Privacy policy
How we collect, use and protect personal data, and the rights you have over it.
Who we are
Aivosity ("Aivosity", "we", "us") is established in Spain, founded in 2026, and operates aivosity.com, selling AI visibility reports to business customers. We are the data controller for everything described here. Our full company details are on the legal notice page, and anything privacy-related can go straight to privacy@aivosity.com.
This policy is written to comply with the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection and Guarantee of Digital Rights (LOPDGDD).
What data we collect
We collect the following categories of personal data:
- Enquiry and account data: your name, work email address, company name, website, role and the content of messages you send us through the contact form or by email.
- Order and billing data: the business to be tested, industry, location, plan chosen, invoicing details and payment status. Card details are processed by our payment provider and are never stored on our systems.
- Report input data: facts you provide about your business (hours, services, prices, staff names, certifications) so we can check model responses for accuracy.
- Technical data: server logs including IP address, browser type, pages requested and timestamps, kept for security and to keep the site working. We do not use analytics cookies; see our cookie policy.
We do not knowingly collect data from anyone under 18, and our services are offered to businesses only.
Data we collect from public sources
To produce a report we query AI models and fetch publicly available web pages about the industry, location and business being tested — the customer's own website, plus directories and review sites. Our crawler identifies itself, follows robots directives and never tries to reach anything behind a login. These pages may contain personal data of third parties (for example, the names of professionals at a business). We process this data only to the extent necessary to produce the report, on the basis of our legitimate interest in providing the service and our customer's legitimate interest in understanding their public reputation. We do not build profiles of individuals and we do not retain third-party personal data beyond the report and its underlying response records.
The questions we send to AI models are generated from industry and location and do not contain your business name or personal data.
Why we process your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiry | Your consent (Art. 6(1)(a) GDPR), given when you submit the form, and pre-contractual steps (Art. 6(1)(b)) |
| Producing and delivering reports you order | Performance of a contract (Art. 6(1)(b)) |
| Invoicing and accounting | Legal obligation (Art. 6(1)(c)), including Spanish tax and commercial law |
| Site security and logs | Legitimate interest (Art. 6(1)(f)) in keeping our systems secure |
| Sending service updates about your plan | Performance of a contract |
| Occasional product news to existing customers | Legitimate interest in maintaining the customer relationship; you can opt out at any time |
Who we share data with
We share personal data only with service providers who process it on our behalf under written agreements: web hosting, email, form handling, payment processing, invoicing software and the AI model providers whose APIs we query. Where a provider is located outside the European Economic Area, transfers are covered by an adequacy decision or the European Commission's Standard Contractual Clauses.
We do not sell personal data, and we do not share your data with advertisers. We may disclose data if required by law or to protect our legal rights.
How long we keep data
- Enquiries that do not lead to an order: 12 months from the last contact.
- Customer and order data: for the duration of the relationship and then for the period required by Spanish tax and commercial law (generally 5 to 6 years).
- Report input data and captured model responses: for the life of your plan plus 24 months, so historical comparisons remain possible, unless you ask us to delete them sooner.
- Server logs: 90 days.
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting processing already carried out. To exercise any of these rights, email privacy@aivosity.com. We will respond within one month.
If you believe we have not handled your data correctly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, www.aepd.es) or to the supervisory authority in your own EU member state.
Security
We use encrypted connections (HTTPS) for the website and for API traffic, access controls and two-factor authentication on the systems that hold customer data, and we limit access to those who need it to deliver the service. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the AEPD as required by law.
Changes to this policy
We may update this policy as our service or the law changes. The date at the top shows the latest version. Significant changes will be announced to customers by email. Questions about this policy can be sent to privacy@aivosity.com.