Privacy Policy

Last Updated: September 2026

1. Introduction

Vizoryo Ltd. is committed to protecting the privacy of individuals whose personal data we process. This Privacy Policy explains how we collect, use, share, and protect personal data in connection with our platform and services.

Vizoryo acts as a data controller under the EU General Data Protection Regulation (GDPR) for personal data collected through the Service.

This Policy applies to website visitors, registered users, business representatives who manage business profiles, and individuals whose data appears in publicly available business information we aggregate. In this Policy, "business profile" means the structured business listing we maintain (presented in the product interface as an "AI Identity"), whether claimed by a representative or auto-discovered from public sources.

2. Data We Collect

Data You Provide Directly

Account Data

Email address, name, password (hashed) for account creation and authentication.

Payment Data

Billing address, payment method (processed by Paddle) for subscriptions.

Profile Edits

Business name, services, contact information, hours for profile management.

Communications

Support requests, feedback, and correspondence.

AI Assistant Chat

Messages you exchange with our on-site AI assistant are stored so we can review conversation quality, understand common questions and interest in our plans, and improve the Service. Please avoid sharing sensitive personal information in chat.

Communication Preferences

Whether you have opted out of commercial email, the unsubscribe token that lets you manage that without logging in, and — where you gave explicit consent to a follow-up series — the exact wording shown to you, the time, and the IP address and region recorded as evidence of that consent.

Data Collected Automatically

Usage Data

Pages viewed, features used, audit history for service improvement.

Device Data

Browser type, operating system, device identifiers for security and compatibility.

Log Data

IP address, access timestamps, referral URLs for security and fraud prevention.

Cookies

Session cookies, analytics cookies and, only with your consent, marketing cookies, for functionality, analytics and advertising measurement.

Data from Public Sources

Vizoryo collects publicly available business information from geographic datasets, business directories, review platforms, social media, and business websites. This data is collected under the legitimate interest basis (GDPR Art. 6(1)(f)).

Accounts Created on Your Behalf

When a business is claimed using your email address by a reseller or partner acting on your behalf, a Vizoryo account is created for that email address. The email address is processed to create and secure the account, send account-setup and service communications, and deliver the subscription service associated with the claimed business. You may access, rectify, or request deletion of this data at any time by contacting privacy@vizoryo.com — the same rights apply as for any account you create directly.

Partner Program Payout Data

If you take part in the Vizoryo Partner Program, we collect and process the information we need in order to pay you and to issue the tax documents the law requires. This is separate from the payment data we collect when you buy a subscription — money moving out to a partner is regulated differently from money coming in from a customer. We collect:

Identity and address — legal or trading name, entity type, and the registered street address, city, postal code and country of the partner business.

Tax data — tax or company registration number, VAT status and rate, withholding-at-source rate, and the books and withholding certificates you upload, together with their validity dates.

Bank details — the account we send payouts to. Bank details are encrypted before they are stored (AES-256-GCM) and are never held in readable form in our database; only the last four digits and the account currency are shown back to you or to our finance team.

Finance contact — the name, email address and phone number of the person at the partner who handles invoicing.

Payout records — the commission ledger, payout statements, and the documents held against your partner account, including invoices, credit notes, receipts and signed partner agreements.

The legal basis is performance of a contract (GDPR Art. 6(1)(b)) for calculating and making the payout, and legal obligation (Art. 6(1)(c)) for the tax, invoicing and accounting records we are required to keep. We do not use this data for marketing or profiling. It is shared only with the payment and accounting providers needed to move the money and issue the documents, and with the tax authorities where the law requires it.

How commission itself is calculated, held and paid is described in the Partner Commission & Payout Terms at /legal/partner-terms.

3. Legal Basis for Processing

We process personal data on the following legal grounds: performance of a contract — creating and running your account, delivering the audits, business profile and subscription you signed up for, and sending the service messages that go with them; legitimate interest — compiling and maintaining the public business index, scoring, product analytics, security and fraud prevention, keeping a record of the email we have sent and of every unsubscribe and bounce so that an opt-out cannot be lost, and sending our own existing customers messages about similar Vizoryo products and services; consent — analytics and marketing cookies, and the follow-up email series offered to people who run an audit without creating an account; and legal obligation — tax, accounting and other compliance requirements.

