What we do with your data.

SupaVisible is run by Benjamin Adams, a sole trader in the United Kingdom, who is the data controller for the personal data described on this page. For anything in this policy, including a request to see or delete your data, write to hello@supavisible.com.

By post: Suite RA01, 195-197 Wood Street, London E17 3NU.

Only what the product needs to do its job:

• +Your email address, and your password if you set one. If you sign in with Google, your name and email address from your Google account.
• +Your website address, and the content of the public pages we scan on it. If you enter your website before you have an account, we keep the address and what we read from it so you can come back to it.
• +Search performance data from the Google Search Console property you connect: queries, clicks, impressions and positions.
• +The articles you generate and edit, and any published URL you give us.
• +If you connect Webflow or WordPress, the access key or password you give us for it, encrypted before it is stored, and the fields you choose to fill.
• +Billing details, if you subscribe. Card numbers go to Stripe and never reach our servers. To give each business one free trial, we keep the email address and a fingerprint of the card that started it: a code Stripe gives us that identifies a card without its number.
• +How you use SupaVisible: the pages you open and what you do on them, such as reading your website or publishing an article. When you are signed in, this is linked to your account.
• +Recordings of how the pages are used, with every word on screen and everything you type hidden.

Four kinds, and only the first is required:

• +Account emails: your sign-up code, password resets, receipts, a reminder before your free trial ends, and anything we must tell you about your account. These cannot be turned off while you have an account.
• +Updates on your work: when an outline or article is ready, when a published article shows up in Google or reaches the top 10, when something is stopping Google reading your pages, and a weekly summary if you turn it on. Each person chooses which ones they get in Settings.
• +Getting-started emails: a short welcome once your account is set up, and a reminder if you have not finished setting up or written your first article. You get these unless you turn them off, which you can do from any of them or in Settings.
• +Product news: occasional updates and SEO tips. Only if you tick the box when you sign up or turn it on in Settings. You can stop them from any email or in Settings.

Resend sends every one of them. To decide when the last two are due, it also holds your email address, your first name, and a few facts that decide which email is due: when you signed up, whether you have finished setting up, whether you have written an article, your plan and your website address. It holds nothing from Search Console and none of your articles. When you tick the product news box we keep a record of when, and of the words you agreed to.

It is the core of the product. SupaVisible reads the searches your site already appears for so it can find the ones you rank just below, which is the data most small companies never use.

We request a single read-only scope, webmasters.readonly. We cannot change anything in your Search Console or in your Google account, and we ask for nothing else. Your Google refresh token is encrypted with AES-256-GCM before it is stored.

We use your Search Console data for one thing: the features you see in SupaVisible. That means showing your searches and positions, choosing what to write next, writing articles and plans, and tracking how published pages move. We do not sell it, we do not use it for advertising, and we do not use it to train AI models, ours or anyone else's. Nobody at SupaVisible reads it unless you ask us to (for example, to answer a support question), we need to for security, or the law requires it.

SupaVisible's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time from Settings. That deletes the stored token and stops us fetching anything new. Data we already fetched stays in your account, so your history and articles keep working, until you delete your account or ask us to delete it. You can also remove our access from your Google account at myaccount.google.com/permissions.

UK GDPR asks us to name one for each thing we do, so here they are in plain terms:

• +Performing our contract with you: running your account, scanning your site, generating your articles, and taking payment.
• +Our legitimate interests: keeping the service secure, preventing abuse (including giving each business only one free trial), and understanding which features work so we can improve them. We use the minimum data that answers the question.
• +Legal obligation: keeping billing records for the period tax law requires.
• +Our legitimate interests again, for getting-started emails: helping you set up the account you just opened. You can turn them off at any time.
• +Your consent, for product news. You give it by ticking a box that starts unticked, and you can withdraw it at any time.

Connecting Google Search Console is your choice, not a condition of having an account, and you can withdraw it whenever you like by disconnecting in Settings. That stops us fetching anything new and does not affect what we did while it was connected.

We use these providers to run the service. Each one only receives what it needs for its part.

• +Supabase stores the database, your account and your generated articles.
• +Anthropic generates articles and plans and analyses the pages we scan. To do that it receives the Search Console searches, clicks and positions that relate to the article or plan. Anthropic does not train its models on this data.
• +DataForSEO receives your website address to find your competitors and the searches they win. On paid plans it also receives the searches your site appears for, to tell us how many people make each one and how hard it is to rank for, without your clicks or positions. Apart from Anthropic, it is the only provider here that receives anything from your Search Console.
• +Google provides the Search Console data you connect, and Google sign-in if you use it.
• +Stripe handles payments and card details.
• +Resend sends the emails we send you.
• +Brandfetch supplies the logos we show next to websites.
• +Cloudflare checks that sign-ins and website reads come from a person, not a bot (Turnstile).
• +Webflow or WordPress, only if you connect one: we send the articles you choose to publish to your own site.
• +Vercel hosts the application.
• +PostHog records how SupaVisible is used, on its servers in the EU, so we can see what helps and what gets in the way. It does not receive your Search Console data or the text of your articles.

We do not sell your data, and we do not share it for advertising.

Some of it, yes. Several of the providers above are based in the United States or process data there, including Anthropic, Stripe and Vercel. Where personal data leaves the United Kingdom we rely on the transfer safeguards UK law provides, such as the UK Addendum to the standard contractual clauses, or an adequacy decision where one covers the country.

We set the cookies needed to keep you signed in, and nothing else. Your browser also remembers a few choices you make, such as light or dark mode and your place in the course, and they stay on your device. We use PostHog to see how SupaVisible is used, set up to store nothing on your device: no cookie and no local storage. If you are not signed in, your visit is counted without knowing who you are. Once you are signed in, what you do in the product is linked to your account. There are no advertising cookies and no tracking pixels.

For as long as you have an account. You can delete your workspace and account yourself in Settings, Plan and billing, or write to us and we will confirm when it is done. We then remove your personal data, your Search Console data and your generated articles, other than anything we have to keep for accounting and tax purposes, which is typically billing records for six years, and the record of a free trial, which we keep so the same business cannot start another one. What we read from a website you entered without making an account is deleted after 30 days.

Under UK GDPR and the Data Protection Act 2018 you can ask us for a copy of your data, ask for it in a portable format, correct it, delete it, or object to us processing it. Write to hello@supavisible.com and we will respond within one month.

If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.

Yes. SupaVisible is a business tool and is not intended for anyone under 18. We do not knowingly collect data about children, and if we find that we have we will delete it.

Probably, as the product grows. The date at the top of this page always shows the current version, and if a change materially affects how we handle your data we will email you rather than quietly edit the page. This policy is governed by the laws of England and Wales.