Privacy Policy

Last updated August 25, 2026 · Questions: [email protected]

Who we are

Visibled ("we", "us") operates visibled.com, a service that measures how AI assistants talk about a business and helps improve it. This policy covers the visibled.com website and the Visibled application. Contact: [email protected].

Information you give us

Account and team

When you sign up we collect your email address and name. Authentication is handled by Supabase. If you invite a teammate we store their email address, the role you assigned, and the invitation status.

Content you add

Running Visibled means giving it things to work on: the domains and projects you add, benchmark questions, business profile details (including names of practitioners you choose to list), conversations with the in-app Assistant and Ad Studio, uploaded brand assets and reference images, and links to social videos you paste in.

Billing

Payments are processed by Stripe. We share your email address and workspace name with Stripe and keep a reference to your Stripe customer and subscription. Card numbers are entered on Stripe's hosted pages and never touch our servers.

Information collected automatically

• Google Analytics 4 measures how the site and app are used: pages viewed, device and browser information, and approximate location. It sets Google cookies (names starting with _ga).
• Microsoft Clarity records clicks, scrolls, and session replays of the screens you view, including inside the app, so we can find and fix usability problems. It sets the _clck and _clsk cookies.
• Server logs record requests for reliability and security, and can include your email address. Logs are streamed to Better Stack, our monitoring provider, and are short-lived.
• The free scan page uses Cloudflare Turnstile to block bots, which processes your IP address. We store only a salted, truncated hash of the IP with the scan, and free-scan records are deleted automatically within about 90 days.

Data the service generates

Visibled produces data about the brands it monitors: stored AI answers, visibility scores, citations, sentiment summaries, crawled text from the website you add and from public pages that AI systems cite, public Reddit posts relevant to your brand, transcripts of social videos you paste in, and generated content such as page drafts, blog posts, and ad images or video. Media created in Ad Studio is stored at publicly accessible (unguessable) URLs so that rendering and video tools can read it.

Google user data

If you connect Google Search Console or Google Analytics, we request read-only scopes: webmasters.readonly (Search Console), analytics.readonly (Google Analytics), and openid/email to identify which Google account you connected.

• What we access: your Search Console site list, search analytics (queries, pages, clicks, impressions, positions), URL index status, and your Analytics property list with aggregate traffic reports.
• How it is stored: the OAuth refresh token is encrypted at rest with AES-256-GCM. Analytics reports are fetched on demand and not stored. Search Console query text may be saved when it becomes a benchmark prompt suggestion, and per-URL index status is cached for the Indexing feature.
• What we never do with it: no advertising, no selling, no training AI models on it, and no human access except for support you request, security, or legal compliance.
• Disconnecting: removing the connection in Visibled deletes the stored token and revokes our access with Google. You can also revoke access any time from your Google Account security settings.

Visibled's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How AI providers are involved

Scans work by asking AI systems the questions your buyers ask. Those requests contain the benchmark question and a generic consumer persona, never your name, email, or account details. Analysis and content generation send brand-level material to AI providers: stored AI answers, your business name, services, locations, listed practitioner names, crawled website text, and connected Search Console queries. The providers we use are OpenAI, Anthropic, Google, xAI, and Perplexity (largely via OpenRouter), plus DataForSEO for search-based answer engines, and Fal.ai for ad video generation. Audio from social videos you paste is transcribed by OpenAI. We do not use your content to train AI models.

Service providers

We share data only with the processors that run the product:

• Supabase: authentication and database hosting
• Heroku (Salesforce) and AWS: application hosting, file storage, and video rendering
• Stripe: billing
• Resend: transactional email (scan reports, invites, weekly summaries)
• OpenRouter, OpenAI, DataForSEO, Fal.ai: the AI processing described above
• Google Analytics and Microsoft Clarity: product analytics
• Better Stack: log monitoring
• Cloudflare: bot protection, and crawler analytics for zones you connect
• Bright Data: rendering pages that block automated fetching

Integrations you connect yourself (Google, Cloudflare, WordPress, Bing Webmaster, and AI assistants via the read-only MCP connector) exchange data only after you approve them, and only within the scope you granted. Team members in your workspace can see the projects shared with them. Beyond that, we disclose data only if the law requires it. We do not sell personal information.

Retention and deletion

• Account and project data is kept while your account is active.
• Deleting a project deactivates it rather than destroying it, so re-adding the same domain restores your scan history. Email us for permanent deletion.
• Free-scan records from the public scan page are deleted automatically within about 90 days.
• Disconnecting an integration deletes its stored credentials.
• Billing records are retained as required for accounting and tax purposes.

Security

All traffic is encrypted in transit with TLS. Integration credentials (Google refresh tokens, Cloudflare tokens, WordPress passwords, Bing keys) are encrypted at rest with AES-256-GCM. Connector access tokens are stored only as hashes. Card data never reaches our systems. No method of storage or transmission is completely secure, but we work to protect your information and will notify you of any breach as the law requires.

Your choices and rights

• Access, export, correct, or delete your data by emailing [email protected].
• Depending on where you live (for example the EEA, UK, or California), you may have additional legal rights to access, correct, delete, or port your data, and to object to processing. We honor these requests regardless of where you live.
• Cookies can be blocked or cleared in your browser settings; the product works without analytics cookies.
• We do not send marketing email except to free-scan leads who requested a report, and every such email has an unsubscribe link.

Children

Visibled is a business tool and is not directed to children. We do not knowingly collect data from anyone under 16.

International transfers

We are based in the United States and process data there. If you use Visibled from elsewhere, your data is transferred to and processed in the United States.

Changes to this policy

When our data practices change, we update this page and the date at the top. Meaningful changes will be called out in the app or by email.

Contact

[email protected]