For processing based on legitimate interest (GDPR Art. 6(1)(f)), Vizoryo has conducted a balancing assessment: (a) Purpose: enabling AI systems to accurately discover and represent businesses is a lawful and beneficial purpose; (b) Necessity: indexing publicly available business data is necessary to operate the Service — no less intrusive alternative achieves the same result; (c) Impact: the data processed is limited to business-related information already made public by the business itself, minimizing impact on individual privacy; (d) Reasonable expectations: businesses publishing information on public websites, directories, and social media should reasonably expect that information to be indexed by data services. This assessment is documented and available to supervisory authorities upon request.

Marketing email — the basis we rely on, stated plainly. If you hold a Vizoryo account, we send you messages about our own similar products and services on the basis of legitimate interest (GDPR Art. 6(1)(f)) together with the existing-customer "soft opt-in" in Article 13(2) of the ePrivacy Directive 2002/58/EC and its national implementations, including UK PECR reg. 22(3): you gave us your address in the course of obtaining our service, the messages concern our own similar services, and a free and simple way to refuse is offered both at the point we collect the address and in every message we send. In Israel we rely on the existing-customer exception in section 30A(c) of the Communications (Telecommunications and Broadcasting) Law, 5742-1982. In the United States these messages comply with the CAN-SPAM Act. We do not rely on your consent for them, so there is no consent for you to withdraw — instead you have an unconditional right to object at any time under Art. 21(2) GDPR, and we honour it by stopping. Consent, recorded individually together with the wording shown and the time it was given, is the basis only for the follow-up series offered to people who run an audit without creating an account, and for analytics and marketing cookies.

Checkout reminders — if you start a checkout and do not finish it, we may send you up to two reminder emails with a link back to the plan you were choosing. These are commercial messages, sent on the same basis as the rest of our existing-customer email (legitimate interest, GDPR Art. 6(1)(f), with the existing-customer soft opt-in), and each one carries a working unsubscribe link. You may opt out at any time and we stop; opting out does not affect your account or any receipt or service message.

4. How We Use Personal Data

5. Data Sharing

Vizoryo does not sell personal data. We share data only with:

Supabase (database hosting and authentication).

Paddle (payment processing).

HYP (payment processing for customers billed in Israeli Shekel).

Resend Inc. (email delivery).

Google LLC — AI processing services used to analyse business websites and generate profile content (anonymized inputs, website URLs and on-page content only).

Business data providers — commercial search and business-listing data services used to discover and verify business contact details (business name, domain, category).

Bright Data Ltd. — web data collection infrastructure used to retrieve publicly available business web pages and search results (target website URLs and search queries; no user account data).

Yelp Inc. — matching a business against its public Yelp listing to cross-check profile facts such as address, opening hours and contact details (business name, location and website domain).

Vercel Inc. (frontend hosting and edge functions — processes web request data including IP addresses for routing).

Render (backend hosting — processes server-side request data).

PostHog Inc. — product analytics (user_id, tier, autocaptured events). Data is processed on PostHog's US instance at us.i.posthog.com; transfers of EU/UK personal data are covered by EU Standard Contractual Clauses.

Google LLC (Analytics 4) — page views and events. Only loaded after you grant analytics consent.

Meta Platforms Ireland Ltd. (for users in the EU/EEA) and Meta Platforms, Inc. — measuring our Meta ad campaigns via the Meta Pixel. Unlike the processors above, Meta is not our processor. The pixel is loaded only after you grant marketing consent, and never when your browser sends a Global Privacy Control signal. Once loaded, it receives the pages you view, whether you completed an audit or created an account, your IP address, your browser data and the _fbp and _fbc cookie identifiers, which expire after 90 days. If your browser holds Meta's own cookies (for example, because you use Facebook or Instagram), Meta may also recognize you through them. Meta Platforms Ireland Ltd. and Vizoryo are joint controllers for collecting this data and transmitting it to Meta (Meta Business Tools Terms and Controller Addendum, facebook.com/legal/controller_addendum). In essence: we ask for your consent before the pixel loads and give you this information, and Meta Ireland handles requests to access, correct, erase, restrict or port the data it stores after receiving it — you can make them directly to Meta, and if you send one to us we will pass it on to Meta. Once received, Meta uses the data as an independent controller under its own privacy policy (facebook.com/privacy/policy), and may combine it with other information it has about you, including activity on other websites and apps, to show you ads on and off Meta's services. You can withdraw consent at any time in Cookie Settings, control how Meta uses your data for ads in your Meta ad preferences (facebook.com/adpreferences), and opt out of interest-based advertising at aboutads.info/choices or youronlinechoices.eu. Transfers to the United States rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Google LLC (Fonts) — font CDN; Google logs your IP address when serving font files.

