Key takeaways
- Sitecore acquired Scrunch on June 3, 2026, reportedly for around $225 million (per Bloomberg; Sitecore declined to confirm). Scrunch says it will keep operating as a standalone platform, and it shipped new features two months after the deal, so early signs point to continuity rather than a shutdown.
- The data a GEO platform collects about your brand is governed by your commercial contract, not the vendor's public privacy policy. Scrunch's own policy states this explicitly.
- Scrunch's privacy policy was last updated in August 2024, before the acquisition. That's a flag worth watching, since standard practice calls for a business-transfer disclosure when a company changes hands.
- The Adobe–Semrush deal shows the portability problem in practice: prompt tracking history and benchmarks generally don't transfer between platforms, so your historical data is only as safe as your export habits.
- The protections that matter (change-of-control notice, guaranteed export formats, deletion rights, no-training clauses) have to be negotiated into your contract before a deal is announced. Afterward, you're negotiating from a weaker position.
What happened: Sitecore bought Scrunch
On June 3, 2026, Sitecore announced it had acquired Scrunch, the AI search visibility platform used by more than 500 brands and agencies, including Akamai, Lenovo, ADP, Publicis, and Seer Interactive. Bloomberg reported the price at roughly $225 million. Sitecore wouldn't confirm the number, and Scrunch didn't respond to media requests for comment, which is standard for deals like this.
The strategic logic is easy to follow. Scrunch shows brands where they appear, disappear, or get misrepresented in AI-generated answers. Sitecore sells the content infrastructure that teams use to publish and manage experiences. Bolt the monitoring tool onto the content platform and you get a closed loop: see the gap, fix the gap, measure the result. Sitecore's CEO Eric Stine put it bluntly, saying "the internet must be written for machines to understand if we want humans to experience it."
For customers, the immediate question was simpler than the strategy: what happens to my account, my pricing, and my data? Scrunch CEO Chris Andrew addressed this directly in a blog post published the same day. "Scrunch isn't going away," he wrote, promising the company would "continue to operate as a standalone platform, support the customers and partners we serve today, and accelerate our product roadmap."
Two months later, there's evidence backing that up. In early August 2026, Scrunch published a product update rolling out new features (Signals, Explorer, and MCP-based natural-language querying). Roadmaps that are about to be frozen don't usually ship new capabilities sixty days after an acquisition. So far, this looks like the good outcome.
But "the product still works" is a low bar. The deeper issue for any brand using a GEO platform is what happens to the data underneath the product, and that's where the paperwork gets interesting.
Why your data is the real prize in these deals
Think about what a GEO platform actually holds after a year of use. Your tracked prompts and how they perform over time. Your competitor set and their visibility trends. Site audit results. Content gap analyses. Crawler behavior on your domain. In some cases, agent-delivery configurations sitting at the edge of your website.
Individually, none of this looks sensitive. Collectively, it's a detailed map of your AI search strategy, your weaknesses, and the competitive intelligence you'd rather not hand to anyone. And there's a second reason this data is valuable: it's irreplaceable.
AI search behavior changes fast enough that historical time series are the whole point of the tool. Promptwatch's data on the GPT-5.3 rollout shows average citations per ChatGPT response dropped measurably across models around March 4, 2026. Then in August, ChatGPT Search started using the site: operator at scale, jumping from roughly 0.4% to 17% of fanout queries overnight. If your vendor's data disappears or gets reset in a migration, you can't reconstruct the before-and-after picture those events created. Your benchmarks are gone.
That's what makes vendor stability a data governance issue, not just a procurement annoyance.
What the paperwork actually says
Here's the part most marketing teams miss. The public privacy policy is not the document that governs your brand's monitored data. Scrunch's own privacy policy says so in plain language: "This Privacy Policy does not apply to content that we process on behalf of customers of our commercial offerings ('Customer Data'). Our processing of Customer Data is governed by the contracts that we have in place with our customers, not this Privacy Policy."
