What we collect, and what we do with it

Effective 20 August 2026.

Who is responsible for your data

Visible2 is the data controller for the information described in this policy. We are based in Dubai, United Arab Emirates and work with clients worldwide.

For anything to do with privacy — a question, a request, or a complaint — email customercare@visible2.com. A person reads it.

What we collect

If you just visit the site

Your browser sends the usual technical information — IP address, browser type, the pages you looked at, and where you arrived from. We use it in aggregate to understand which pages are useful. We do not build advertising profiles, and we do not sell or rent anything to anyone, ever.

If you run a free scan

The scan form asks for a website address. If you give us an email address so we can send the result, we hold that too. That is the whole collection.

If you submit an audit intake

The intake form asks for your name, business name, phone number, email address, website, a description of your business, the markets you serve, the search phrases you want to be found for, optionally your competitors and ad spend, and what you want the audit to achieve. We use it to run the audit and to reply to you. Nothing on that form feeds a newsletter or a sales sequence.

If you become a client

We hold what the engagement requires: contact details, billing details, the access we need to do the work, and the reports we produce for you. Where you give us access to a system of yours — a CMS login, an analytics property, a search console — we use it only for the agreed work, and we ask you to remove that access when the engagement ends.

How the testing works, and what leaves our hands

This is the part a standard privacy policy would not tell you, and it is the part that matters most, so it gets its own section.

Measuring AI visibility means asking AI assistants the questions your buyers ask, and recording what they say. To do that, we submit your business name, your website address and the search phrases you gave us to third-party AI systems — the same systems your customers use. Those providers receive that information and handle it under their own terms, which we do not control.

Two commitments about how we do that:

• We do not put personal data into prompts. Prompts contain business names, domains and search phrases. They do not contain your customers' details, your staff list, or anything else personal you may have shared with us in the course of the work.
• We tell you which systems we tested. Every report names the assistants used and the dates, because a result you cannot trace is a result you cannot check.

If you would rather we did not submit your details to a particular provider, say so before we start and we will exclude it — your report will simply note the gap.

Why we are allowed to hold it

Where the UK or EU General Data Protection Regulation applies to you, our lawful bases are:

• Performance of a contract — running the audit or the engagement you asked for.
• Legitimate interests — replying to enquiries, keeping records of work done, keeping the site secure and working, and understanding in aggregate which pages are useful. We have considered your interests alongside ours and do not think any of this would surprise you.
• Consent — for anything you specifically opt into. You can withdraw it at any time.
• Legal obligation — tax and accounting records.

We also operate under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Its executive regulations have not yet been issued, so where the UAE position is unsettled we apply the GDPR standard, which is the stricter of the two.

Who else touches it

We keep the list of third parties short on purpose. Each of these processes data on our behalf, under contract, and none of them may use it for their own purposes:

We will also disclose information if the law genuinely requires it. If that ever happens and we are permitted to tell you, we will.

Sending data abroad

We are in the UAE, our clients are worldwide, and the AI providers we test against are mostly in the United States. So yes — data crosses borders. Where information protected by the UK or EU GDPR leaves that area, we rely on the appropriate safeguards for the transfer, including standard contractual clauses where they apply. Ask us and we will tell you which mechanism covers your case.

How long we keep it

• Scan requests — 12 months, then deleted. Long enough to re-run a comparison, short enough not to be a liability.
• Audit intakes that do not become work — 24 months, then deleted.
• Client records and reports — for the engagement and 6 years after, which is what tax and professional-records obligations require.
• Analytics — aggregated, and not tied back to you.

Your rights

Wherever you are, we will honour these. We do not make you prove you are in a particular jurisdiction first.

• See it — ask for a copy of what we hold about you.
• Fix it — have anything inaccurate corrected.
• Delete it — ask us to erase it, where we are not required to keep it.
• Restrict or object — tell us to stop a particular use, including anything relying on legitimate interests.
• Take it with you — get what you gave us in a portable format.
• Withdraw consent — at any time, without it affecting what was done beforehand.
• Not be sold — we do not sell or share personal information for cross-context behavioral advertising, so there is nothing here to opt out of.

Email customercare@visible2.com and we will respond within 30 days. There is no charge.

Cookies and analytics

Plainly, so there is no confusion: this site does not show a cookie banner, and Google Analytics runs on every visit. We would rather tell you that than show you a consent box that does not actually hold anything back.

What that means in practice:

• What is set. The cookies WordPress needs in order to function, and Google Analytics cookies (_ga and a related identifier) which let us count visits and see which pages are read.
• What it is used for. Aggregate statistics only. We do not enable Google's advertising features, we do not build a profile of you across other websites, and we do not run advertising or cross-site tracking cookies of any kind.
• Where it goes. To Google, in the United States and other countries where Google operates. Google Analytics 4 does not store full IP addresses.

If you would rather not be counted, any of these work and none of them break the site: block cookies for this domain in your browser, use private browsing, turn on your browser's tracking protection, or install Google's own opt-out add-on, which switches Analytics off across every site you visit. You can also email us and we will exclude you.

Security

The site runs over HTTPS. Access to submissions is restricted to people who need it. We keep the amount of personal data we hold deliberately small, which is the only security measure that never fails. No system is perfectly secure, and we will not pretend otherwise — if a breach ever affects you, we will tell you and tell you what we are doing about it.

Children

This is a business-to-business service. It is not directed at children and we do not knowingly collect their data.

Changes to this policy

When we change it, we change the effective date at the top. If a change materially affects how we handle information you have already given us, we will tell you directly rather than quietly updating the page.

Complaints

Come to us first — customercare@visible2.com — and we will try to put it right. If you are not satisfied, you can complain to your local data protection authority: in the UAE the UAE Data Office, in the UK the Information Commissioner's Office, and in the EU your national supervisory authority.