Privacy Policy

1. Who we are

Visora provides AI Visibility measurement software. For the personal data described in this policy we act as the data controller, except where we process customer data on your instructions as part of delivering the service, where we act as a processor. Contact: privacy@visora.app.

2. Data we collect

• Account data: name, email address, organisation name, role and authentication metadata.
• Business data you provide: business name, website, services, locations, sector and named competitors.
• Analysis data: the customer questions generated for your business, the AI responses recorded during testing, the observable signals audited, and the scores and recommendations produced.
• Commercial data: plan, purchase history and subscription status. Card details are handled by our payment provider and are never stored by Visora.
• Technical data: IP address, device and browser information, and application logs needed to operate and secure the service.
• Support data: messages you send us and the records needed to respond.

3. Why we use it and our lawful basis

We do not sell personal data, and we do not use your business data to train third-party AI models.

• To provide the service you purchased — performance of a contract.
• To operate, secure, monitor and improve the platform — legitimate interests.
• To send service and billing communications — performance of a contract.
• To send marketing communications — consent, withdrawable at any time.
• To meet accounting, tax and legal obligations — legal obligation.

4. How reports are generated

To produce an audit we generate representative customer questions for your sector and locations, submit those questions to third-party AI assistants, and record which businesses were named in each response. We also review publicly available signals about your business, such as your website, structured data, listings, citations and reviews.

The prompts sent to AI providers contain the business details you supply, which are typically business information rather than personal data. Do not enter personal data into business fields if you do not want it included in testing.

5. Subprocessors and third parties

Each provider is engaged under a written agreement requiring them to process data only on our instructions and to apply appropriate security measures. Where data is transferred outside the UK or EEA, we rely on approved transfer mechanisms such as Standard Contractual Clauses or a UK adequacy decision.

• Cloud hosting and database infrastructure used to run the platform and store your data.
• AI model providers used to generate customer questions and record observed responses during testing.
• Payment processing for purchases and subscriptions.
• Email delivery for account, billing and report notifications.

6. Retention

• Account data: retained while your account is active and for up to 12 months after closure.
• Analysis and report history: retained for the life of the account so trends stay comparable, and deleted on request.
• Billing records: retained for 6 years where required by tax and accounting law.
• Application logs: retained for up to 12 months.

7. Your rights

Where UK GDPR or EU GDPR applies you have the right to access, correct, erase, restrict or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time.

To exercise any right, email privacy@visora.app. We respond within one month. You may also complain to your local supervisory authority, which in the UK is the Information Commissioner's Office.

8. Deletion and export

You can request deletion of your account, business records and analysis history at any time. Deletion removes your data from live systems immediately and from encrypted backups within 30 days, except where we must retain records for legal reasons. You can also request a machine-readable export of your account and report data.

9. Security

Access to your data is restricted by authenticated accounts, organisation membership and row-level database policies. Data is encrypted in transit and at rest by our infrastructure providers. No system can be described as completely secure, and we do not make absolute security claims.

Report a suspected vulnerability or security issue to security@visora.app.

10. Changes

We update this policy when our practices change. Material changes are communicated by email or in-product notice, and the revision date above is always current.