Privacy policy

Last updated: 20 October 2026.

Who we are

Vizu is operated by Phillip InfoSec, CVR 41892463, Sandbygårdvej 33, 1. tv, 2700 Brønshøj, Denmark. Contact [email protected] about privacy or support.

We are the controller for account administration, billing, support and service security. When a business submits personal data to its workspace, we process that content on its instructions under its data processing agreement. The business determines its purposes and legal basis. Ask the relevant business about its content; we assist it and handle requests about our own processing.

Information and purposes

An account uses a Vizu username and a password or a linked Google, Apple, Microsoft or GitHub account, where enabled. We protect passwords and process sign-in records, linked provider account identifiers, the email and name your provider shares, account preferences, membership and access roles to provide and secure your account. When you choose a provider, it receives the sign-in request and processes it under its own privacy notice. Vizu uses its stable account identifier to recognise your linked account; it does not request access to your repositories, calendar or messages. We use your name or email to identify you to workspace collaborators, and verified email addresses let workspace owners add members. Your workspace can contain text, comments, annotations, images, fonts, asset metadata and previous design versions. Members and connected agents you authorize can access it according to their permissions. If you enable public link access, anyone holding the link can view the workspace’s designs and assets. Turning it off blocks future access through that link; copies already downloaded remain outside Vizu.

When the shared free-image protection is enabled, successful signup and sign-in use your connection's IP address to create a protected network reference. IPv6 connections use a shared network prefix. We keep this reference with your account for 35 days after its latest sign-in and use it to apply a shared monthly free-image limit, including requests from connected agents. We do not save the raw IP address in these records or include the reference in diagnostic logs or optional analytics. Account deletion removes its network associations; network-only monthly attempt counts remain until the month ends and normal hourly cleanup removes them. Shared connections can reach the limit together; contact support if this affects you. This processing supports our legitimate interest in preventing abuse and protecting service availability (GDPR Article 6(1)(f)).

Requested image generation uses your prompt, selected reference images, generated results and request information. Our image providers receive the inputs needed to carry out the request and a pseudonymous service user reference. Connected agent services are separate services with their own privacy practices.

If you use ad creation, we process the business information, brand guidance, campaign instructions, selected assets and design references you provide, together with generated samples, creatives and job records. If you request website analysis, we fetch public pages from the website you select and use their text and visual information to suggest business context. The website address, analysis result and business context can be saved with your workspace. The website operator receives the connection needed to fetch its pages.

Requested AI analysis and ad composition send relevant website evidence, business and campaign context, and selected design information to our AI service providers. Requested image generation may also send selected reference images. Include only information you are authorized to share and that is needed for the requested work.

Stripe collects purchaser, contact and payment information and processes transactions. We receive billing references, subscription status and the information needed to administer your plan. Vizu does not receive your full card number. Support receives correspondence and attachments you choose to supply.

Limited diagnostic records contain random request references, app version, operation, outcome and safe failure classifications. They exclude passwords, design content, image prompts and account names. When the investigation service is configured, our restricted diagnostic index stores server operation outcomes and timings for up to seven days, independently of optional interface recording. It can connect an operation to a recording only when a valid recording reference is available. Desktop diagnostic files stay on your device unless you send them to support. Providers also process technical connection information needed for their services.

Legal bases

When referral-source measurement is configured, we reduce an already supplied referring-site address to a broad source category, such as a known AI service, other or unknown, to estimate incoming requests. The daily total contains no referring address or visitor matching key and is kept for seven UTC calendar days. Missing referrers limit this estimate. These totals are separate from individual journeys, signups and payments.

When measurement is configured, we also keep daily service totals for page delivery, operation outcomes and collection health for seven UTC calendar days. These counters contain fixed categories, counts and timing buckets, with no visitor, account, workspace, session or request identifier. They do not use a tracking cookie or fingerprint. We keep exact small totals restricted because aggregation alone does not guarantee anonymity. These totals cannot be attached to your later usage recording; optional recording begins after your permission.

We use the information necessary to perform our contract with individual users for accounts, workspaces, requested image generation, website analysis and ad creation, subscriptions and support (GDPR Article 6(1)(b)). Our legitimate interests in administering a business customer's authorized access and protecting service security and reliability support necessary account administration and limited diagnostics (Article 6(1)(f)). Necessary financial records are retained under legal obligations (Article 6(1)(c)). Optional saved browser interface preferences rely on consent (Article 6(1)(a)); you may withdraw it in Privacy & data. We use voluntarily submitted feature suggestions and optional contact details to assess improvements and respond about the suggestion, based on our legitimate interest in improving Vizu (Article 6(1)(f)). Instructed business content is processed under the customer's agreement and instructions.

