Security and data
What we read, what we keep, and how it is protected.
Plain answers to the four questions every careful buyer asks before trusting an AI product: does it understand my business, am I tied to one AI company, will the bill surprise me, and is my data safe.
In one minute
- We read only public pages. We never log in to your systems.
- Your email is never sent to AI providers.
- Card details never reach us. Razorpay handles payments.
- Data is encrypted on the way and at rest, on Render in the United States.
- Email us and we delete your data.
Context, choice, cost and control
What we read, and what we never touch
- Logins to your website, CRM, email or ad accounts
- Your card or bank details: payments go through Razorpay
- Pages behind a login on your website
- Your buyers' details for any purpose other than your own enquiry log
- Selling or renting any of your information
- Public pages of your website, the same pages any visitor or search engine sees
- What AI tools answer to your buyer questions
- Google results for the searches on your list
- Facts, notes and enquiries that you choose to give us
What we store, why, and for how long
| What | Why | How long |
|---|---|---|
| Your work email | To sign you in with a one-time code and send reports and alerts | Until you ask us to delete your account |
| Password, if you set one | Optional faster sign-in | Stored only as a protected (hashed) form, never the password itself |
| Company details | Name, website, field, buyers and rivals you confirm, used to write and judge the questions | While your account is active |
| AI answers and Google results | Saved word for word with date and model, so every number can be checked | While your account is active |
| Sales notes you paste | To describe your buyer types; uploaded files are read for text and not kept | While your account is active, or until you replace them |
| Enquiries you log or receive through your form | Name, company, contact, need, source and order value, for your own monthly report | While your account is active, or until you delete them |
| Payment record | Order number, amount and plan; card details never reach us | As long as tax and accounting rules require |
The services we use
Only the services needed to run WebVisiblity. Each gets only what its job needs.
| Service | Job | What it receives |
|---|---|---|
| Render | Hosting and database | Runs the website and stores the data, in Render's Oregon (United States) region Their security page |
| OpenAI, Anthropic, Google and Perplexity | AI answers | Receive your buyer questions with your company name and website; for page writing and buyer types, also your website text, confirmed facts and the notes you paste. Never your email |
| DataForSEO | Google search data | Receives the searches on your list and your website address, to read Google rankings and AI Overviews |
| Razorpay | Payments | Handles card, UPI and net banking payments; we never see card numbers Their security page |
| Brevo and our mail server | Deliver sign-in codes, reports and alerts to your address |
How it is protected
The 14-day trial needs a website and a work email. No card, no logins.
Questions security teams ask
Do you need access to our website, CRM or Google account?
No. WebVisiblity works from the outside, like a buyer or a search engine would. It reads your public pages, asks AI tools your buyer questions and checks Google results.
Two connections are optional and read-only. HubSpot or Webflow can be connected once to count your pages more exactly; the token is used once and not saved. Nothing we offer can publish to your website or change your accounts.
Is our data used to train AI models?
We do not use your data to train any AI model, and we do not sell or share it.
To get answers, we send your buyer questions, with your company name and website, to OpenAI, Anthropic, Google and Perplexity, the same way any person asks them. When you use page writing or buyer types, your website text, confirmed facts and pasted notes are also sent. We never send your email. Each AI provider handles what it receives under its own terms. If something should not leave your company, such as client names in sales notes, remove it before pasting; the Buyers page reminds you.
Where is our data stored?
In the United States, on Render, in its Oregon region. Render runs on large cloud providers and reports SOC 2 Type 2 and ISO 27001 for its own operations. (Render security)
Render says its managed Postgres is fully encrypted in transit and at rest, with TLS 1.2 or higher for all traffic. (Render) Our database does not accept connections from the internet.
Is WebVisiblity itself SOC 2 or ISO 27001 certified?
No, not today, and we would rather say so than imply otherwise. Our hosting provider, Render, reports SOC 2 Type 2 and ISO 27001. (Render security) Card payments run through Razorpay, which says it is PCI-DSS Level 1 certified and does not save sensitive card details. (Razorpay)
If your company needs a security questionnaire answered, email us. We answer in writing, plainly, including what we do not do.
How do we delete our data?
Email us from the account's email address and we delete your account, company details, answers, notes and enquiries. Payment records are kept only as long as tax and accounting rules require.
You can also stop monitoring at any time; nothing renews without a plan you chose. See the privacy policy and refund policy.
Do you track visitors on this website?
Lightly. A small first-party cookie remembers for 90 days how a visitor first arrived, such as from a search engine or an AI answer, so we can count which channels lead to sign-ups. It holds no personal details.
When we advertise on ChatGPT, OpenAI's measurement tag records visits and sign-up actions, as described in the privacy policy. Any standard ad blocker stops it, and the site works the same.
Related: Privacy policy · Terms · Refunds · How we measure