Now availableVisibilityKit CrawlerDownload for Mac
VisibilityKit
Sign Up

How we protect your data

Last updated: October 6, 2026

1. Introduction

VisibilityKit ("we," "our," or "us") is operated by SevenHills Software. We make two products:

  • VisibilityKit Intelligence, a web application that measures how often your brand is mentioned, recommended and cited by AI assistants such as ChatGPT, Perplexity, Gemini and Google AI Overviews when buyers ask category questions.
  • VisibilityKit Crawler, a desktop application for macOS, Windows and Linux that audits websites. Crawl data stays on your own computer; see section 2.4.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over it. By using VisibilityKit, you agree to the practices described here.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Email address, name, and password when you create an account.
  • Business Information: Company name, website URL, brand names, and the keywords or queries you want tracked.
  • Payment Information: Billing address and payment details. Payments are processed by Lemon Squeezy. We do not store full card numbers on our servers.
  • Communication Data: Messages you send us through our contact form, email, or support channels.
  • Download and Waitlist Requests: When you ask for a Crawler download link or join a waitlist we store your email address, the product and operating system you chose, whether you are an individual or an agency, whether you ticked the marketing checkbox and when, and first-touch attribution (UTM parameters, the referring site and the page you landed on). When you open a mailed download link or download an installer we record the time, your IP address and your browser so we can trace which email led to which download.

2.2 Information We Collect Automatically

  • Usage Data: Pages you visit, features you use, audit history, and interaction patterns within the platform.
  • Device Information: Browser type, operating system, and device identifiers.
  • Log Data: IP address, access times, and referring URLs.
  • Cookies and Analytics Events: We use cookies and product analytics events to understand how the product is used. See our Cookie Policy for details.

2.3 Information from Third Parties

  • AI Platform Responses: When we run an audit for you, we query public interfaces of AI platforms (ChatGPT, Perplexity, Gemini, Google AI Overviews, Copilot, Grok, DeepSeek, and Meta AI) using your brand and keyword strings. The responses we receive back are stored against your account so we can detect citations and report visibility.
  • Analytics Providers: Aggregated usage and performance data from our analytics and hosting providers.

2.4 VisibilityKit Crawler (Desktop App)

The Crawler runs on your computer, not on our servers. What it does and does not send us:

  • Crawl data stays local. Pages, findings, action plans and reports are written to a database on your own computer. We operate no crawl server and cannot see your crawls.
  • Licence checks. When you activate or refresh a paid licence the app sends your licence key and a hashed fingerprint of your machine to our licence server so the licence can be bound to that machine. The app checks for updates by fetching a version manifest; that request carries only the app version and platform.
  • Integrations you configure. If you connect Google Search Console or Analytics, or enter an API key for an AI provider, the app sends the data those features need directly to that provider using your own credentials. We do not receive it.
  • Usage telemetry is off by default. The app sends no usage events unless you switch telemetry on in its settings.

2.5 ChatGPT, Claude and Other AI Assistant Connectors

You can connect VisibilityKit to ChatGPT, Claude or another AI assistant through our MCP server at mcp.visibilitykit.app. Our ChatGPT and Claude plugins contain only instructions and this server address; they collect nothing themselves. When you connect:

  • Sign-in. You sign in with your VisibilityKit account and approve access. The assistant receives an access token for your account, never your password. You can revoke access at any time under Settings → AI connectors, or in the assistant's own app settings.
  • What we receive. Only the inputs of each tool the assistant calls (for example a brand name, a topic, a website address or a report type), plus the IP address of the request. We do not receive the rest of your conversation.
  • What the tools return to the assistant. Data from workspaces you belong to: your brands and their websites; tracked topics and prompts; the AI answers we collected and the brands, competitors and source URLs they mention or cite; visibility scores, sentiment and trends; competitor names and websites; site health and page audit findings; recommendations and action items; content drafts and reports you create; your monitoring, alert and brand kit settings; for workspace owners, your plan and usage; and, when you ask for your team, the names, email addresses and roles of your workspace members. Tools that work without an account (crawler access, page and citation checks) return only results about the public website you name.
  • Actions. Tools that change something (for example adding a brand or topic, running a check, generating content or submitting pages to search engines) run only when you ask, and the assistant asks you to confirm first.
  • The assistant provider. Tool results are sent to the assistant you use (for example OpenAI for ChatGPT, or Anthropic for Claude) and are handled under that provider's privacy policy.
  • Logs and limits. For each tool call we log the tool name, your user ID, the connecting app's client ID, timing and any error, kept as log data (see Data Retention). We use the request IP address, or your user ID when you are signed in, only to apply rate limits.

2.6 Visibility Tracker (Website Analytics)

Visibility Tracker lets our customers measure visits to their own websites, including visits that arrive from AI assistants and requests from AI crawlers. When a website you visit uses Visibility Tracker, the website owner is the data controller for that analytics data and we process it on their behalf, following their instructions. If you have questions about a site's analytics, contact the owner of that site.

