Privacy Policy

1) Overview

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit or use our Service. “Personal data” means information that identifies or can reasonably be linked to an individual.

2) Information we collect

• Audit inputs: business/entity name, website/domain, category/industry, location, and related parameters you submit.
• Contact information: if you provide it (e.g., email) for receipts, report delivery, support, or updates.
• Payment information: payments are processed by our payment processor (e.g., Stripe). We receive limited payment metadata (e.g., payment status, transaction IDs), not full card details.
• Usage and device data: IP address, user agent, approximate location (city/region), pages viewed, and request logs for security and troubleshooting.
• Cookies/local storage: we may set cookies required for the Service to function (for example an access token cookie such as vi_token after purchase).

3) How we use information

• Provide, run, and deliver audits and reports.
• Authenticate access to paid features (including via cookies).
• Process payments and prevent fraud.
• Operate, maintain, and secure the Service (rate limiting, abuse detection, logging).
• Improve the Service (debugging, performance, product analytics).
• Communicate with you (support responses, service updates where allowed).

4) Third-party processing (LLMs, search/retrieval, payments)

To generate audits, we may send audit prompts and related context to third-party providers (for example LLM providers and search/retrieval APIs). Your audit inputs and derived queries may be processed by those providers in order to return results. We also use third-party processors for payments (for example Stripe). These providers process data under their own terms and privacy practices.

5) Legal bases (EEA/UK users)

If you are in the EEA/UK, our legal bases for processing may include: (a) performance of a contract (to deliver the audit you request), (b) our legitimate interests (security, fraud prevention, improving the Service), and (c) consent (where required for optional cookies/marketing).

6) How we share information

We may share information with:

• Service providers that help us operate (hosting, logs/monitoring, payment processors, email delivery).
• Compliance and legal authorities if required to comply with law or protect rights/safety.
• Business transfers if we undergo a merger, acquisition, or asset sale (subject to this Policy).

We do not sell your personal data. We do not share personal data with third parties for their own direct marketing purposes without your consent.

7) Data retention

We retain audit runs, evidence artifacts, and related logs for as long as necessary to provide the Service, support customers, and meet legal/security obligations. Typical retention targets: 12 months for audit artifacts and 30–90 days for raw access logs, unless a longer period is required by law or needed for fraud prevention. You may request deletion as described below.

8) Your rights

Depending on your location, you may have rights to access, correct, delete, or object to processing of your personal data, and to receive a copy of your data. To exercise rights, contact privacy@visibilityindex.ai.

9) International transfers

We may process and store information in the United States and other countries where our service providers operate. Where required, we use appropriate safeguards for cross-border transfers (for example, standard contractual clauses).

10) Security

We use reasonable administrative, technical, and organizational measures to protect information. However, no method of transmission or storage is 100% secure.

11) Children

The Service is not intended for children under 13 (or the age required in your jurisdiction). We do not knowingly collect data from children.

12) Changes to this Policy

We may update this Policy from time to time. The “Effective date” above reflects the latest revision.

13) Contact

Privacy questions? Contact privacy@visibilityindex.ai.

Note: Replace bracketed placeholders (entity name, emails, address, retention periods) before publishing.