Legal
Privacy Policy
Last updated: July 22, 2026
This policy is written from the actual data flows in the product — what the code collects, stores, and sends — not from a template. If the product changes, this page changes with it.
Who we are
Scale Visibility ("we", "us") is operated by Joshua Winningham, a sole proprietorship based in Arizona, USA. We run www.scalevisibility.com (our marketing site and free tools) and app.scalevisibility.com (the AI Search Readiness Audit product).
Questions about this policy or your data: hello@scalevisibility.com.
What we collect, and when
Broken out by what you actually do, because most visitors never create an account.
Browsing the marketing site
Google Analytics 4 and Google Ads tags run on our pages and collect standard analytics data: pages viewed, approximate location (derived from IP by Google, not stored by us), device and browser, and referring source. We use the same tags on the app so a visit that crosses from the marketing site to the product is understood as one session.
Using the free tools
Our free tools (robots.txt analyzer, schema generator, llms.txt generator, entity check, PageSpeed calculator) run against whatever you paste in. The AI Visibility Check sends your business name, city, and industry to AI providers as part of a search query. We do not store the inputs or results of these tools — they are returned to your browser and discarded. We apply a short-lived, in-memory rate limit keyed to your IP address to prevent abuse; it is not written to a database and is lost whenever the server restarts.
Running a free score (no account)
When you paste a URL for a free AI search readiness score, we store: the domain you submitted, the industry you optionally selected, the audit result, and a one-way cryptographic hash of your IP address — not the address itself. The hash exists solely to enforce a limit of 5 runs per day and cannot be reversed to identify you. We also fetch and analyze the public pages of the domain you submitted.
Free score results live at a shareable link. Anyone with that link can view the report — treat it as public.
Creating an account
We collect your email address and a password (the password is hashed by our authentication provider; we never see it). We create a workspace for you and store the sites you add, the audits you run, and their findings.
If you set up an AI citation check, we store the business details you enter: business name, description, city, industry, and the competitor names and websites you list. This is business information, not personal information, but it is yours and we treat it as confidential.
Buying an audit
Payment is processed entirely by Stripe. We never see or store your card number — it goes directly from your browser to Stripe. We store the amount, the Stripe transaction identifier, the purchase status, and the email address you used at checkout.
Requesting a Tune-Up quote
If you request a done-for-you quote from your report, we store your email address and your message so we can reply.
Who we share it with
We do not sell your personal information. We do not share it for advertising purposes beyond the analytics and conversion measurement described below. We use the following service providers, each of which handles data on our behalf:
| Provider | What it handles | Why |
|---|---|---|
| Vercel | All site and app traffic | Hosting |
| Supabase | Accounts, workspaces, sites, audits, purchases (US, us-east-2) | Database and authentication |
| Stripe | Payment details, buyer email | Payment processing |
| Inngest | Job orchestration for citation checks and speed tests | Background processing |
| Anthropic, OpenAI, Google, Perplexity | Your business name, city, industry, competitor names, and the search queries built from them | Running the AI citation check |
| Google PageSpeed Insights | The URL you submitted | Page speed and Core Web Vitals data |
| Google Analytics / Google Ads | Usage and conversion events | Understanding traffic and measuring advertising |
| Formspree | Contact form submissions (name, email, website, message) | Delivering contact form messages |
| Slack | Operator notifications, which include the domain audited and the buyer's email on a purchase | Alerting us to activity |
We may also disclose information if required by law, or in connection with a sale or transfer of the business.
A note on the AI providers specifically. To answer "does ChatGPT name your business," we have to ask ChatGPT, Claude, Gemini, and Perplexity real questions containing your business details. Those queries are subject to each provider's own terms and privacy practices. We send business information — never your account credentials, payment details, or personal contact information.
Cookies and analytics
We use Google Analytics and Google Ads cookies to understand how people find and use the product and to measure whether advertising works. You can opt out using the Google Analytics opt-out add-on or by blocking cookies in your browser. The product itself works fine with analytics blocked.
We also set an essential session cookie when you sign in. This is required for the product to function and cannot be disabled.
Because we do not sell or share personal information as the CCPA defines those terms, a Global Privacy Control (GPC) signal has nothing additional to opt you out of. To block analytics entirely, use the opt-out add-on or block cookies as described above.
Where your data lives
We are a US business, and our providers store and process data in the United States. If you use the service from outside the US, your information is transferred to and handled in the US, which may not have the same data-protection laws as your country.
How long we keep it
- Free score results: retained indefinitely so shared links keep working. Ask us and we'll delete a specific report.
- Account data (workspace, sites, audits, citation runs): kept while your account is open, and deleted on request.
- Purchase records: retained as long as required for tax and accounting purposes (generally seven years).
- Contact and quote requests: kept while we're in touch, then periodically cleared.
- IP hashes for rate limiting: rolling 24-hour window.
Your rights
Whatever jurisdiction you're in, you can ask us to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Delete your account and its data
- Export your data in a portable format
- Opt out of analytics (see Cookies above)
Email hello@scalevisibility.com and we'll action it within 30 days. We will not charge you or degrade your service for exercising any of these rights.
If you are in California, this includes rights under the CCPA/CPRA. We do not sell or share personal information as those terms are defined. If you are in the EU or UK, we process your data to perform our contract with you (providing the product), to comply with legal obligations (tax records), and on the basis of legitimate interests (security, analytics, product improvement) — and you may lodge a complaint with your local supervisory authority.
Security
Data is encrypted in transit. Our database enforces tenant isolation at the row level, so one customer's workspace cannot read another's. Passwords are hashed by our authentication provider and are never visible to us. Card details never touch our servers.
No system is perfectly secure, and we won't claim otherwise. If we discover a breach affecting your personal data, we'll notify you promptly.
Children
The product is for businesses and is not directed at anyone under 16. We don't knowingly collect data from children.
Changes
If we make a material change, we'll update the date at the top and, for account holders, notify you by email.
Contact
hello@scalevisibility.com
Scale Visibility, Arizona, USA