OpenAI, L.L.C. — AI Mentions monitoring (business name, category, location).

Anthropic, PBC — AI Mentions monitoring (business name, category, location).

Instantly.ai (Foo Monk, LLC dba Instantly.ai) — outbound email delivery for cold outreach and claim invitations (recipient email address, contact name where publicly listed, business name, website, phone, city, country, language, industry). Recipients can unsubscribe via the one-click List-Unsubscribe header included in every message.

Each processor listed above is bound by data-processing terms — either a wet-ink-signed Data Processing Agreement or the processor's vendor-standard DPA in force via service activation. Where processors are based outside the EU/EEA, transfers are covered by the EU-US Data Privacy Framework, Standard Contractual Clauses, or Israel's adequacy decision.

Separately from the processors above, you can connect a third-party application — an AI assistant, or any other software built for our connector — from Settings → AI Connections. You choose the application and you approve it yourself. An application approved for your account alone receives no business record: it can only run the audits your account is entitled to. If you approve it for one specific AI Identity you own, it also receives that record, its AI visibility scores and its edit history, and — on a record you have claimed on a paid plan — it can update a limited set of business facts on it.

An application you connect is not one of our processors. We do not select, vet, approve or endorse it, we have no agreement with it, and any application built to the connector standard can ask to connect. Once it receives your data it acts on its own account, under its own terms and privacy policy, and we cannot control, recall or audit what it does with that data afterwards.

Ending a connection in Settings → AI Connections stops any further data reaching that application, immediately. It cannot reach back data that has already been sent. Read an application's own terms and privacy policy before you connect it.

For the complete list of sub-processors and the data categories they process, see our

Sub-Processors page

Published business profiles in the Index are accessible to the public, including AI systems and search engines. Published profiles do not include user account data.

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

Right to Access — request a copy of your personal data.

Right to Rectification — request correction of inaccurate data.

Right to Erasure — request deletion of your data.

Right to Portability — receive your data in a portable format.

Right to Restriction — request limitation of processing.

Right to Object — object to processing based on legitimate interest.

Right to Object to Direct Marketing — you may object to the use of your personal data for direct marketing at any time, for any reason or none. This right is absolute: we stop, and there is nothing for us to weigh against it. Use the unsubscribe link in any commercial message, your account settings, the form at vizoryo.com/unsubscribe, or write to privacy@vizoryo.com.

Right to Withdraw Consent — where we rely on consent (analytics and marketing cookies, and the guest audit follow-up series), you may withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.

Right to Lodge a Complaint — if you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with a data protection supervisory authority. For EU/EEA residents, contact your local supervisory authority (list available at edpb.europa.eu). For Israeli residents, contact the Privacy Protection Authority (PPA) at the Israeli Ministry of Justice.

Automated Decision-Making — our AI Visibility Score and business classifications involve automated processing of publicly available business data. These automated outputs are informational only and do not produce legal or similarly significant effects on individuals. You have the right to request human review of any automated assessment, contest the result, and express your point of view by contacting privacy@vizoryo.com.

To exercise your rights, contact privacy@vizoryo.com. We will respond within 30 days.

7. International Data Transfers

Vizoryo is based in Israel, which has received an EU adequacy decision (Commission Decision 2011/61/EU), permitting data transfers from the EU/EEA without additional safeguards. Vizoryo regularly monitors the adequacy status and, if the decision is rescinded or revised, will promptly implement Standard Contractual Clauses (SCCs) or other EU-recognized transfer mechanisms to ensure continued lawful data transfers.

For transfers to other countries, we rely on the EU-US Data Privacy Framework, Standard Contractual Clauses, or other recognized transfer mechanisms.

8. Data Retention

Account data — duration of account + 3 years.

Payment records — 7 years (tax/legal requirements).

Partner payout records (billing profile, commission ledger, payout statements, signed agreements, tax documents) — 7 years (tax/legal requirements).

Business profile data — until removal requested or business ceases to exist.

AI connection records — which application you connected, which AI Identity you connected it to, the permissions you approved, and the date. Disconnecting an application revokes its credentials immediately, so they stop working the moment you disconnect, and the credentials themselves are deleted within 30 days of expiring. The record of your approval is kept for 12 months after you disconnect, as security evidence, and is then deleted.

Business record edit history — every change made to a business record is kept for as long as the record exists in the Index. Which connected application made a change is kept only for as long as that application's connection record (see AI connection records above).

