Privacy Policy
Last updated: 2026-10-18
1. Data Controller
The controller within the meaning of the GDPR is:
Antonio Blago
Email: info@antonioblago.com
Website: www.antonioblago.com
If you have any questions about data protection, you can contact us at any time at the above email address.
2. General Information on Data Processing
2.1 Scope of Processing
We only process personal data of our users to the extent necessary to provide a functional website and our services. Processing is generally only carried out with the user's consent or where processing is permitted by law.
2.2 Legal Basis
The processing of personal data is based on the following legal bases of the GDPR:
- Art. 6(1)(a) GDPR: User consent
- Art. 6(1)(b) GDPR: Contract performance or pre-contractual measures
- Art. 6(1)(c) GDPR: Legal obligations
- Art. 6(1)(f) GDPR: Legitimate interests of the controller
2.3 Data Deletion and Storage Period
Personal data is deleted as soon as the purpose of storage no longer applies. Storage may continue if required by law (e.g., tax retention periods of 6-10 years).
3. Collection and Processing of Personal Data
3.1 Registration and User Account
Data collected:
- Email address (required)
- Password (stored encrypted)
- Registration date
- Login history (timestamp, IP address)
Purpose: Provision of user account, authentication, security
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Storage period: Until account deletion plus 30 days backup period
3.2 Subscriptions and Payment Data
Data collected:
- Payment information (processed via Stripe)
- Billing address (if provided)
- Transaction history
- Subscription status and duration
- Purchased credits and usage
Purpose: Payment processing, invoicing, contract management
Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (legal obligations)
Storage period: 10 years (tax retention requirement)
3.3 Usage Data and Analytics
Data collected:
- Analyzed websites and domains (entered by you)
- EEAT analyses and projects
- Keyword research
- Backlink analyses
- SEO Copilot conversations (temporary for session management)
- Credit usage and API usage
Purpose: Provision of SEO services, platform optimization
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Storage period: As long as the account is active; 30 days after account deletion
3.4 AI Bot Log Analyzer (upload of your own server logs)
The AI Bot Log Analyzer is a free tool that lets you analyze an access log from your own web server. Because such logs typically contain IP addresses, timestamps, requested URLs, referrers and user agents, separate rules apply here.
Processing of the uploaded file:
- The file is read and parsed in memory only. It is never written to disk and is discarded once the analysis completes.
- No individual IP addresses are taken from the log. IP addresses only enter the result as a count of distinct addresses per bot.
- Raw log lines are neither stored nor passed on to third parties. In particular, no data is sent to any AI provider; the analysis runs entirely in our own code on our own server.
What is stored from the analysis:
- Aggregated metrics (total requests, requests per bot, status codes, time series, AI visibility score)
- The most frequently requested URLs of the analyzed domain
- The analyzed domain, where provided or inferable from the log
- The IP address of the upload (not the IP addresses contained in the log) for rate limiting and abuse detection
- Your email address, if you choose to have the report sent to you
Purpose: Providing the analysis, abuse prevention, providing shareable reports
Legal basis: Art. 6(1)(b) GDPR (performing the service you requested), Art. 6(1)(f) GDPR (legitimate interest in system security and abuse prevention)
Storage period: The uploaded file is not stored. The aggregated analysis result is deleted automatically after 90 days. A share link you create expires after 30 days.
Storage location: Servers of our hosting provider PythonAnywhere within the European Union (see section 5.6)
Shareable reports:
On your explicit action you can create a link that makes the aggregated result accessible without login. Anyone who has the link can view the report. The link expires automatically after 30 days and the page is set to "noindex" for search engines. If you do not create a link, the result is not accessible from outside. On request we delete any report earlier at any time.
3.5 Emails and Email Tracking
Emails we send:
- Service emails: account confirmation, password reset, payment and subscription notices, account deletion, notifications and reports you have set up in the app
- Product information to existing customers: occasional emails about new features and changes to Visibly AI, for example announcements of new versions and credit promotions
Data processed: email address, first name, language setting, account status, delivery status, and for product emails the time of opening and of clicks on links
Email tracking: Product emails contain a small tracking pixel and links that are redirected via our email service provider Brevo. This shows us whether an email was delivered and opened and which link was clicked. We use this information only in aggregated form to judge whether our product information is useful and to avoid sending emails that nobody reads. We do not create user profiles for advertising and do not share this data with third parties for advertising purposes. For credit promotions, we also record in our own system whether the promotion was sent to your account and whether you redeemed it.
