Privacy Policy

1. Scope

This Privacy Policy describes how Vivander Advisors LLC ("Vivander," "we," "us," or "our") collects, uses, and shares information when you use the Vivander Visibility service, including the website at aivisibility.vivander.ai and its public pages (collectively, the "Service"). The Service is a business tool sold to organizations, and this policy applies to the people who use it on their behalf and to visitors who contact us through the website.

For account, billing, inquiry, and usage information, we decide how the information is used. For personal information that a customer places in the Service as part of its own business data, we process it on that customer's behalf and under its instructions, and the customer's own privacy notice also applies.

2. Information We Collect

Account information. When we set up an account for you, we collect your name, email address, organization name, and role. Sign-in is handled by our authentication provider, and we do not store your password in plain text.

Inquiry information. When you request an audit or contact us through the website form, we collect the details you enter: company name, website address, your name, role, email address, phone number (optional), your main concern, competitor names, and the campaign or page that referred you.

Customer data. We collect the information you or your team provide to configure measurement, including business names, website addresses, business facts you confirm, competitor names, and the questions (prompts) we test. We store the results of each measurement run, including the prompts sent, the answers AI platforms returned, the sources those answers cited, and the scores we derive from them.

Public web and listing data. To measure visibility, we read publicly available pages and records about your business and the competitors you name. This includes website pages, directory and review listings, social profiles, and articles that mention a business.

Connected analytics data. If you choose to connect Google Analytics 4 or Google Search Console, we receive read-only access to the property or site you authorize. Section 5 describes how we handle that data.

Billing information. Payments are processed by Stripe. We store a Stripe customer reference, your plan, subscription status, and credit balance.

Card numbers are entered with and held by Stripe, never by us.

Assistant conversations. If you use the in-app Assistant, we store your questions and its replies so the conversation can continue across pages.

Usage and technical data. Our servers record IP addresses, browser type, pages requested, and timestamps in access logs. We use this information to operate, secure, and troubleshoot the Service.

3. How We Use Information

We use the information we collect to:

• Deliver the Service, run the measurements you request, and produce your scores and reports.
• Authenticate your account and keep it secure.
• Respond to inquiries and prepare an audit you requested.
• Process payments and manage subscriptions and run credits.
• Send service emails, such as account setup, password resets, run summaries, and billing notices. You can opt out of non-essential product update emails at any time.
• Detect and prevent fraud, abuse, and security incidents.
• Improve the Service, including through aggregated, de-identified analysis that does not identify an individual or a customer's business.
• Comply with legal obligations.

Legal bases (EU and UK users). We process personal data to perform our contract with you or your organization, for our legitimate interests in operating, securing, and improving a business service, with your consent where we ask for it (for example, when you connect a Google account), and to meet legal obligations.

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use it for automated decisions that have legal or similarly significant effects on individuals.

4. Service Providers and Sub-Processors

We use the following service providers to deliver the Service. Each receives only the data it needs for the purpose listed and processes it under its own terms with us.

AI providers keep what we send them. To measure your visibility we send questions about your business to the AI providers listed below. You should assume each provider stores those questions and its answers and may use them under its own terms, which can include improving its models.

What we send is public business information: business and competitor names, locations, offerings and the questions a customer might ask. We do not send the personal information of your staff or your customers to these providers.

We send data to AI providers through their commercial application programming interfaces (APIs), not through consumer chat products. Each provider's API terms govern how long it keeps those requests and whether it may use them. A current list of providers, and the data-use settings we rely on with each, is available on request at [email protected].

Some application pages load open-source charting libraries from the jsDelivr content delivery network, which receives your IP address when those files load.

5. Google Analytics and Search Console Data

Connecting Google Analytics 4 or Google Search Console is optional. When you connect, we request read-only access: analytics data and the list of properties you can see, or Search Console performance data. We store an encrypted refresh token (AES-256-GCM) and request a short-lived access token for each daily sync.

We use this data only to show traffic and search performance alongside your visibility measurements in your own account. We do not sell it, use it for advertising, or send it to the AI providers listed in Section 4, and we do not use it to train AI models. Our people read it only with your permission, for security, or to meet a legal obligation.

You can disconnect at any time in the Service or revoke access in your Google account permissions.

6. Data Sharing

We share personal information only with the service providers listed in Section 4, with other users in your own organization's account, and as required by law (for example, in response to a valid subpoena, court order, or government request). If the law requires us to disclose your data, we will try to notify you first where the law permits.

Who sees your account. Your account is private to your organization. Our team accesses your data only to deliver the Service you ordered (for example, to prepare an Audit or set up monitoring), to support you at your request, to investigate or prevent a security problem, fraud or abuse, or when the law requires it. We never sell it.

