Privacy Policy

Scope and operator

This staging draft explains the application behavior reviewed for this release. It is not a completed public privacy notice. The legal operator, privacy contact, applicable privacy laws, legal bases and international-transfer arrangements require confirmation before commercial launch.

Information processed

Account data includes your email, Supabase authentication identity and confirmation state, workspace memberships and roles, and account privacy choices. Authentication requests contain your password; VIDIK360 forwards them to Supabase. The application does not put passwords in project data or ordinary application logs.

Workspace data includes business names, domains, Place IDs if supplied, search queries, prompts, coordinates, provider location settings, annotations and configuration history. Scanning can produce raw provider evidence, normalized observations, timestamps, task identifiers, provider-cost records and credit records. Evidence may itself contain public business or individual information from source results.

Billing data includes Stripe customer, subscription, invoice and payment identifiers, recorded catalog versions, monthly service boundaries, credit grants, source expiry and reservations, TEST checkout/refund/cancellation and future plan-change operations, and reconciliation records. Card entry occurs on Stripe-hosted checkout. The application does not receive or store full card numbers.

Reports, share-link limits and revocations, verified recipient addresses, message content and delivery attempts are stored to provide reporting. Privacy controls record versioned acknowledgements, marketing choices, export/deletion requests, review stages and private export snapshots. Restricted operator records include reasons and before/after audit values for account, credit and privacy actions.

Following a VIDIK360 referral link creates a short-lived first-party referral association using an opaque browser token and a server-side token hash. The service records a code, capture/expiry timestamps, qualifying account attribution, program version, payment eligibility, credit rewards or commission entries, reviews and reversals. Explicit approved-promoter codes can also be saved before first payment. Customer referral screens show their own reward activity without referred customer names, email addresses or private scans.

Restricted fraud and financial review can use verified ownership/email relationships and a keyed hash of a payment-method fingerprint. A matching signal is not automatic proof of fraud; missing or ambiguous evidence requires review. Raw card numbers, bank credentials and raw payment fingerprints are not placed in the referral dashboard. Promoter/friend records include reviewed payout batches, owner-entered manual payment references, policies and cost-wallet activity. A payment reference must not include bank credentials or unnecessary personal data.

Why information is used

The implemented uses are authentication, access control, configuration persistence, requested scans and comparisons, reports, billing reconciliation, spending protection, operational diagnosis and responding to privacy choices. Optional marketing preferences are separate from transactional report delivery. No marketing campaign sender is implemented in this release.

The reviewed application contains no advertising pixel, browser analytics or session replay. Hosting and service vendors may process connection metadata to operate their services. The application monitoring hook sends allowlisted incident details when enabled; it does not enable full session replay or user-behavior tracking.

External processing and sharing

Cloudflare hosts the web application and background Workflows. Supabase provides authentication, database and configured private evidence storage. Stripe handles TEST checkout, subscriptions and billing events. DataForSEO receives scan inputs only when a permitted provider request is made. Resend handles authentication emails through Supabase SMTP and permitted report emails. Sentry receives configured operational events. See the vendor list for current integration status and unresolved contract checks.

The map view is an application-rendered coordinate plot. It does not currently load external map tiles. A user opening an evidence, citation or Stripe link leaves the application and contacts that destination.

Workspace members can access information permitted by their role. Report-link holders can access the report scoped to that link. An export or delivered email creates a copy outside the application's access controls.

Retention and deletion

There is no general age-based retention schedule that automatically deletes accounts, configuration history, evidence, reports, financial/provider ledgers or email journals. Credit expiry limits future use of particular credit units; it does not delete the accounting record. A category-specific commercial retention schedule, legal holds and response deadlines still require approval. A separately reviewed request can initiate the bounded content-erasure workflow described below.

Supabase, Cloudflare, Stripe, Resend and Sentry may have their own contractual or configured retention. Those periods, backups and deletion propagation have not all been verified. No fixed vendor retention, backup-erasure or data-residency promise is made here. An export already downloaded or an email already received is a separate copy that the application cannot recall.

Privacy controls provide an immediate scoped account download and a request for a reviewed private export. Reviewed database snapshots are downloaded in pages, so an aggregate account larger than 20 MB is not silently truncated. Downloads include authorized workspace records and the requester's own allowed personal records; billing records require billing membership. Other members' personal records, credentials, private share tokens and internal security records are excluded. The manifest describes included categories and exclusions; this product export is not a claim that every possible legal access request is fulfilled automatically.

Prepared exports are private to the verified requester. The service rechecks captured workspace and billing membership on each download. Separately stored evidence can be downloaded only when its captured object identity, version and content tag can still be verified. Changed or missing objects are not silently replaced with new content. A single artifact larger than 20,000,000 bytes, non-JSON content or missing verification information needs separate operator review. Exceptionally large individual database records and other unimplemented categories may also require reviewed fulfilment. No download link exposes a raw storage path or a public evidence bucket.

Deletion requests are reviewed for identity, shared membership, billing ownership, unresolved work and retention obligations. Reviewed access revocation remains a separate containment action and is not described as completed erasure. Prepared private exports and request status can remain available through authenticated privacy controls after access revocation, subject to current authority and before a content-erasure job begins. Subscription cancellation, refund decisions and outstanding financial reconciliation remain separate billing operations.

For an approved request covering organizations solely owned by the requester with no other members, an authorized platform owner can separately confirm content erasure with fresh authentication and an audit reason. Shared ownership, held credits, unknown paid submissions, unresolved delivery/payment operations and uncancelled active subscription renewal stop preparation for review. Preparation disables application access, future schedules, report email preferences, spending and referral activity, and revokes report links. It does not automatically cancel a Stripe subscription, refund a payment or send an email.

The erasure processor removes the exact recorded private evidence objects through the storage service, then redacts selected business/configuration, observation, report, annotation and email payloads and removes affected prepared exports. It uses Supabase's administrative soft-deletion operation for the authentication identity, preserving the referenced identifier needed by retained records. A failed step remains incomplete for retry or operator review. Processing is bounded and its duration depends on the queue and external services; no automatic completion deadline is promised. A finished authentication deletion also ends signed-in access, so the operator must handle any later request through a separately verified process.

Financial ledgers, payments, refunds, grants, reservations, provider task/cost identifiers, referral awards and relevant audit records remain for reconciliation and retention review. Those retained identifiers and records are not claimed to be anonymous. Tombstones prevent late billing or worker events from restoring ordinary account access or creating new scoped content. The completed workflow is labelled content erased with retained records, not erasure of every vendor record, backup, downloaded copy, unrelated bucket or unreferenced storage object. Unsupported objects and any remaining retention obligations require operator review.

Security and your choices

Implemented controls include server-side provider credentials, authenticated workspace authorization, database access restrictions, private evidence storage, secure HTTP-only session cookies on hosted staging and bounded report links. These controls are not a certification or a guarantee against incidents.

Use Privacy controls for account requests and the billing portal for cancellation. Withdraw optional marketing consent independently of account access. For requests from someone unable to sign in, an accessible verified privacy contact and identity-check process must be established before public launch.