Required account and purchase information is needed to provide those services. Support attachments and saved interface preferences are optional. Accepting service terms does not consent to unrelated processing.

Optional campaign measurement

If you allow Campaign statistics, we measure which ads bring people to Vizu and lead to signups or subscriptions. We store the campaign source and labels, a random visit reference, and visit and download-intent times. If you create an account within 30 days, we link the visit to your signup, saved-screen activity and first confirmed paid subscription. This uses activity records, not the contents of your designs. These first-party records stay in Vizu and are separate from the events shared with X, Meta and Reddit below.

This processing relies on your consent (GDPR Article 6(1)(a)), separately from service terms and saved interface preferences. The initial banner can appear on the website and on signup or login before you choose. After a choice, it disappears. Change or withdraw your choice at any time in Cookie settings. Refusing does not affect access to Vizu. Account Privacy & data also lets you request removal of account-linked campaign records; it does not change this browser's advertising choice.

Your browser remembers the choice for 30 days. Visits can be linked to a signup for 30 days; server records are then deleted by hourly cleanup once they reach 90 days, or earlier after confirmed withdrawal or account erasure. Account-linked records are included in your account export. The browser tab keeps a removal reference for up to 90 days so you can remove an earlier visit. If removal fails, keep the tab open and retry Cookie settings or contact support. Clearing browser data resets local choices but does not itself delete server records. A limited record of withdrawal is retained for 90 days after the latest request to prevent delayed requests or restored backups from restarting withdrawn measurement.

Optional advertising measurement

If you allow Advertising measurement, we use X, Meta and Reddit to measure ad visits and confirmed new-account signups. This also relies on your consent (GDPR Article 6(1)(a)); allowing Campaign statistics alone does not enable it. Vizu sends the event, an ad-click reference where available and a random conversion reference. These providers also receive connection information, such as your IP address and browser information. We do not send your username, email, payment details, design content or the address of the page you are viewing in these events. Meta and Reddit receive the address of an empty measurement frame containing an ad-click reference when available.

Our integration is configured not to create first-party advertising cookies on Vizu. It saves your choice in this browser for 30 days and keeps the click reference and signup marker in the current tab for at most 30 days. Browser settings can affect whether these providers receive their own existing cookies. We request X's restricted-data-use setting to limit the events' use for advertising optimization; this does not make the information anonymous or guarantee that X can match every conversion.

Change or withdraw your choice in Cookie settings. Withdrawal stops future measurement through this integration and clears Vizu's saved click reference. It does not automatically delete information the providers have already received. Contact us for help with a request or use X's privacy notice and rights controls. Meta’s privacy notice and rights controls and Reddit’s privacy notice and rights controls are also available. Each provider explains its own use, retention, recipients and international transfers; they may process information in the United States and other countries.

Recipients and locations

Railway Corporation hosts the application and workspace database in Europe. Hetzner Online GmbH stores assets in Europe. Stripe provides payment and subscription services and also processes information for its own regulatory and payment purposes; see Stripe's privacy notice.

OpenRouter, Inc. supplies requested image generation through OpenAI and ByteDance Seed. Your prompt and selected references are sent for that processing. OpenAI image processing takes place in the United States; other providers' processing locations depend on the service used. European hosting does not keep requested image processing within Europe. See OpenRouter privacy, OpenAI API data practices and OpenRouter's Seed provider information for supplier information. Contact us for the recipient and transfer information applicable to your requested feature before submitting personal data. Vizu does not sell workspace content or train its own AI models with it.

OpenRouter also supplies requested AI website analysis and ad composition through its downstream model providers. Their processing locations and privacy conditions depend on the provider used for the feature; European workspace storage does not guarantee European AI processing. Contact us for the recipient and transfer information applicable to your requested feature before submitting personal data.

Overseas provider access and payment processing may also involve international transfers. Contact us for the safeguards applicable to your use, including available contractual documentation. Business personal-data processing requires a completed agreement identifying approved subprocessors and transfer arrangements before content is submitted.

We limit staff access to service, security and support needs. We may disclose necessary information to comply with law or defend legal rights.

Optional usage analytics and masked replay

With your separate permission, we measure public website journeys and workspace usage to find confusing or slow interactions and investigate failures. Records contain route or feature categories, approved action names, timing, outcomes and random session, request and operation references. Public website replay shows the page’s public text, images and styling together with pointer activity, clicks and scrolling. Form values and marked private areas are masked before recording. Workspace replay shows a masked interface structure and excludes customer design content, prompts and images. Full page addresses, account names and raw error messages are excluded. Account, privacy, shared-design and capture surfaces are excluded from replay. We do not use these recordings for advertising or model training.