So if you want to know what Sitecore can do with your Scrunch data, you read your MSA, not the privacy page. A few specifics from the Scrunch paperwork worth noting:
- The privacy policy was last modified August 15, 2024, well before the acquisition. Standard practice, per legal guidance on business transfers, is that policies should disclose when data will transfer to a new owner in an acquisition and that users get notice. Whether Scrunch's pre-acquisition policy contains adequate business-transfer language is exactly the kind of thing a customer should ask about.
- The terms of use prohibit using the service to "train or fine-tune any general-purpose (foundational) generative AI model." That matters because it limits what an acquirer can do with pooled customer data unless contracts are renegotiated.
- The terms reserve the right to delete account data after termination, without specifying the retention window in the visible text. If your contract doesn't state a deletion timeline, you're relying on the vendor's goodwill.
- On the reassuring side, Scrunch's FAQ confirms it doesn't collect personal information from members of the general public when monitoring AI platforms. The monitored data is mostly brand and competitor intelligence, not consumer PII, which narrows GDPR and CCPA exposure in a transfer.
There's also a layer above Sitecore that few customers think about: Sitecore itself is majority-owned by EQT, the Swedish private equity firm. So Scrunch customer data now sits inside a PE-backed platform company. That's not inherently bad, PE ownership often comes with real compliance investment, but it means the ultimate decision-maker about your data is two corporate levels removed from the vendor you signed a contract with.
To be fair, Sitecore brings a stronger compliance posture than most startups can afford. Its Managed Cloud offering has held ISO 27001, ISO 27017, ISO 27018, CSA STAR, and SOC 2 Type 2 certifications since January 2019, and it publishes a standard Data Processing Addendum. If your data ends up on Sitecore infrastructure, it lands in a more audited environment than most standalone GEO tools can offer. The open question is whether your contract terms survive the trip.
The Adobe–Semrush lesson: your history doesn't travel
The Scrunch deal isn't happening in a vacuum. Adobe announced its acquisition of Semrush in November 2025, an all-cash deal at $12.00 per share, roughly $1.9 billion in equity value, expected to close in the first half of 2026. Same pattern: a large experience platform buying its way into brand visibility and AI search data.
The Semrush case is useful because it exposes the portability problem concretely. Industry analysis of switching between Semrush and rival BrightEdge found that neither platform offers a formal migration tool, ranking history and benchmarks don't transfer, and prompt tracking history doesn't transfer either. AI visibility benchmarks have to be re-established from scratch in the new platform.
Read that again in the context of an acquisition. If your GEO vendor gets bought, you decide to leave, and your historical data can't come with you in a usable format, then your "choice" to stay or go is heavily constrained. The vendor's promise that everything stays the same is doing a lot of load-bearing work.
The four ways these deals play out for customers
Based on how SaaS acquisitions typically go, and what we've seen so far from Scrunch specifically, here are the realistic outcomes:
| Outcome | What it looks like | Early warning signs | Real-world example |
|---|---|---|---|
| Maintained standalone | Product keeps shipping, pricing holds, data stays put | New features post-acquisition, public roadmap commitments | Scrunch shipped Signals, Explorer, and MCP querying two months after the Sitecore deal |
| Absorbed into the suite | Your tool becomes a module; you're pushed toward the parent platform's contract and pricing | "Scrunch, a Sitecore company" branding, bundled sales calls, feature freeze on the standalone product | Scrunch recommendations being automated into SitecoreAI's content workflows is a step in this direction |
| Repositioned upmarket | Entry pricing rises, small accounts deprioritized | New enterprise-only tiers, self-serve onboarding quietly dropped | Scrunch's Core plan at $250/month was already priced for committed teams, not testers |
| Sunset | Product winds down, data deleted on a timeline you don't control | Missed releases, support slowdowns, migration deadlines | No GEO example yet, which is itself worth noticing, the category is too young |
I'd put Scrunch somewhere between the first and second outcome right now. The messaging says standalone; the press release says the recommendations will be automated within SitecoreAI's content management and digital asset management products. Both can be true for a while. Eventually, acquirers consolidate because that's the point of acquiring.