Legal basis: Art. 6(1)(b) GDPR for service emails; for product information to existing customers Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG), our legitimate interest being to inform customers about our own similar services; for email tracking Art. 6(1)(f) GDPR
Your choices: Every product email contains a link to your email settings, where you can unsubscribe from product emails at any time without any costs other than the transmission costs at the basic rates. You can also object to email tracking at any time by email to info@antonioblago.com, or prevent it by not loading images in your email program. Service emails required for your account are not affected.
Storage period: Delivery, opening and click data is stored at Brevo for the retention period of the transactional email logs and deleted automatically afterwards; promotion records in our system are deleted together with your account.
3.6 Experience Memory of the SEO Copilot
The SEO Copilot in the app can take reviewed experience into account when answering. There are two kinds:
- Personal memory: preferences you expressed in the chat, for example that you prefer short answers or a certain target country. These entries belong to your account and are only used in your own chats.
- General experience: anonymous findings derived from many accounts, for example frequent errors, recurring questions or results that did not work. They are only created from accounts that have explicitly agreed to contribute.
Data processed: chat ratings (thumbs up or down), the related question and answer excerpt, and error messages of failed tool calls from the last days. For general experience, accounts are replaced by pseudonyms before an AI system (Anthropic Claude, see section 5.3) summarises the pattern; email addresses and links are removed beforehand. A general entry is only created if several consenting accounts show the same pattern, and suggestions containing names, domains, addresses or links are discarded. Chats in a project owned by someone else are only used if the project owner has also agreed. Every entry is reviewed and approved by us before it is used.
Legal basis: Art. 6(1)(b) GDPR for personal memory, which is part of the service you use; Art. 6(1)(a) GDPR (your consent) for contributing to general experience. Only chats from the time of your consent onwards are used.
Your choices: In the app settings (Account, section "Speicher & Datenschutz") you can switch off personal memory, remove individual entries and give or withdraw your consent to contribute at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal; general entries already approved contain no personal data.
Storage period: Personal entries are kept until you remove them, switch off personal memory or delete your account. General entries contain no personal data and are kept as long as they are useful.
4. Cookies and Tracking
4.1 Use of Cookies
Our website uses cookies. Cookies are small text files stored on your device that contain certain information for exchange with our system.
4.2 Types of Cookies
| Cookie Type | Purpose | Storage Period |
|---|---|---|
| Session Cookies | Authentication, login status | Until browser session ends |
| Functional Cookies | Language settings, preferences | Up to 1 year |
| Security Cookies | CSRF protection, abuse detection | Session or 24 hours |
| Analytics Cookies (only with consent) | Reach measurement with Google Analytics 4 (_ga, _ga_*) |
Up to 2 years |
4.3 Google Analytics 4 (only with your consent)
If you give your consent, we use Google Analytics 4 to measure the reach of our website visibly-ai.com and of the app at app.visibly-ai.com and to understand which content is used. Without your consent, Google Analytics is not loaded and no data is sent to Google.
- Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
- Purpose: Reach measurement and improvement of our website and app.
- Legal basis: Your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG (German Telecommunications Telemedia Data Protection Act).
- Data processed: Pseudonymous usage data such as pages viewed, approximate location, device and browser information and a randomly generated identifier stored in a cookie. IP anonymisation is enabled, so your IP address is shortened before further processing.
- Third-country transfer: Data may be transferred to Google LLC in the USA. The transfer is based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework.
- Storage period: The Google Analytics cookies (for example
_ga) are stored for up to 2 years. Event data in Google Analytics is retained for 14 months and then deleted automatically. - Revocation: You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of this website or in the app. When you withdraw, the Google Analytics cookies are removed.
We do not use advertising trackers. Consent signals for advertising storage, advertising user data and advertising personalisation are always set to “denied” (Google Consent Mode v2). The only other measurement of this kind is the opening and click tracking in product emails described in section 3.5.