  • What the tracking script collects from visitors: the page path visited (not the full query string, apart from UTM campaign tags), the referring website's domain, the browser, operating system and device type derived from the user agent, and two first-party cookie identifiers (a visitor ID kept for up to one year and a session ID that expires after 30 minutes of inactivity). If the website owner sends custom events (for example "signup"), we receive the event name and the properties they choose to send.
  • IP addresses: used briefly to prevent abuse and, where enabled, to look up an approximate country, then discarded. We do not store visitors' IP addresses.
  • AI crawler reports: a website owner's own server can report requests from known AI crawlers (for example GPTBot or ClaudeBot). These reports contain the crawler's user agent, the page path and the response status, and no information about people.
  • Consent: website owners can run the script in a consent mode in which nothing is collected and no cookie is set until the visitor agrees. Website owners are responsible for telling their visitors about analytics and for obtaining any consent their local law requires.
  • What we don't do: we don't track visitors across different websites, build advertising profiles, or sell analytics data. We use it only to provide the analytics to the website owner.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our AI visibility tracking service.
  • Generate audits and insights about your brand's presence across the AI platforms we monitor.
  • Send you the download link or waitlist confirmation you asked for, and, only if you opted in, Crawler release notes and offers.
  • Send you notifications about audit results, alerts, and account activity.
  • Process payments and manage your subscription.
  • Respond to your inquiries and provide customer support.
  • Send marketing communications, where you have consented or where the law allows it.
  • Analyze usage patterns to improve performance and product design.
  • Detect, prevent, and address technical issues, fraud, or security threats.
  • Comply with legal and tax obligations.

4. How We Share Your Information

We share your information only with the parties listed below, and only to the extent needed to run the service.

4.1 Service Providers

  • Database and authentication provider: Stores your account, audit data and sign-in state.
  • Lemon Squeezy: Payment processing, subscription billing, and tax handling.
  • Hosting provider: Runs the web application and background workers, in the European Union.
  • Network and delivery provider: DNS, TLS, the bot check on public forms, and the storage that serves Crawler installers, updates and licence checks.
  • Analytics provider: Product analytics, including cookie-based session data and event capture.
  • AI providers (OpenAI, Anthropic, Google, xAI, Perplexity, and others): We send public brand, keyword, and query strings to their public interfaces on your behalf to detect citations. We do not send your account email, billing details, or other personal data to these providers.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or a valid governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

If SevenHills Software or VisibilityKit is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you and update this policy if that happens.

We do not sell your personal information to third parties.

5. Data Retention

We keep your personal information for as long as your account is active or as needed to provide the service. Specifically:

  • Account data: Kept while your account is active. Deleted within 30 days of account closure.
  • Audit history: Kept for 12 months so we can show trend analysis and historical visibility.
  • Payment records: Kept for 7 years for tax and legal compliance.
  • Log data: Kept for 90 days for security and debugging.
  • Visibility Tracker analytics: Kept for the period of the website owner's plan (30 days, 1 year or 2 years), then deleted automatically. Deleting a site removes its data.
  • Download and waitlist records: Kept for 24 months after your last request or download, or until you ask us to delete them.

6. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the UK, you have the following rights under the General Data Protection Regulation (GDPR):

  • Right to Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete data.
  • Right to Erasure: Request deletion of your personal data (the "right to be forgotten").
  • Right to Restrict Processing: Ask us to limit how we use your data.
  • Right to Data Portability: Receive your data in a common, machine-readable format.
  • Right to Object: Object to certain types of processing, including direct marketing.
  • Right to Withdraw Consent: Withdraw consent at any time where we rely on consent as the legal basis.

To exercise these rights, email us at privacy@visibilitykit.app. We will respond within 30 days.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

  • Know what personal information we collect about you.
  • Request deletion of your personal information.
  • Opt out of the sale of your personal information. We do not sell personal information.
  • Not be discriminated against for exercising your privacy rights.

To make a request, email us at privacy@visibilitykit.app.

8. Cookies and Tracking

We use cookies and similar technologies to keep you signed in, remember your settings, and understand how the product is used. Categories include:

  • Essential cookies: Required for the platform to function, such as authentication and session management.
  • Analytics cookies: Set by our analytics provider so we can see how visitors use our site and product.
  • Preference cookies: Remember your settings and choices.

Websites that use Visibility Tracker set two first-party analytics cookies on their own domain: _bi_v (a random visitor ID, up to one year) and _bi_s (a random session ID, 30 minutes). They are set by that website, not by visibilitykit.app, and are not shared across websites. See section 2.6.

You can control cookies through your browser settings. For full details, see our Cookie Policy.

9. Third-Party Services

Our service depends on several third-party providers. When you use VisibilityKit, your data may be processed by:

  • Lemon Squeezy: Handles payment data, invoices, and sales tax. Their handling is governed by Lemon Squeezy's Privacy Policy.
  • Database and authentication provider: Stores your account, audit data, and authentication state.
  • Hosting and delivery providers: Host the application and serve Crawler downloads and updates.
  • Analytics provider: Captures product analytics events and session data.
  • AI Platforms (ChatGPT, Perplexity, Gemini, Google AI Overviews, Copilot, Grok, DeepSeek, Meta AI): We query their public interfaces on your behalf using brand, keyword, and query strings you have configured. We do not share your personal account data with them.

Use of VisibilityKit is also governed by our Terms of Service.

10. Data Security

We use technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit using TLS, and encryption at rest provided by our database and hosting providers.
  • Role-based access controls and authentication requirements.
  • Internal employee training on data protection.
  • Logging and monitoring of access to production systems.

No method of transmission over the Internet is fully secure. We cannot guarantee absolute security, but we work to keep your data safe and to respond quickly if something goes wrong.

11. International Data Transfers

Our web application is hosted in the European Union. Our database and authentication provider, and several other service providers, process data in the United States. Your information may therefore be transferred to and processed in countries other than your own. Where required, we rely on Standard Contractual Clauses or other approved safeguards for transfers from the EEA and the UK.

12. Children's Privacy

VisibilityKit is not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us at privacy@visibilitykit.app and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and update the "Last updated" date at the top. For significant changes, we will also notify account holders by email.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please reach out:

For GDPR-related inquiries, you may also contact your local data protection authority.