Privacy Policy — visz.ai
Draft — legal review pending (B7.1).
Covers visz.ai and app.visz.ai. For data our snippet collects on customers' sites, the respective customer is the controller (section 12 and DPA).
1. Controller
Domantas Paradauskas (sole proprietorship), Talstr. 29, 69231 Rauenberg, Germany. Email: info@visz.ai (phone: see Imprint).
2. Data Protection Officer
None appointed (sole proprietorship below § 38 BDSG). Contact: info@visz.ai. An external DPO will be appointed before a wider rollout.
3. Data we process (account and website)
Email, name (optional), password (hash only), 2FA secret (encrypted); Google/GitHub OAuth (email, display name, verify status); dashboard usage (login times, device/browser, anonymised IP); website logs (anonymised IP, time, user agent); cookies (section 14).
4. Purposes
Service delivery, account management, security, bot protection, error diagnostics, legal duties.
5. Legal bases
Art. 6(1)(b) contract (account/service); Art. 6(1)(f) legitimate interest (security, anonymised IP, bot detection); Art. 6(1)(a) consent (non-essential cookies); Art. 6(1)(c) legal obligation (record retention).
6. Account data and retention
Until 30 days after account deletion (grace period), then permanent erasure. Periods: section 15.
7. Third-party sign-in (OAuth)
Login via Google/GitHub: only email and display name. Both USA, hence transfer on EU-US DPF or EU Standard Contractual Clauses (section 11). Apple Sign-In currently inactive.
8. Security and 2FA
Argon2id hashing, server-side sessions, optional TOTP 2FA and hashed backup codes. Token lifetimes: verify 24 hours, reset 1 hour, magic link 20 minutes, invite 7 days, single-use.
9. Payment data — not applicable in the free version
visz.ai is fully free. No payment, invoice or credit-card data, no payment processor.
10. Hosting and data location
Hetzner Online GmbH (Falkenstein/Nuremberg, Germany). Replay and snapshot blobs in EU object storage. All data stays in the EU.
11. Processors and third-country transfer
The full list is public at app.visz.ai/subunternehmer. Resend processes exclusively in the EU region (Frankfurt); the US parent has no routine access, any support access is under Standard Contractual Clauses (SCC). Sentry (EU, Frankfurt), Cloudflare (marketing CDN, DPF/SCC) and GitHub Actions (CI/CD, US, SCC — never customer data). Geo lookup uses a local MaxMind database without any external call and is therefore not a processor.
11a. Pre-beta mandatory block
Mandatory before any wide beta rollout:
- Create a Data Protection Impact Assessment (Art. 35 GDPR) — session recordings and behaviour tracking are systematic monitoring on a large scale and thus require a DPIA; mitigation: PII masking, IP anonymisation, consent gate, 30-day retention.
- Lawyer review of the mandatory documents (privacy policy, DPA, terms, DPIA) — no launch without it.
- Appoint an external Data Protection Officer (no internal DPO; dsb@visz.ai is not active) — selection and appointment before beta.
- Obtain outstanding DPAs (Grafana Cloud, Better Stack, Zoho Mail).
12. Dual role
For snippet data on customer sites the customer is the controller; we act as processor (DPA). This policy only concerns our own role.
13. Compliance records
Consent, DSR and deletion logs are kept longer (section 15).
14. Cookies and consent (visz.ai)
Necessary cookies (always on); analytics and marketing cookies only with consent (banner). Your choice lasts up to 12 months (cookie „visz_consent“). We honour „Do Not Track“. Change via the footer link „Change cookie settings“.
15. Retention
Raw data 30 days, anonymised IP 30 days, account data 30 days post-deletion, security log 1 year, compliance records up to 3 years.
16. Your rights
Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal (Art. 7(3)). Requests: info@visz.ai; reply within one month.
17. Automated decisions
None with legal effect within the meaning of Art. 22.
18. Right to complain
Competent authority: LfDI Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, poststelle@lfdi.bwl.de, +49 711 615541-0.
19. Obligation to provide
An account email is required to use the service; without it no account.
20. „Your data belongs to you“
We never sell data, never use it for AI training and never for third-party advertising.
21. Changes
Updated as needed; material changes notified 30 days in advance by email. The version published here applies; the German version prevails.