Privacy Policy

Last updated: 2 July 2026

This policy explains how AI Visibility Tool ("we", "us") collects and uses personal data when you use aivisibilitytool.uk (the "Service"). We are the data controller for the personal data described here. We handle personal data in line with the UK GDPR and the Data Protection Act 2018.

1. What we collect

• Account identity: when you sign in with Google, we receive your email address and basic profile from Google to identify you and manage your account.
• Google Analytics access: a read-only OAuth token that lets the Service request report data from GA4 properties you already have access to. Tokens are encrypted at rest on our server.
• Analytics report data: aggregated GA4 metrics (users, sessions, views, landing pages, geography, device and timing) that the dashboard displays. This is requested on demand and cached briefly to reduce API usage.
• Contact enquiries: the name, email, optional company and message you submit through the contact form, plus the timestamp and IP address of the submission for security and abuse prevention.

2. What we do not collect

We do not receive or store the private prompts people type into AI assistants — GA4 does not expose them. We do not sell your data, and one user's data is never shared with another.

3. How we use your data

• To authenticate you and give you access to the Service.
• To fetch and display your GA4 analytics inside the dashboard.
• To respond to contact enquiries.
• To secure the Service and prevent abuse (rate limiting, logging).

4. Lawful basis

We rely on your consent (for connecting your Google Analytics account), and on our legitimate interests in operating, securing and improving the Service and in responding to enquiries you send us.

5. Google user data

The Service's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only request the read-only Analytics scope, use the data solely to provide the dashboard features you can see, and never transfer it to third parties except as needed to run the Service or as required by law.

6. Retention

OAuth tokens are kept until you disconnect the account or ask us to delete them. Cached report data expires automatically (typically within 30 minutes to 24 hours). Contact enquiries are kept for as long as needed to deal with your request and a reasonable period afterwards.

7. Sharing

We use Google (authentication and Analytics APIs) and our hosting provider to run the Service. We do not sell personal data or share it for advertising.

8. Your rights

Under UK GDPR you can request access to, correction of, or deletion of your personal data, object to processing, or withdraw consent at any time by disconnecting your Google account or contacting us. You can also complain to the Information Commissioner's Office (ICO).

9. Contact

For any privacy request, use the contact form and we'll respond promptly.