Privacy Policy

Vistobi operates Vistobi, available at https://app.vistobi.com. For the personal data described here we act as the data controller. You can reach us at info@vistobi.com.

• Account data: email address, display name, password (stored only as a salted hash by our authentication provider), language and time-zone preference, workspace membership and role.
• Workspace configuration: the websites you add, their domains, selected Google properties, WordPress connection details, e-commerce API credentials and monitoring settings.
• Metrics collected on your behalf: aggregated traffic, search, ranking, site-health and order data for the websites in your workspace.
• Assistant conversations: the questions you ask Tobi and the answers generated for you.
• Billing data: subscription plan, status and period, plus a customer and subscription identifier from our payment provider. We never receive or store full card numbers.
• Technical and usage data: log entries, error reports and aggregated product analytics events (for example that a website was added), used to operate and improve the service.

If you choose to connect Google, we request read-only access with the minimum scopes needed:

• https://www.googleapis.com/auth/analytics.readonly — to list your GA4 properties so you can select them, and to read aggregated traffic, engagement, conversion and revenue metrics for the selected properties.
• https://www.googleapis.com/auth/webmasters.readonly — to list your Search Console properties, and to read search queries, clicks, impressions, click-through rate, average position, page performance and sitemap or indexing status for the selected properties.

We use this data solely to display metrics, calculate the Tobi Score, generate your daily brief and answer your own questions inside your workspace. We do not request write access, and we do not modify anything in your Google accounts.

Vistobi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described in this policy.
• We do not transfer or sell Google user data to advertising platforms, data brokers, resellers or information resellers.
• We do not use Google user data to serve advertisements.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models. Data is only sent to our AI provider to answer your own question about your own workspace, and is not used by that provider for model training.
• Humans do not read your Google user data, except with your explicit permission for a support request you raised, when required by law, for security investigations or abuse handling, or on aggregated and anonymised data for internal operations.

• Performance of a contract: operating your account, workspaces, monitoring and billing.
• Consent: connecting your Google, WordPress or e-commerce accounts, and any optional notification emails. You can withdraw consent at any time by disconnecting the integration.
• Legitimate interests: security, abuse prevention, service reliability and product improvement using aggregated data.
• Legal obligation: accounting and tax records for paid subscriptions.

• Data is stored on the Base44 application platform, which hosts our database, backend functions and file storage.
• Access tokens and API credentials are stored server-side and are never exposed to the browser. Requests to third-party APIs are made only from our backend.
• All traffic is encrypted in transit over HTTPS.
• Each workspace is isolated at the database level, so records belonging to one workspace are not readable by another workspace's accounts.
• Access to production data by our staff is limited to what is necessary to operate and support the service.

We do not sell personal data. We share data only with the processors needed to run the service:

• Base44 — application hosting, database, authentication and transactional email.
• Stripe — subscription payments and invoicing.
• Our AI model provider — receives only the specific question and the relevant metrics needed to generate your answer or brief; not used for model training.
• Google — only to read the data you authorised, on your behalf.
• Providers you connect yourself, such as your WordPress site, your webshop or your SEO data provider.

• Account and workspace data is kept while your account exists.
• Daily metric records are retained for up to 25 months so that year-over-year comparisons remain possible; detailed query-level records are aggregated earlier, as shown in the application's data-retention settings.
• Assistant conversations are retained for up to 12 months.
• Synchronisation and audit logs are retained for up to 12 months.
• Google access and refresh tokens are deleted immediately when you disconnect the integration or delete your account.
• When you delete your account, or ask us to delete it, we delete your account data, workspace configuration and collected metrics within 30 days, except records we must keep for accounting purposes.

You can revoke Vistobi's access to your Google account at any time in the application, or directly at myaccount.google.com/permissions. To request deletion of your data, email info@vistobi.com.

Depending on where you live, you have the right to access, correct, delete, export or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. Contact info@vistobi.com and we will respond within 30 days. If you are in the EU, you may also lodge a complaint with your local data protection authority.

Some of our processors operate outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

Vistobi is a business tool and is not intended for children under 16. We do not knowingly collect data from children.

We use strictly necessary cookies and browser storage to keep you signed in and to remember your language, theme and view preferences, plus aggregated product analytics to understand which features are used. We do not use advertising cookies.

We will update this page when our practices change and revise the date above. Material changes affecting how we use Google user data will be announced in the application before they take effect. See also our Terms of Service.