Privacy Policy

01Introduction and Scope

Vyzz, Inc. ("Vyzz," "we," "us," or "our") operates the AI Visibility & GEO Optimization platform accessible at vyzz.io and at the Vyzz app at app.vyzz.io (together, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use our Service, visit our websites, or otherwise interact with us.

This Policy applies to all users of the Service, including individual account holders, authorized users within organizational accounts, and visitors to our public-facing web properties. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Service immediately.

We are committed to protecting your privacy and handling your data in an open and transparent manner. This Policy complies with applicable data protection laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other relevant privacy legislation in the jurisdictions where we operate.

02Definitions

To ensure clarity throughout this Privacy Policy, the following terms carry specific meanings when used in this document:

• "Service" refers to the Vyzz AI Visibility & GEO Optimization platform, including the web application at vyzz.io, all associated APIs, dashboards, reports, and related tools provided by Vyzz, Inc.
• "Personal Data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a natural person or household. This includes, but is not limited to, names, email addresses, IP addresses, and device identifiers.
• "Usage Data" refers to data collected automatically through the operation of the Service, including but not limited to pages visited, features used, time spent on pages, click paths, browser type, operating system, and referral URLs.
• "AI Platform Data" means data generated through our analysis of third-party artificial intelligence platforms (such as ChatGPT, Claude, Google Gemini, Grok, Microsoft Copilot, and Perplexity), including visibility scores, citation frequency, sentiment analysis, competitor benchmarking data, and prompt-response analysis results.

Where this Policy refers to "you" or "your," it means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

03Categories of Personal Data

We collect personal data through several channels and categorize it as follows. The specific data points collected depend on how you interact with the Service and the features you use.

Data You Provide Directly

• Account information: Full name, email address, and password (managed by our authentication provider, Clerk)
• Organization details: Company name, business domain, industry vertical, and geographic region
• Payment information: Billing name, billing address, and payment card details (processed and stored exclusively by Stripe; Vyzz does not store raw payment card numbers)
• Communications: Messages, feedback, or inquiries you submit through our support channels

Data Collected Automatically

• Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences
• Usage information: Pages viewed, features accessed, actions taken within the dashboard, session duration, and interaction patterns
• Cookies and similar technologies: Authentication tokens, session identifiers, and functional preference cookies (detailed in Section 12)

AI-Specific Data

• Visibility scores: Numerical assessments of your brand's presence across major AI platforms
• Competitor data: Comparative rankings and benchmarks against identified competitors in your industry
• Prompt analysis results: Aggregated data from queries submitted to third-party AI platforms on your behalf, including citation frequency, recommendation sentiment, and positioning analysis

Data from Third-Party Integrations You Authorize

When you connect an optional third-party integration (such as Google Analytics, Google Search Console or Google Business Profile) to your Vyzz account, we read specific data from that service on your behalf via OAuth 2.0. The exact fields, retention, and Limited Use commitments for each integration are detailed in Section 7 (Third-Party Integrations You Authorize). Connecting an integration is voluntary and is not required to use the core Service.

04Purposes and Legal Bases

We process your personal data for the following purposes. Where GDPR applies, we have identified the corresponding legal basis for each processing activity.

Where we rely on legitimate interest as the legal basis, we have conducted balancing tests to ensure that our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting us at hello@vyzz.io.

05AI Training Disclosures

Vyzz does not use customer data to train artificial intelligence models. We do not feed your account information, organization details, visibility scores, or any other personal data into machine learning training pipelines. Your data is used exclusively to deliver the Service as described in this Policy.

To provide the features you see in Vyzz, such as reports, recommendations and drafts of content, information about your business and data from the tools you connect may be processed by the AI models of our model providers (listed in Section 6). They process it only to produce these features for you, under terms that do not allow them to use it to train their models.

Our Service generates visibility scores and competitive analyses by querying third-party AI platforms (including OpenAI's ChatGPT, Anthropic's Claude, Google Gemini, xAI's Grok, Microsoft Copilot, and Perplexity) with industry-relevant prompts. These queries are designed to assess how each platform references, recommends, or describes your brand and your competitors. The prompts submitted to these third-party platforms do not contain your personal data; they consist of industry-specific and brand-relevant questions.

The responses we receive from these third-party AI platforms are processed and aggregated by Vyzz to generate your visibility scores, citation analysis, and competitive benchmarks. We do not control how third-party AI platforms process the prompts we submit to them, and we encourage you to review the privacy policies of these platforms independently. Vyzz is not responsible for the data practices of third-party AI platforms.

06Disclosure of Personal Data

We share your personal data only with the third-party service providers necessary to operate the Service. We do not sell, rent, or trade your personal data to any third party for their marketing or advertising purposes.

Each service provider is contractually obligated to process your data only for the purposes specified above and in accordance with applicable data protection laws. We may also disclose your personal data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Vyzz, our users, or the public.