Claim invitations that were never accepted — the claim link stops working when the invitation expires and is deleted 90 days later. A minimal record that we sent it (the address, the business it concerned, the date, and whether it was unsubscribed or bounced) is kept for as long as we send commercial email, so that an opt-out cannot be lost.

Unsubscribe and suppression entries — kept for as long as we send commercial email, so that an opt-out cannot be lost.

Checkout-reminder records — which reminders we sent you about an unfinished checkout, and when, kept for the life of your account so the two-email limit cannot be exceeded.

9. Data Security

We implement appropriate technical and organizational measures including encryption in transit (TLS 1.2+) and at rest, access controls, regular security assessments, and incident response procedures.

While we strive to protect personal data, no method of transmission over the internet is completely secure. We cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Vizoryo will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay, providing details of the breach, its likely consequences, and the measures taken to address it.

Vizoryo maintains a documented Incident Response Plan defining escalation procedures, notification timelines, and remediation workflows for personal data breaches. This plan is reviewed annually and is available to supervisory authorities upon request.

Embed Widget IP Logging: When a Vizoryo embed widget is loaded on a partner site, we log a one-way salted hash of the visitor's IP address (not the raw IP) together with the referring domain. This is used for abuse prevention and aggregated impression counts. Hashed IPs are deleted after 90 days.

10. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. If discovered, we will delete such data promptly.

If you believe a minor has provided personal data to Vizoryo, contact privacy@vizoryo.com and we will delete the data within 7 days.

11. Changes to This Policy

We may update this Policy from time to time. The current version is always published here, and the “Last Updated” date is revised when it changes. Where a change materially affects how we handle your personal data, we will bring it to your attention.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Your rights include:

Right to Know — request details about the personal information we collect, use, and disclose about you.

Right to Delete — request deletion of personal information we have collected from you.

Right to Opt-Out of Sale/Sharing — We do not sell personal information for money. We share limited identifiers (cookie IDs, user agent, IP-address-derived region) with Google Analytics and PostHog for first-party analytics purposes, contingent on your analytics consent. If you allow marketing cookies, the Meta Pixel sends Meta identifiers (cookie IDs, IP address and browser data) together with the pages you view and whether you completed an audit or created an account, to measure our advertising, which California law may treat as a "sale" or "sharing" for cross-context behavioral advertising. Under California law this disclosure operates as your notice; you may opt out at any time by rejecting analytics and marketing cookies in Cookie Settings or by sending a Global Privacy Control signal, which we honor automatically.

Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.

To exercise your rights, contact privacy@vizoryo.com. We will verify your identity and respond within 45 days.

13. AI Data Processing

Vizoryo uses third-party AI services to process business website data. When you run an audit, the following data may be sent to AI providers for processing:

For more details about how AI is used in our Service, see our AI Disclaimer page.

14. Information for Data Subjects — Indirect Collection (GDPR Art. 14)

Vizoryo collects business information from publicly available sources including business directories, review platforms, social media, and business websites. If your personal data (such as your name as a business owner or your contact details published on a business website) appears in a profile created from these sources, this section explains your rights.

Data sources include: publicly accessible business websites, geographic datasets (Google Maps, government registries), business directories, social media business pages, and structured data (Schema.org) published by the business.

Vizoryo provides individual notice to identifiable data subjects where feasible, including through claim invitation emails sent to business contact addresses found during data collection. Where providing individual notice would involve disproportionate effort due to the large-scale nature of public data aggregation and the absence of direct contact information, this privacy policy serves as the required transparency notice under GDPR Art. 14(5)(b). Data subjects may exercise their rights at any time regardless of how they were notified.

You have the right to: access your data (Art. 15), request rectification (Art. 16), request erasure (Art. 17), restrict processing (Art. 18), object to processing (Art. 21), and receive your data in a portable format (Art. 20). To exercise any of these rights, contact privacy@vizoryo.com or use our removal request form at vizoryo.com/removal-request.

The legal basis for processing publicly available business data is legitimate interest (Art. 6(1)(f)). Our legitimate interest assessment is detailed in Section 3 of this policy.

Auto-discovered business profiles are compiled from lawfully obtained, publicly available information about the business and are published to the public Index when they are created. They are not verified by the business or its owner and carry no Verified badge. A business may claim its profile, request correction of inaccurate information, object to the processing, or request removal from the Index at any time — by contacting privacy@vizoryo.com or using our removal request form at vizoryo.com/removal-request.

Sole Proprietors: Where a business profile relates to a sole proprietor or other natural person doing business under their own name, we treat that profile as personal data. Such individuals receive the full GDPR Article 15–21 rights against the profile itself, including the right to immediate erasure on request, regardless of the legitimate-interest basis we rely on for corporate business data.

