What we do with your data.

SupaVisible is a service operated from the United Kingdom, and it is the data controller for the personal data described on this page. For anything in this policy, including a request to see or delete your data, write to hello@supavisible.com.

SupaVisible is a trading name rather than a registered company. If you need the operator's registered details for your own compliance records or for a formal data request, ask at that address and we will give them to you.

Only what the product needs to do its job:

• +Your email address and your password.
• +Your website address, and the content of the public pages we scan on it.
• +Search performance data from the Google Search Console property you connect: queries, clicks, impressions and positions.
• +The articles you generate and edit, and any published URL you give us.
• +Billing details, if you subscribe. Card numbers go to Stripe and never reach our servers.

Three kinds, and only the first is required:

• +Account emails: your sign-up code, password resets, receipts and anything we must tell you about your account. These cannot be turned off while you have an account.
• +Getting-started emails: a short welcome once your account is set up, and a reminder if you have not finished setting up or written your first article. You get these unless you turn them off, which you can do from any of them or in Settings.
• +Product news: occasional updates and SEO tips. Only if you tick the box when you sign up or turn it on in Settings. You can stop them from any email or in Settings.

To send the last two, Resend holds your email address, your first name, and a few facts that decide which email is due: when you signed up, whether you have finished setting up, whether you have written an article, your plan and your website address. It holds nothing from Search Console and none of your articles. When you tick the product news box we keep a record of when, and of the words you agreed to.

It is the core of the product. SupaVisible reads the searches your site already appears for so it can find the ones you rank just below, which is the data most founders never use.

We request a single read-only scope, webmasters.readonly. We cannot change anything in your Search Console or in your Google account, and we ask for nothing else. Your Google refresh token is encrypted with AES-256-GCM before it is stored.

We use your Search Console data for one thing: the features you see in SupaVisible. That means showing your searches and positions, choosing what to write next, writing articles and plans, and tracking how published pages move. We do not sell it, we do not use it for advertising, and we do not use it to train AI models, ours or anyone else's. Nobody at SupaVisible reads it unless you ask us to (for example, to answer a support question), we need to for security, or the law requires it.

SupaVisible's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from Settings. That deletes the stored token and stops us fetching anything new. Data we already fetched stays in your account, so your history and articles keep working, until you delete your account or ask us to delete it. You can also remove our access from your Google account at myaccount.google.com/permissions.

UK GDPR asks us to name one for each thing we do, so here they are in plain terms:

• +Performing our contract with you: running your account, scanning your site, generating your articles, and taking payment.
• +Our legitimate interests: keeping the service secure, preventing abuse, and understanding which features work so we can improve them. We use the minimum data that answers the question.
• +Legal obligation: keeping billing records for the period tax law requires.
• +Our legitimate interests again, for getting-started emails: helping you set up the account you just opened. You can turn them off at any time.
• +Your consent, for product news. You give it by ticking a box that starts unticked, and you can withdraw it at any time.

Connecting Google Search Console is your choice, not a condition of having an account, and you can withdraw it whenever you like by disconnecting in Settings. That stops us fetching anything new and does not affect what we did while it was connected.

We use these providers to run the service. Each one only receives what it needs for its part.

• +Supabase stores the database, your account and your generated articles.
• +Anthropic generates articles and plans and analyses the pages we scan. To do that it receives the Search Console searches, clicks and positions that relate to the article or plan. Anthropic does not train its models on this data. No other provider on this list receives your Search Console data.
• +Google provides the Search Console data you connect.
• +Stripe handles payments and card details.
• +Resend sends the emails we send you.
• +DataForSEO and Brandfetch supply competitor search data and brand information.
• +Browserless renders pages we cannot read without a browser.
• +Vercel hosts the application.

We do not sell your data, and we do not share it for advertising.

Some of it, yes. Several of the providers above are based in the United States or process data there, including Anthropic, Stripe and Vercel. Where personal data leaves the United Kingdom we rely on the transfer safeguards UK law provides, such as the UK Addendum to the standard contractual clauses, or an adequacy decision where one covers the country.

We set the cookies needed to keep you signed in, and nothing else. There is no third-party analytics on this site, no advertising cookies and no tracking pixels. Nothing here asks for a cookie banner because there is nothing to consent to beyond staying logged in.

For as long as you have an account. If you delete your account we remove your personal data, your Search Console data and your generated articles, other than anything we have to keep for accounting and tax purposes, which is typically billing records for six years. Ask us to delete your account and we will confirm when it is done.

Under UK GDPR and the Data Protection Act 2018 you can ask us for a copy of your data, ask for it in a portable format, correct it, delete it, or object to us processing it. Write to hello@supavisible.com and we will respond within one month.

If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.

Yes. SupaVisible is a business tool and is not intended for anyone under 18. We do not knowingly collect data about children, and if we find that we have we will delete it.

Probably, as the product grows. The date at the top of this page always shows the current version, and if a change materially affects how we handle your data we will email you rather than quietly edit the page. This policy is governed by the laws of England and Wales.