How Visisona Ltd collects, uses and protects your personal data, how long we keep it, cookies, and your rights under UK GDPR.
Privacy Policy - Visisona Ltd Version: 1.2 Effective Date: 25 September 2026 1. Introduction Visisona Ltd (“we”, “us”, “our”), registered in Scotland (Company No. SC755759), is the data controller for the personal data processed through the Visisona platform (“Service”). Our registered office is at DunEden Business Centre, 8 Harrison Road, Dundee, DD2 3SN, United Kingdom. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 2. Data We Collect We collect the following categories of personal data: 2.1 Account Information - Full name - Email address - Password (stored as a secure hash — we cannot read your password) - Phone number, country, and business name (optional) 2.2 Technical Data - IP address at signup and login - Browser user agent string - Login timestamps and frequency - Last activity timestamps 2.3 Billing Data - Subscription plan and billing cycle - Stripe customer ID (payment details are held by Stripe, not by us) - Invoice history 2.4 Content Data - Images, videos, and other files you upload - Catalog metadata (names, descriptions, settings) - Usage statistics (storage, views, bandwidth) 2.5 Catalog Readers and Site Visitors When someone views a published catalog, we record viewing statistics for the catalog owner: - A one-way code derived from the reader's IP address instead of the address itself (this code is still treated as personal data) - Approximate country, estimated from the IP address by Cloudflare - Device type and browser - The referring website, pages viewed, buttons clicked, and where the catalog was shared If a reader sends a message through a catalog's contact form, we store their name, email address, phone number (if given), message, IP address, browser details and approximate country. The catalog owner sees these in their Analytics and may also receive them by email. The catalog owner is the controller of this data and we process it on their behalf; it is deleted when the catalog, or the catalog owner's account, is deleted. If a reader reports a catalog, we store the reason, their message and a one-way code derived from their IP address, to review the report. We count visits to visisona.com with Cloudflare Web Analytics, which does not use cookies or collect personal data such as IP addresses. 2.6 Consent Records - Date and time you accepted the Terms of Service - Date and time you accepted this Privacy Policy - Version numbers of accepted documents 3. Legal Basis for Processing We process your data under the following lawful bases: - Contract: Processing necessary to provide the Service you have subscribed to (Article 6(1)(b) UK GDPR) - Consent: Where you have given explicit consent, such as accepting this Privacy Policy (Article 6(1)(a)) - Legitimate Interest: For security monitoring, fraud prevention, and service improvement (Article 6(1)(f)) - Legal Obligation: For tax records, regulatory compliance, and responding to lawful requests (Article 6(1)(c)) 4. How We Use Your Data - To create and manage your account - To provide, maintain, and improve the Service - To process payments and manage subscriptions - To send important service notifications (account verification, password resets, billing alerts) - To monitor for abuse, fraud, and security threats - To comply with legal obligations - To provide customer support 5. Data Sharing We share personal data only with the following categories of recipients: - Stripe: Payment processing (Stripe acts as an independent controller for payment data) - Cloudflare: CDN, security services, and cookieless website analytics (data processing agreement in place) - Google: AI image and video generation in AI Studio (the prompts and reference images you submit are sent to Google to generate your content) - DigitalOcean: Database hosting (data processing agreement in place) - Render: Application hosting (data processing agreement in place) - Brevo (Sendinblue): Transactional email delivery We do not sell your personal data to third parties. We do not use your data for advertising purposes. 6. International Transfers Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions, as required by UK GDPR. 7. Data Retention - Active accounts: Data is retained for the duration of your account - Deleted accounts: Personal data is permanently removed upon account deletion, subject to our lifecycle process (grace period, archive period, then permanent deletion) - Billing records: Retained for 7 years as required by UK tax law - Admin activity logs: Retained for 2 years for security and audit purposes 8. Your Rights Under UK GDPR You have the following rights regarding your personal data: - Right of Access: Request a copy of the personal data we hold about you - Right to Rectification: Request correction of inaccurate data - Right to Erasure: Request deletion of your data (“right to be forgotten”) - Right to Restrict Processing: Request that we limit how we use your data - Right to Data Portability: Request your data in a structured, machine-readable format - Right to Object: Object to processing based on legitimate interest - Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time To exercise any of these rights, contact us at support@visisona.com. We will respond within 30 days as required by UK GDPR. 9. Data Security We implement appropriate technical and organisational measures to protect your data, including: - Encryption in transit (TLS/HTTPS) - Passwords stored using bcrypt hashing - Access controls and role-based permissions - Regular security monitoring and audit logging - Secure cloud infrastructure with reputable providers 10. Cookies The Service uses essential cookies and local storage for authentication (session tokens). We do not use tracking cookies, advertising cookies, or analytics cookies, and the catalog viewer sets no cookies for readers. Website visits are counted with Cloudflare Web Analytics, which is cookieless. No cookie consent banner is required as we only use strictly necessary cookies. 11. Children's Privacy The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly. 12. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. The version number and effective date at the top of this page will be updated accordingly. 13. Complaints If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow Cheshire, SK9 5AF https://ico.org.uk 14. Contact For any questions or requests regarding this Privacy Policy or your personal data, contact us at: support@visisona.com Visisona Ltd DunEden Business Centre 8 Harrison Road, Dundee DD2 3SN, United Kingdom Company No. SC755759