07Third-Party Integrations You Authorize

When you choose to connect a third-party service (such as Google Analytics, Google Search Console or Google Business Profile) to your Vyzz account, you authorize us to access specific data from that service on your behalf via the OAuth 2.0 protocol. We access only the data necessary to provide the features described in your subscription, and only for as long as you maintain an active connection.

In the Vyzz app at app.vyzz.io, connections to Google are handled by our OAuth token service, Nango (listed in Section 6). It stores the refresh token encrypted and makes the read-only requests to Google on our behalf. AI models never see these tokens. Everything else in this section applies to both vyzz.io and app.vyzz.io.

Google Analytics 4

When you connect Google Analytics, Vyzz requests the following OAuth scopes from your Google Account: openid, email, and https://www.googleapis.com/auth/analytics.readonly. These permissions allow Vyzz to read — but never modify or delete — data from the GA4 property you select.

Data we read from Google Analytics: aggregate metrics for your selected GA4 property, including sessions, users, engaged sessions, average session duration, conversions, page views, source/medium/campaign attribution, page paths and titles, country/region/city, device category, operating system, browser, and event names. We also read your connected Google account email and stable user identifier for display in the integration settings.

Where this data is stored: Your refresh token is encrypted at rest using AES-256-GCM and stored in our database (Supabase) until you disconnect. Aggregate report responses are cached for up to 15 minutes per report so we don't hit Google's API on every page load. To show trends over time and measure the results of our work, we may also store periodic summaries of these metrics (for example weekly totals of visits by source) for as long as your account is active. Cached data is wiped immediately when you change your selected property or disconnect, and stored summaries for that property are deleted within 30 days.

Google Search Console

When you connect Google Search Console, Vyzz requests the https://www.googleapis.com/auth/webmasters.readonly scope for the properties you select. These permissions allow Vyzz to read — but never modify — your Search Console data.

Data we read from Search Console: search queries, clicks, impressions, click-through rate and average position for the pages of your selected property, and the indexing status of those pages. We use it to show your search performance in Vyzz and to decide, with you, which pages to create or improve.

Where this data is stored: as for Google Analytics: the refresh token is encrypted at rest with AES-256-GCM until you disconnect, responses are cached briefly, and periodic summaries may be stored to show trends, deleted within 30 days after you disconnect.

Google Business Profile (coming soon)

This connection is not available yet. This section describes how it will work once it is. When you connect your Google Business Profile, Vyzz will request the https://www.googleapis.com/auth/business.manage scope for the locations you select.

What we do with it: we read your profile information (name, address, hours, categories, services, description, photos), your reviews, and your profile's performance metrics (for example searches, views, calls and direction requests) to show in your reports. We prepare suggested updates to your profile, posts for your profile and draft replies to reviews. Nothing is published to your Business Profile until you approve it in the Vyzz app, and we only act on the locations you selected.

Where this data is stored: the refresh token is encrypted at rest with AES-256-GCM until you disconnect. Profile details, reviews and performance metrics may be stored to prepare suggestions and track progress for as long as your account is active, and are deleted within 30 days after you disconnect.

Who can see data from your connected tools

Your dedicated Vyzz consultant can view the data from the tools you connect, in order to review and approve your team's work and to walk you through your reports. You agree to this when you connect a tool, and you can disconnect at any time. Otherwise, Vyzz staff view this data only as described in the Limited Use commitments below.

Limited Use Compliance — Google API Services User Data Policy

Vyzz's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve user-facing features that are visible to the user who authorized access (and authorized members of their organization).
• We do not transfer Google user data to third parties other than the service providers listed in Section 6 (Disclosure of Personal Data), all of whom act under contract for the limited purposes described.
• We do not use Google user data to serve advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read Google user data unless: (a) we have your specific consent (for example, when you connect a tool you agree that your dedicated Vyzz consultant can view its data to review your team's work), (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data has been aggregated and anonymized.
• We do not sell Google user data.
• We do not use Google user data for training generalized AI or machine learning models. As stated in Section 5 (AI Training Disclosures), no client data is used to train any AI models.

How to revoke access at any time

You can revoke Vyzz's access to a connected third-party integration at any time. You do not need to contact us.

• In the Vyzz app: open Settings → Integrations on your dashboard (in the app at app.vyzz.io: Setup → Connections) and click Disconnect on the integration you wish to remove. We immediately revoke the refresh token at the provider, wipe our encrypted copy from our database, and clear all cached data for your organization.
• At Google: visit https://myaccount.google.com/permissions and revoke “Vyzz” from your authorized third-party apps. Our copy of your refresh token will be rejected on the next refresh attempt and the connection will be flagged in your dashboard as needing reconnection.