4.4 Anonymous count of cookie choices
When you make a choice in the cookie banner (accept all, necessary only or individual settings), the website and the app send this choice once to our server at app.visibly-ai.com. We only store a daily counter per choice (for example “accept all, website, 2026-10-18: +1”). We do not store your IP address, no cookie and no identifier, so the count cannot be linked to you. It shows us how many visitors agree to statistics. Your choice itself is stored only in your browser (local storage, key va_consent) so that the banner does not appear again.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing how the consent request is answered); storing your choice in your browser is technically necessary (Section 25(2) No. 2 TTDSG).
5. Integration of Third-Party Services
5.1 Stripe (Payment Processing)
For payment processing, we use Stripe Inc., 510 Townsend Street, San Francisco, CA 94103, USA.
Data transferred: Email, payment information, transaction data
Purpose: Secure payment processing, fraud prevention
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Privacy Policy: stripe.com/privacy
5.2 DataForSEO (SEO Data API)
For SEO analyses (keywords, backlinks, traffic), we use the DataForSEO API.
Data transferred: Analyzed domains and websites (entered by you)
Purpose: Provision of SEO analysis data
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Important: No personal data about you is transferred to DataForSEO, only the websites to be analyzed.
AI visibility measurement: For the LLM Visibility module, DataForSEO forwards the questions (prompts) of your prompt sets to the AI systems being measured (for example ChatGPT, Claude, Gemini, Perplexity and Google AI Overviews) and returns their answers. Prompts are questions about your market and brand; do not enter personal data in them.
5.3 Anthropic Claude (AI Analyses)
For AI-powered EEAT analyses and the SEO Copilot, we use the Claude API from Anthropic.
Data transferred: Website content (for analysis), chat queries
Purpose: AI-based SEO analyses and recommendations
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Privacy Policy: anthropic.com/privacy
- We use the Anthropic API in business mode
- No Training: Your data is NOT used to train AI models
- Retention: Anthropic stores API requests for a maximum of 30 days for abuse detection
- We have concluded a Data Processing Agreement (DPA) with Anthropic (GDPR Art. 28)
5.4 OpenAI (Fallback AI System)
As a fallback system for AI analyses, we use the OpenAI API (GPT-4).
Data transferred: Website content (for analysis), chat queries (only when fallback is activated)
Purpose: AI-based SEO analyses as backup when primary system is unavailable
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Privacy Policy: openai.com/privacy
- API Usage: When using the OpenAI API, your data is NOT used by default to train AI models
- No Training: We have activated the training opt-out - your prompts and outputs are not used for model training
- DPA Concluded: We have concluded a Data Processing Addendum (DPA) with OpenAI pursuant to GDPR Art. 28
- Retention: OpenAI stores API requests for a maximum of 30 days for abuse detection and then automatically deletes them
- EU-US Data Privacy Framework: OpenAI is certified under the EU-US Data Privacy Framework
5.5 Google Search Console & Analytics API (OAuth Integration)
For extended SEO analyses, we offer an optional integration with the Google Search Console API and Google Analytics Data API (GA4). This feature requires your explicit consent via Google OAuth 2.0.
Data collected upon connection:
- Google account email address
- List of verified Search Console properties (websites)
- Search performance data (clicks, impressions, CTR, position)
- Keyword data and search queries
- Indexing status and crawling statistics
- Google Analytics 4 properties (if available)
- Analytics data: Sessions, users, page views, traffic sources
Purpose: Provision of detailed SEO analyses based on your actual Google search data and website statistics
Legal basis: Art. 6(1)(a) GDPR (explicit consent)
Storage period: OAuth tokens are stored encrypted with Fernet (AES-128-CBC) until you disconnect. Retrieved analysis data is cached for a maximum of 30 days.
5.6 Brevo (Email Delivery)
We send our emails via Brevo, operated by Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France.
Data transferred: Email address, first name, email content, delivery status, and for product emails the time of opening and of link clicks (see section 3.5)
Purpose: Reliable delivery of service emails and product information, measurement of delivery, opening and clicks
Legal basis: Art. 6(1)(b) GDPR (service emails), Art. 6(1)(f) GDPR (product information and email tracking); a Data Processing Agreement pursuant to Art. 28 GDPR is in place
Location: Brevo processes data on servers in the EU.