The data is pseudonymous and may remain linkable to you through support references or activity patterns. Authorized internal analysis tools have read-only access. Events and replay metadata are stored in our Railway database; private replay files use Cloudflare R2 when that storage is configured. Processing and access locations depend on the configured services. Native log files stay on your device; selected approved operation metadata may accompany an opted-in workspace recording.

Usage measurement is off until you allow it and is separate from campaign and advertising choices. Change it through Cookie settings on the website or Usage privacy in a workspace. Withdrawal stops future collection and clears unsent buffers; current-recording removal may remain pending until the service is reachable. Stored usage events and replay expire after seven days under normal cleanup. Contact support about other access or removal requests. Our rights and withdrawal information below applies to this optional processing.

Retention and deletion

Account and workspace content is kept while needed for the service. Removing a design item can leave previous versions in history. Account deletion covers owned workspaces, their history and assets; membership in other people's workspaces is removed without deleting their workspaces. Their content and copies already obtained by collaborators or external agents may remain. Ask us about personal data contained in another person's content.

Saved business profiles, website-analysis results, campaign information, ad-generation job records and generated creatives are retained with the workspace while needed for the service. Account exports include this information for owned workspaces and relevant contribution records for shared workspaces. Owned-workspace deletion removes its ad records; generated assets and design history follow the workspace and asset-deletion process described here.

Image-generation recovery content expires after 30 days without further request activity, including unresolved delivery outcomes. A minimal request receipt can remain to prevent an uncertain request from being generated again. Imported images remain part of your workspace and its history until those references are deleted. Monthly allowance records are kept for the current month and 90 further days. Expired sign-in sessions are cleaned up within 24 hours under normal processing. Our database recovery policy is seven-day rolling retention. Erasures must be reapplied before a restored backup returns to service; backups are used for recovery rather than ordinary account access.

Temporary collaboration state retains selected design identifiers for up to 24 hours, activity signals for up to two minutes, and capture requests and results for up to 60 seconds. Revoked accounts and deleted workspaces cannot retrieve this state; transient copies expire on those schedules. Infrastructure backups or exports have separately configured retention.

Native diagnostic files expire after seven days when the app next runs or writes a log. Diagnostic collection has a seven-day default. Support correspondence is retained while needed to resolve your request and related disputes; we remove unnecessary attachments sooner. Minimal rights-request evidence is retained only as needed to demonstrate the response and prevent an erased account being restored. Required bookkeeping records are normally retained for the relevant financial year and five following financial years. A specific legal claim can justify narrowly scoped longer retention.

Deletion can remain pending while billing reconciliation and physical asset cleanup finish. A completed receipt confirms live account and owned-workspace removal and those dependency steps. Temporary collaboration copies expire as described above; the receipt does not confirm deletion of infrastructure backups, legally retained financial records or separate provider and support copies. We explain lawful retention and remaining provider work when responding to a rights request. Subscription cancellation alone leaves your account and designs in place. Hosted account deletion does not erase copies on your device or in other services.

Feature suggestions are used to plan product improvements. We store the title, details and any email you choose to provide for up to 180 days. Email is optional and used only to follow up about your suggestion. A random submission reference lets your browser check whether a request was received; it is not linked to your account. Contact us to request access or deletion of a suggestion.

Your rights

You can request access, correction, erasure, restriction, portability where applicable, and object to processing based on legitimate interests. You can withdraw consent without affecting earlier lawful processing. Privacy & data in your account offers account export and deletion after you confirm your password or, for an account without a password, confirm a linked sign-in method again. Email [email protected] for other requests or help when you cannot sign in. We verify identity proportionately; do not send passwords, access credentials or identity documents unless we explain why additional information is necessary.

We normally respond within one calendar month. If a lawful extension or limitation applies, we explain it within that month. Requests are normally free. You can complain to Datatilsynet or your competent authority. Vizu does not make solely automated decisions about you with legal or similarly significant effects.

Device storage and changes

Our cookie and device storage notice describes sign-in storage and optional interface choices. We update this notice when practices change and provide appropriate notice of material changes.

When you request immediate paid service, we retain that request and the terms supplied to you. If you withdraw or request annual consumer termination, we record your statement, name, receipt email and submission time, send an acknowledgement through our Mailflare service hosted on Cloudflare, and reconcile cancellation and any applicable refund with Stripe. Your account export includes this evidence. Necessary unresolved financial work and active-contract evidence are retained for their purpose; resolved statements and inactive completed or abandoned checkout evidence are removed after five calendar years. Account erasure detaches necessary retained financial evidence rather than losing a pending refund. Provider and mail copies have separate retention and rights handling.