Disconnecting an integration removes the dashboard panels that surface its data. Existing Vyzz analyses (AI visibility scores, competitor reviews, citation data, and so on) are unaffected by disconnecting an integration.

08International Data Transfers

Your personal data is processed and stored primarily in the United States through our infrastructure providers, Vercel and Supabase. If you access the Service from outside the United States, your data will be transferred to and processed in the United States, which may have data protection laws that differ from those in your jurisdiction.

For users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on appropriate legal mechanisms to facilitate international data transfers. These include Standard Contractual Clauses (SCCs) approved by the European Commission, as incorporated into our data processing agreements with our sub-processors. Where applicable, we also rely on adequacy decisions and supplementary measures as recommended by relevant supervisory authorities.

By using the Service, you acknowledge and consent to the processing and transfer of your information to the United States and other jurisdictions where our service providers operate. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

09Data Security Measures

We implement and maintain reasonable administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your personal data. While no method of transmission over the Internet or method of electronic storage is completely secure, we strive to use commercially acceptable means to protect your data.

• Encryption in transit: All data transmitted between your browser and our Service is encrypted using TLS (Transport Layer Security) with modern cipher suites. We enforce HTTPS across all endpoints.
• Authentication security: User authentication is managed by Clerk, which provides enterprise-grade session management, optional multi-factor authentication (MFA), and protection against common attack vectors including credential stuffing and brute force attempts.
• Payment security: All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. Vyzz never receives, processes, or stores raw payment card numbers. Card data is tokenized by Stripe before any interaction with our systems.
• Access controls: We implement role-based access controls to limit access to personal data to those employees, contractors, and agents who need it to perform their duties. All access is logged and subject to periodic review.
• Infrastructure security: Our application is hosted on Vercel with automatic security patching and DDoS protection. Our database is hosted on Supabase with encryption at rest and automated backups.
• Third-party integration credentials: When you connect a third-party integration (such as Google Analytics, Search Console or Business Profile), the long-lived refresh token issued by the provider is encrypted at rest with AES-256-GCM before being stored in our database. The encryption key is held in a separate secrets vault, distinct from the database itself. Short-lived access tokens are never persisted; we exchange the encrypted refresh token for a fresh access token on each request and discard it immediately after use. In the Vyzz app at app.vyzz.io, the refresh token is held encrypted by our OAuth token service (Nango) instead of our database; it is never included in prompts sent to AI models, and it is deleted at Nango and revoked at Google when you disconnect.

We regularly review and update our security practices to address evolving threats. In the event of a data breach that affects your personal data, we will notify you and relevant supervisory authorities as required by applicable law.

10Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. When we no longer need your personal data, we securely delete or anonymize it.

If you request deletion of your account, we will remove or anonymize your personal data within the timeframes specified above, subject to any legal obligations that require us to retain certain records. We may retain anonymized, aggregated data indefinitely for statistical and analytical purposes, as such data cannot be used to identify you.

11Data Subject Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data. We are committed to honoring these rights and have established processes to facilitate their exercise.

Rights under GDPR (EEA, UK, Switzerland)

• Right of access: You may request a copy of the personal data we hold about you, along with information about how it is processed.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to data portability: You may request a machine-readable copy of personal data you have provided to us.
• Right to restriction: You may request that we restrict processing of your personal data in certain circumstances.
• Right to object: You may object to processing based on legitimate interest at any time.

Rights under CCPA (California residents)

• Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to delete: You may request deletion of personal information we have collected from you.
• Right to opt-out: You have the right to opt-out of the sale of personal information. Vyzz does not sell personal information, so this right is satisfied by default.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us at hello@vyzz.io. We will respond to your request within 30 days. We may request additional information to verify your identity before fulfilling your request. If we are unable to comply with your request, we will provide you with a written explanation of the reasons.

12Cookies and Tracking

We use cookies and similar tracking technologies to operate and improve the Service. A cookie is a small data file placed on your device when you visit a website. We categorize the cookies we use as follows:

We do not use advertising or third-party marketing cookies. We do not participate in cross-site tracking networks or serve targeted advertisements. You can control cookies through your browser settings, though disabling essential cookies will prevent you from using the Service.

13Children's Privacy

The Service is designed for business professionals and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16 years of age. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at hello@vyzz.io.

If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take immediate steps to delete that information from our servers. If you believe we might have any information from or about a child under 16, please contact us immediately.

14Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

For material changes that significantly affect how we collect, use, or share your personal data, we will provide you with prominent notice at least 30 days in advance of the change taking effect. This notice will be delivered via the email address associated with your account. We may also display a notice within the Service itself.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree with the updated terms, you should discontinue use of the Service and contact us to request deletion of your account.

15Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us using the information below. We aim to respond to all inquiries within 30 calendar days.

If you are located in the EEA and believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority, and we encourage you to contact us first.