro team. Your right to erasure under GDPR Article 17 applies regardless of whether automated deletion is available. Provider-side request retention is governed by each provider's terms. Retention terms for Paddle-managed checkout records are governed by Paddle's published buyer and privacy terms, alongside any mandatory rights that apply.

Session continuity. Where repeat captures of the same domain require authentication or cookie-wall dismissal, we may retain browser cookies observed during capture. Cookies are scoped to your account and the target domain; they are never reused across accounts.

Questions about this document, the models we use, or the data we hold should reach us at admin@coexploro.com.

• 2026-06-15 — Brandfetch brand search. Added Brandfetch as an active infrastructure sub-processor for company-name to website and logo resolution in URL autocomplete. A sanitized search term (a company name, or only the hostname of a pasted URL) is sent server-side only when your saved history has fewer than three close matches; gated behind a default-off flag.
• 2026-06-14 — PostHog analytics. Added PostHog as an active infrastructure sub-processor for product analytics (cookieless, no autocapture, no session replay; identified-only person profiles; URLs reduced to origin and pathname).
• 2026-06-10 — Paddle activation. Moved Paddle from feature-gated wording to an active payment processor disclosure and enumerated the checkout data Paddle processes as Merchant of Record.
• 2026-05-22 — Paddle billing readiness. Updated Paddle from planned-only wording to feature-gated payment processor wording for paid checkout readiness.
• 2026-05-20 — Email verification. Updated Resend disclosure to include account email verification in addition to password reset.