Privacy Policy

Scope and operator

This staging draft explains the application behavior reviewed for this release. It is not a completed public privacy notice. The legal operator, privacy contact, applicable privacy laws, legal bases and international-transfer arrangements require confirmation before commercial launch.

Information processed

Account data includes your email, Supabase authentication identity and confirmation state, workspace memberships and roles, and account privacy choices. Authentication requests contain your password; VIDIK360 forwards them to Supabase. The application does not put passwords in project data or ordinary application logs.

Workspace data includes business names, domains, Place IDs if supplied, search queries, prompts, coordinates, provider location settings, annotations and configuration history. Scanning can produce raw provider evidence, normalized observations, timestamps, task identifiers, provider-cost records and credit records. Evidence may itself contain public business or individual information from source results.

Billing data includes Stripe customer/subscription/invoice identifiers, plan state, credit grants and test event records. Card entry occurs on Stripe-hosted checkout. The application does not receive or store full card numbers.

Reports, share-link limits and revocations, verified recipient addresses, message content and delivery attempts are stored to provide reporting. Privacy controls record versioned staging acknowledgements, marketing choices and deletion requests.

Why information is used

The implemented uses are authentication, access control, configuration persistence, requested scans and comparisons, reports, billing reconciliation, spending protection, operational diagnosis and responding to privacy choices. Optional marketing preferences are separate from transactional report delivery. No marketing campaign sender is implemented in this release.

The reviewed application contains no advertising pixel, browser analytics or session replay. Hosting and service vendors may process connection metadata to operate their services. The application monitoring hook sends allowlisted incident details when enabled; it does not enable full session replay or user-behavior tracking.

External processing and sharing

Cloudflare hosts the web application and background Workflows. Supabase provides authentication, database and configured private evidence storage. Stripe handles TEST checkout, subscriptions and billing events. DataForSEO receives scan inputs only when a permitted provider request is made. Resend handles authentication emails through Supabase SMTP and permitted report emails. Sentry receives configured operational events. See the vendor list for current integration status and unresolved contract checks.

The map view is an application-rendered coordinate plot. It does not currently load external map tiles. A user opening an evidence, citation or Stripe link leaves the application and contacts that destination.

Workspace members can access information permitted by their role. Report-link holders can access the report scoped to that link. An export or delivered email creates a copy outside the application's access controls.

Retention and deletion

The current application has no automatic expiry/deletion scheduler for accounts, configuration history, evidence, reports, credit/provider ledgers or email journals. These remain stored until a controlled administrative process removes or changes them. A commercially appropriate retention schedule has not been approved.

Supabase, Cloudflare, Stripe, Resend and Sentry may have their own contractual or configured retention. Those periods, backups and deletion propagation have not all been verified. No fixed vendor retention or data-residency promise is made here.

Privacy controls let you download an account summary, change marketing preference, clear local drafts and submit a deletion request. A request is stored with its status for operator review. Automatic deletion is not implemented; the summary export is not a complete response to every possible data-access request. Workspace ownership, records that must be retained, vendor copies and backup handling need review before fulfilment.

Security and your choices

Implemented controls include server-side provider credentials, authenticated workspace authorization, database access restrictions, private evidence storage, secure HTTP-only session cookies on hosted staging and bounded report links. These controls are not a certification or a guarantee against incidents.

Use Privacy controls for account requests and the billing portal for cancellation. Withdraw optional marketing consent independently of account access. For requests from someone unable to sign in, an accessible verified privacy contact and identity-check process must be established before public launch.