Privacy Policy: brevo.com/legal/privacypolicy
5.7 Hosting
Website (www.visibly-ai.com): Our marketing website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, Vercel processes technical access data (IP address, time of access, requested page, browser information) in order to deliver the pages.
Application (app.visibly-ai.com): The Visibly AI application, its database and the background services are hosted by Railway Corporation, San Francisco, USA, in a data centre in the EU (Amsterdam, Netherlands). This includes all data you enter in the app or that is created there (see section 3).
Purpose: Provision of the website and application infrastructure
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation); for data processed in the app additionally Art. 6(1)(b) GDPR (contract performance). Data Processing Agreements pursuant to Art. 28 GDPR are in place with both providers.
5.8 Sentry (Error Monitoring)
To detect and fix technical errors in the app, we use Sentry, operated by Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA. Error reports are stored in Sentry's EU data region (Frankfurt, Germany).
Data transferred: Error message, technical context (page or interface affected, browser and device type, app version, time). The integration is configured not to send personal data by default (no names, email addresses or content you enter). As with every connection, the server receives the IP address of the reporting browser for technical reasons.
Purpose: Stable operation and fast fixing of errors
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an error-free service)
5.9 Cloudflare Turnstile (Bot Protection)
On registration and in the free visibility check, we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to distinguish people from automated bots. Turnstile works without tracking cookies and without image puzzles.
Data transferred: IP address, browser and device characteristics needed for the check
Purpose: Protection against spam and abuse of forms
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our service)
5.10 Further AI Providers
In addition to Anthropic and OpenAI (sections 5.3 and 5.4), individual functions use the following AI providers:
- Google Gemini (Google Ireland Limited, Dublin, Ireland) and Mistral AI (Mistral AI SAS, Paris, France): answers to test questions in the free visibility check, in Pitch Prep and in the AI visibility measurement. Transferred are questions about the domain, brand and market concerned.
- Perplexity (Perplexity AI, Inc., San Francisco, USA): search for external sources in the article editor. Transferred are search queries derived from the passage of text concerned.
Legal basis: Art. 6(1)(b) GDPR (contract performance); in the free visibility check Art. 6(1)(f) GDPR. We do not send account data such as your name or email address to these providers.
5.11 Retrieval of Public Web Pages
For analyses of public websites (for example rendering pages that need JavaScript, crawling, YouTube transcripts for content sources), we use ScraperAPI (USA) and the Google PageSpeed Insights API (Google Ireland Limited). Only the addresses of the public pages to be analysed are transferred, no personal data about you.
Legal basis: Art. 6(1)(b) GDPR (contract performance)
5.12 Connections with Your Own Accounts (Optional)
Some functions only work if you connect your own account with another service yourself. In this case, data is exchanged on your behalf and under the terms of your contract with that service:
- Buffer (Buffer Inc., USA): scheduling social media posts you have approved; transferred are post text, image and the scheduled time.
- Ahrefs (Ahrefs Pte. Ltd., Singapore): reading the site audit of projects you have created in Ahrefs, using your own API key.
- WordPress, Shopify or your own CMS: publishing and updating articles you have approved.
Access data (API keys, tokens) is stored encrypted (see section 8.2). You can remove a connection at any time in the app settings.
Legal basis: Art. 6(1)(b) GDPR (contract performance)
6. Data Transfer to Third Countries
Some of the services used (Stripe, Anthropic, OpenAI, Google, Perplexity, Cloudflare, Sentry, ScraperAPI, Vercel, Railway) are based in the USA or may process data in the USA. Railway stores our application data in the EU; access from the USA can occur for operation and support. The USA is not considered a safe third country from the EU's perspective under GDPR.