15. Data Protection Contact

Vizoryo has assessed that the appointment of a Data Protection Officer (DPO) is not currently required under GDPR Article 37, as our core activities do not consist of large-scale systematic monitoring of individuals or processing of special categories of data. This assessment is formally documented, reviewed semi-annually, and available to supervisory authorities upon request.

For all data protection inquiries, including requests to exercise your rights, complaints, or questions about this policy, contact our Privacy Lead at privacy@vizoryo.com. Supervisory authorities may contact us at the same address.

If you are located in the EU/EEA and wish to contact a supervisory authority directly, a list of EU Data Protection Authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en.

Vizoryo monitors its database obligations under the Israeli Protection of Privacy Law and will register with the Privacy Protection Authority's Database Registrar as required by applicable thresholds.

Email We Send You, and the Records We Keep

We send two kinds of email. Service messages are the ones the Service itself requires — verification codes, receipts and invoices, payment and renewal notices, notices about a business profile you own, replies to your support requests, and legal or contractual notices — and they continue for as long as your account is open. Commercial messages are about our own similar products and services: scheduled scan results, alerts when an AI assistant mentions your business, the monthly AI-read digest, product news and plan offers. Section 3 sets out the legal basis for each. Only the commercial ones can be switched off, and switching them off changes nothing else about your account or your subscription.

We keep a record of every email we send you: the recipient address, which template was used, the subject line, whether it was a service or a commercial message, the delivery status our email provider reported, and the timestamps. We use it to show what was sent and when, to investigate delivery failures and support questions, and to make sure the same message is not sent twice. We keep them for as long as your account is open. If you ask us to erase your data, we delete them.

Our email provider reports delivery events back to us — delivered, bounced, or reported as spam — and a bounce or a spam report suppresses the address automatically. Where the provider’s tracking is enabled, an open or a click may also be reported. We record an open or a click only against a claim invitation, so we can tell whether the invitation reached the business it was addressed to. We do not use open or click data to profile you, to score you, or to decide what to offer you or what to charge you.

If you unsubscribe, or if your address hard-bounces or is reported as spam, we add that address to a suppression list and check that list before every send. The list holds the address, the reason and the date — nothing else. We keep an entry for as long as we send commercial email at all, and we keep it even after an account is closed or a deletion request is fulfilled, because deleting it is precisely how an opt-out gets broken. This retention is required to comply with a legal obligation (GDPR Art. 6(1)(c)) and falls within the erasure exception in Art. 17(3)(b); it is also what CAN-SPAM §5(a)(3) and the do-not-contact register under Israeli section 30A require. If you would rather we held a one-way hash of your address instead of the address itself, ask us at privacy@vizoryo.com.

To stop commercial email: use the unsubscribe link at the foot of any such message, use the one-click unsubscribe control if your mail client shows one, turn marketing email off in your account settings, use the form at vizoryo.com/unsubscribe — which does not require you to be logged in — or write to privacy@vizoryo.com. Every one of these is free and takes effect promptly, and an opt-out stays in effect until you ask us to start sending again. Service messages continue while your account is open; closing the account is how those stop.

HYP (Hyp / קבוצת היפ) — For customers who pay in Israeli Shekel, payment is processed by HYP, an Israeli payment provider acting as a data holder (מחזיק) on our behalf. We share with HYP the billing and payment details needed to charge your card, manage your recurring subscription, and issue a tax invoice (חשבונית מס). You have the right to access the personal data we hold about you and to request its correction, in accordance with the Protection of Privacy Law, 5741-1981 (including Amendment 13). To exercise these rights, contact privacy@vizoryo.com.

AI Referral Records

One record per browsing session when you arrive on the site: the page you landed on, the referring address, your browser, operating system and device type, and a two-letter country code. The country is derived from your IP address at the moment of the visit and the IP address itself is never stored. Link parameters are kept so we can tell which AI assistant sent you; any value whose name suggests a credential, key or email address is replaced before it is written, and a referring address is stored without its query string. We use a single browser-session flag so one visit is not counted twice. This data is first-party and is never sold or shared with an advertising network. Records we cannot attribute to an AI assistant are deleted after 90 days; attributed ones after 180.

Service records — audits, scans, AI mention history and product-usage records are kept for as long as we operate the Service, because they are the history it is built on. When you delete your account, your account record is erased and the audits and business records tied to it are unlinked from you, so they no longer identify you.