If Vivander Advisors is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. This policy will continue to apply to it unless you are notified otherwise.

7. International Transfers

The Service is operated from the United States. Our database and application servers are hosted in the United States, and some service providers in Section 4 may process data in other countries. If you are located in the European Union, United Kingdom, or another jurisdiction with data transfer rules, your data will be transferred to and processed in the United States.

Where the law requires a transfer mechanism, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable. You may request a copy by contacting us at [email protected].

8. Data Retention

Account information is retained while your account is active. If you close your account, we delete your personal account information within 30 days.

Customer data and measurement results are retained for the life of your account, because each new score is compared with the ones before it. We delete them within 30 days of account closure, unless you request earlier deletion or we must keep them for legal or compliance reasons.

Inquiry information is retained while we respond to you and for as long as a business relationship continues, and is deleted on request. Billing records are kept for as long as tax and accounting law requires. Server and access logs are retained for up to 30 days.

Download and deletion on request. You can export your reports and data from the Service at any time. You can also ask for a copy of your data, or for your account and its data to be deleted, by emailing [email protected] from the address on your account. Deleted data is removed from our live systems straight away and from backups as they expire, normally within 30 days. Deletion cannot be undone, so export anything you want to keep first.

9. Your Rights

If you are in the EU or UK (GDPR and UK GDPR), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request erasure of your personal data in certain circumstances.
• Restrict or object to our processing of your personal data, including processing based on legitimate interests.
• Receive your personal data in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.
• Lodge a complaint with your local data protection authority.

If you are a California resident (CCPA as amended by the CPRA), you have the right to:

• Know what personal information we collect, use, and disclose.
• Delete personal information we hold about you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information.
• Limit the use of sensitive personal information. We do not collect sensitive personal information as defined by California law.
• Not be treated differently for exercising a privacy right.

Residents of other US states with consumer privacy laws may have similar rights, and we honor those requests on the same terms. You may use an authorized agent to make a request on your behalf.

To exercise any of these rights, email [email protected] with the subject line "Privacy Request." We will confirm receipt within 10 business days and respond within 30 days, or within the period your local law sets. We may need to verify your identity before acting on a request.

If your request concerns data a customer placed in the Service about you, we will refer it to that customer and assist them in responding.

10. Cookies and Local Storage

We use first-party cookies to keep you signed in. These cookies are set by our own server, are not readable by page scripts, and are strictly necessary for the Service to work.

The application also uses your browser's local storage to remember preferences, such as the website you last selected, your date range, and an open Assistant conversation. This information stays in your browser and is not used to track you.

Analytics on our public pages. Our public pages (aivisibility.vivander.ai and audit.vivander.ai) use Google Analytics 4 to count visits and requests. Google Analytics sets its cookies only if you choose Accept in the cookie notice. Until you choose, Google receives visit counts with no cookies. If you choose Decline, the pages do not load Google Analytics. You can change your choice with the "Cookie choices" link at the bottom of every public page. We do not use Google Analytics inside the signed-in application.

When you arrive from a campaign link, the page keeps the campaign tags, the first page you viewed, and the referring site in your browser's session storage for that visit. If you send a request through one of our forms, the campaign source and campaign name are saved with your request.

We do not use advertising cookies, tracking pixels, or cross-site tracking technologies. You can clear cookies and local storage in your browser settings; clearing the sign-in cookie will sign you out.

11. Security

We use TLS encryption for data in transit. Data at rest is encrypted by our infrastructure providers, and connected Google account tokens receive an additional layer of application encryption. Access to production data is limited to authorized personnel who need it to operate the Service.

No security system is perfect, and we cannot guarantee that unauthorized parties will never gain access to your data. If we learn of a security breach affecting your personal data, we will notify you and the relevant authorities as applicable law requires.

Risks you should understand. No online service is completely secure. Despite reasonable precautions, information can be intercepted, accessed without permission, altered or lost, including through hacking, malware or a failure at one of the providers listed in Section 4. By using the Service and connecting accounts to it, you accept these risks, as set out in our Terms of Service, which also limit our liability for them. Do not enter government ID numbers, bank or card numbers, passwords, health information or other sensitive personal information into the Service, and connect only the accounts and permissions you are comfortable sharing.

12. Children

The Service is a business tool and is not directed to anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected such data, contact us at [email protected] and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service, our service providers, or applicable law. When we make material changes, we will notify account holders by email or by a notice within the Service at least 14 days before the changes take effect. The dates at the top of this page always reflect the current version.

14. Contact and Data Protection

For privacy questions, data access requests, or to exercise any of the rights described above, contact:

Vivander Advisors LLC
Attn: Privacy
[email protected]

We have not appointed a formal Data Protection Officer. For EU and UK data protection inquiries, the contact above serves as our point of contact.