Data transfer is based on:
- Standard Contractual Clauses (SCC): Stripe, Anthropic, OpenAI, Vercel, Railway and the further providers named in section 5 that process data in the USA
- Adequacy Decision: Where applicable (EU-US Data Privacy Framework)
- Your Consent: Art. 6(1)(a) GDPR in conjunction with Art. 49(1)(a) GDPR
7. Your Rights as a Data Subject
You have the following rights under GDPR:
- Right of Access (Art. 15 GDPR): You can request information about your data stored with us
- Right to Rectification (Art. 16 GDPR): You can request correction of inaccurate data
- Right to Erasure (Art. 17 GDPR): You can request deletion of your data ("right to be forgotten")
- Right to Restriction (Art. 18 GDPR): You can request restriction of processing
- Right to Data Portability (Art. 20 GDPR): You can receive your data in a structured format
- Right to Object (Art. 21 GDPR): You can object to processing on grounds relating to your particular situation
- Right to Withdraw Consent (Art. 7(3) GDPR): Consent given can be withdrawn at any time
7.1 Exercising Your Rights
To exercise your rights, please contact:
Email: info@antonioblago.com
We will respond to your request within 30 days.
7.2 Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.
8. Data Security
8.1 Technical Measures
We implement the following security measures:
- SSL/TLS Encryption: All data transfers are encrypted (HTTPS)
- Password Hashing: Passwords are hashed with bcrypt, not stored in plain text
- Access Control: Strict permission management for database access
- Firewall: Protection against unauthorized access
- Regular Backups: Daily database backups
- Security Updates: Regular updates of all systems
8.2 Encryption of Sensitive Data (Encryption at Rest)
Encrypted data categories:
| Data Category | Encryption Method | Key Derivation |
|---|---|---|
| Google OAuth Tokens | Fernet (AES-128-CBC) | Individual per user |
| Revenue Analysis Data | Fernet (AES-128-CBC) | Individual per user |
| API Credentials | Fernet (AES-128-CBC) | Individual per user |
Detailed Technical Documentation: A comprehensive description of our encryption procedures can be found on our Data Encryption page.
9. AI Transparency and EU AI Act Compliance
9.1 AI Systems Used
We use the following AI models:
- Anthropic Claude (Primary): current Claude models (Sonnet, Haiku, Opus) for the SEO Copilot, content generation and analyses
- OpenAI GPT (Fallback and embeddings): as backup when the primary system is unavailable, for text embeddings (semantic search) and image generation
- Google Gemini, Mistral, Perplexity: for individual functions, see section 5.10
9.2 Risk Classification
Our AI applications fall under the "limited risk" category pursuant to EU AI Act (Art. 52), as they:
- Do not make automated decisions with legal effect
- Are exclusively for analysis and information purposes
- Provide transparent labeling of AI-generated content
- Ensure human control (human-in-the-loop)
9.3 Transparency Requirements
We fulfill the following transparency requirements:
- Labeling: AI-generated content is labeled as such
- No Training: User data is NOT used to train AI models
- Data Processing: Clear documentation of what data is transmitted to AI systems
- Retention Periods: Defined deletion periods (max. 30 days with third-party providers)
9.4 Data Processing Agreements (DPA)
We have concluded Data Processing Agreements (DPA) pursuant to GDPR Art. 28 with all AI providers:
| Provider | DPA Status | Training Opt-Out | Retention |
|---|---|---|---|
| OpenAI | Concluded | Activated (API) | 30 days |
| Anthropic | Concluded | Activated (Business) | 30 days |
9.5 Human Control (Human-in-the-Loop)
All AI-generated analyses and recommendations are designed as decision support. The final assessment and implementation is always up to the user. The AI:
- Does not make automated decisions
- Does not perform independent actions
- Does not change data without explicit user approval
- Only provides recommendations and analyses
9.6 Your Rights Regarding AI Processing
You have the right to:
- Know when AI is used in processing your requests
- Decline AI use (alternative manual analysis on request)
- Receive information about data transmitted to AI systems
- Request deletion of data stored with AI providers
10. Protection of Minors
Our services are intended exclusively for persons aged 18 and over. We do not knowingly collect data from minors. If we become aware that data from minors has been stored, it will be deleted immediately.
11. Changes to this Privacy Policy
We reserve the right to adapt this privacy policy to reflect changes in the legal situation or changes to our services. The current version can always be found on this page.
Last updated: 2026-10-18
Privacy Contact
Controller:
Antonio Blago
Email: info@antonioblago.com
Website: www.antonioblago.com
If you have any questions about data protection or wish to exercise your rights, you can contact us at any time. We will respond to your inquiry within 30 days.
Last updated: 2026-10-18 | Antonio Blago