A due diligence checklist for your next GEO contract
The time to protect yourself is before you sign, not after an acquisition email lands in your inbox. Here's what to negotiate, based on standard SaaS vendor due diligence practice:
- Change-of-control notice. A clause requiring the vendor to notify you within a set number of days if the company is acquired, with a termination right that follows. Without it, you find out when everyone else does.
- Guaranteed export format and window. Specify that you can export all your data (prompt history, citations, audit results) in a machine-readable format, and that you get a defined grace period after termination. Vendor practice varies widely here; some grant a portable export window, others restrict access immediately.
- Deletion rights with a timeline. Scrunch's terms reserve the right to delete account data after termination without stating when. Get the window in writing, both for your own records and for compliance purposes.
- No-training clause. Confirm in the contract, not just the terms of use, that your data can't be used to train general-purpose models. Scrunch has this in its public terms, which is good, but public terms can change.
- DPA and transfer mechanisms. If you're in the EU or handle EU data, verify the data processing addendum and cross-border transfer mechanisms will survive an acquisition. Data privacy teams consistently flag this as the messiest part of system mergers.
- API access. A REST API means you can pull your data on your own schedule instead of waiting for a manual export. This single clause does more for your negotiating position than anything else on the list.
What to do in the first 90 days after your vendor is acquired
Say the email arrives tomorrow. Privacy practitioners who've been through system mergers recommend a phased approach rather than panic:
First 30 days: don't assume, verify. Study the acquired company's actual data practices, not just the documented ones. Meet with your account manager and ask direct questions: Does my data move to the acquirer's infrastructure? When? Under which contract? Does my pricing change at renewal? Request written answers. Also start exporting everything you can, immediately, before any migration changes what's available.
Days 30 to 90: watch for the consolidation signals. Expect a spike in complexity as systems merge, privacy teams report that data subject access requests get harder when personal data spans multiple environments. Track whether the product roadmap keeps moving, whether support quality holds, and whether your renewal quote changes. Review the updated privacy policy and terms when they arrive, and specifically look for the business-transfer disclosure language.
In parallel: re-establish your benchmarks elsewhere. Because prompt tracking history doesn't transfer between platforms, start capturing your current visibility numbers now, even in a basic spreadsheet, so you have a baseline if you ever need to switch. If you run a second platform in parallel, even at a low tier, you've bought yourself continuity insurance.
Building a lower-risk setup going forward
The uncomfortable truth is that GEO is a young category moving through its first wave of consolidation, and consolidation is how young categories mature. Sitecore buying Scrunch and Adobe buying Semrush won't be the last of these deals. More startups will raise money, grow, and get acquired, and some of your vendors will be among them.
Practical steps that reduce your exposure:
- Prioritize platforms with open API access and documented export. Promptwatch, for example, exposes a REST API and CSV exports on every plan, which means your data leaves the platform on your schedule, not the vendor's.
- Export on a cadence, not once a year. Monthly CSV pulls of your prompt performance and citation data cost you nothing and preserve the historical series that can't be rebuilt.
- Keep your prompt list and competitor set in your own documentation. The strategy should live with you even if the tracking data can't.
- When evaluating new vendors, weigh company stability alongside features. A VC-backed startup two funding rounds from an exit will treat your data differently than a company built to stay independent. The GEO software directory at bestgeosoftware.com is a reasonable starting point for comparing what's out there, including each vendor's data export story.
The bottom line
The Scrunch acquisition looks like a good outcome so far: the product is shipping, the company says it's staying standalone, and Sitecore's compliance certifications are stronger than most startups can claim. But the deal also surfaced facts every GEO buyer should internalize. Your monitored data is governed by your contract, not the privacy policy. Scrunch's privacy policy predates the acquisition. And the Adobe–Semrush parallel shows that when you do want to leave, your history probably won't come with you.
None of this is a reason to avoid GEO platforms. It's a reason to sign better contracts, export your data regularly, and treat vendor ownership as a live variable in your stack rather than a footnote. The brands that get burned in these deals aren't the ones that picked the wrong tool. They're the ones that never asked who'd own the data when the tool changed hands.