A public question about a company’s visibility is different from uploading a contract containing personal data. Before a project, record what is transferred, who receives it, the purpose and retention period. Even a public question can contain personal information.
Context and scope
No-training statements need an appropriate contractual and technical basis. A Swiss server location does not automatically describe every external service’s processing. Review model access, hosting, email, analytics and logs separately.
A proxy can make the network connection to a downstream service. It does not anonymise names or contract details in the text. Public service questions or clearly labelled synthetic examples are often sufficient for testing. Client documents belong only in an appropriately approved workflow.
SOURCE/01 records these flows and open questions. It does not issue a blanket data-protection certification. GlasBox’s own privacy policy describes hosting and processing at Infomaniak in Switzerland and separate retention periods for logs, email leads and browser storage.
A data matrix before a visibility test
This template distinguishes four data types. Enter the actual providers and retention periods for the project before use. “Switzerland” without identifying the processing, or “session only” without a defined period, is insufficient technical documentation. The template does not replace a project-specific review of legal duties.
| Review point | Example / subject | Interpretation |
|---|---|---|
| Public service question | Name and public offer | Deliberately choose the receiving search surface. |
| Synthetic test contract | Invented information that cannot identify a person | Label as test data; do not copy actual client details. |
| Actual contract file | Confidential or personal data | Agree approval, roles, recipients and deletion period first. |
| Technical log | Time, identifier, error and possibly request content | Document access and actual retention. |
How to apply this
- Minimise the information needed for each test.
- Record hosting and downstream recipients separately.
- Define retention, deletion and the responsible person.
- Review production privacy information after configuration changes.
Sources and further reading
The source supports the rules it describes. This article’s working templates are our methodological examples, not client test results.
RAG-readiness versus GEO
Next step
The free short check provides an initial assessment of one domain, three buying questions and three observations. An introductory call establishes whether deeper analysis is useful.
Request an introductory call