Privacy Policy

Visxy Last Updated: July 3, 2026

1. Introduction

This Privacy Policy explains how Visxy ("we", "us", "our") collects, uses, and protects your information when you use our website and mobile applications (the "Service").

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and/or username and authentication data via our authentication provider (Supabase Auth), including information from Google or Apple if you sign in using those services.

2.2 Usage Data

We collect data about how you interact with the Service, such as prompts viewed, copied, and favorited, and pages visited, via Google Analytics.

2.3 Subscription & Payment Information

If you subscribe to a premium plan:

Web: Payment is processed by Paddle (acting as our Merchant of Record). We receive limited billing information (e.g., subscription status) but do not store your full card details.
iOS / Android: Payment is processed by Apple or Google. We receive subscription status information from these platforms but do not have access to your payment details.

2.4 License & Copy Records

If you hold or have held a Premium subscription, we generate and store license and usage records associated with your account:

License codes: for each active Premium period, we generate a unique license code (VISXY-XXXX-XXXX-XXXX) and store it, along with the plan, start and end dates, and status, as part of your subscription history. These records are retained permanently as part of your account (subject to account deletion — see Section 7).
Copy records: prompts you copy while a Premium period is active are recorded under that period's license code, so you can review the prompts you used during that period. Copies made outside an active Premium period are recorded without a license association.

License codes may be verified through our public verification page (visxy.com/license), which exposes only the plan, period, and status of a code — never the identity of the account holder or any personal information. See our Terms of Service, Section 6.3, for how these records relate to your usage rights.

2.5 Meta Platform Data (Instagram & Facebook)

Visxy operates a comment-triggered marketing automation feature on its own Instagram Business account and Facebook Page, using the Meta Graph API. In connection with this feature, the following data is processed:

Comment content and commenter identifiers: When a comment on a tracked post matches a trigger keyword, the comment text and the commenter's Meta user identifier are ingested and stored to classify the comment and enforce deduplication rules.
DM delivery logs: A minimal log entry (commenter identifier, timestamp, and associated post/comment reference) is stored upon each successfully sent DM, solely to enforce the 1 DM per user per 24-hour deduplication rule and applicable rate limits.

We do not collect or store Meta user profile information (name, profile photo, follower data, or other profile fields) beyond the opaque user identifier needed for deduplication. This data is not linked to any Visxy account and is not used for advertising profiling or shared with any third parties.

2.6 Device & Technical Data

We may automatically collect device information, IP address, browser type, and operating system for security and analytics purposes. Additionally:

Cloudflare processes network traffic (including IP addresses and HTTP request metadata) as part of our CDN, DDoS protection, and security infrastructure. This processing occurs at the network level before requests reach our servers.
Google reCAPTCHA may collect behavioral signals, IP address, and browser/device information to distinguish human users from bots. This data is processed by Google under their own privacy policy.

3. How We Use Your Information

We use the information we collect to:

Provide and maintain the Service (account management, favorites, history);
Process subscription payments and manage premium access;
Generate license codes, maintain license and copy records for your Premium periods, and enable public verification of license codes (see Section 2.4);
Display advertisements to Guest and Free Account users (Premium subscribers do not see ads);
Analyze usage trends to improve the Service (via Google Analytics);
Communicate with you (e.g., account verification, security notices, support);
Detect and prevent fraud or abuse;
Operate our comment-triggered marketing automation on Instagram and Facebook, including sending automated DMs and public replies to users who comment trigger keywords on tracked posts, deduplicating messages, and enforcing rate limits (see Section 2.5).

4. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

Essential cookies: required for authentication and core functionality (e.g., keeping you logged in).
Analytics cookies: Google Analytics, used to understand usage patterns and improve the Service.
Security cookies: Google reCAPTCHA uses cookies and behavioral signals to detect and prevent automated abuse. These are active on forms and interactive elements where bot protection is applied.
Advertising cookies: used to display and measure advertisements to Guest and Free Account users. Premium subscribers do not see ads and are not served advertising cookies. We will update this Policy with the specific advertising providers we use once finalized, and you will be able to manage ad personalization through that provider's settings or industry opt-out tools (such as the Digital Advertising Alliance's opt-out page).

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service. Where required by applicable law, we will request your consent before setting non-essential cookies, and you may withdraw that consent at any time.

5. Third-Party Services

We share data with the following third-party service providers, each governed by their own privacy policies:

Supabase: database, authentication, and storage infrastructure.
Paddle: payment processing and merchant of record services for web subscriptions.
Apple / Google: sign-in authentication and mobile subscription billing.
Google Analytics: usage analytics.
Sentry (Functional Software, Inc., sentry.io): error monitoring and crash reporting. When an application error occurs, technical information such as the error message, stack trace, browser/device information, page URL, and approximate timestamp may be sent to Sentry. We configure Sentry to scrub personal data (including email addresses, user-generated content, cookies, and IP addresses) before transmission, in line with the principle of data minimization. This processing is carried out on the basis of our legitimate interest in maintaining the security and proper functioning of the Service.
Cloudflare, Inc.: content delivery network (CDN), DDoS protection, and security services. Cloudflare processes network-level data including IP addresses and HTTP request metadata in transit. Cloudflare does not have access to the content of your account or stored personal data beyond what is necessary for routing and security purposes.
Brevo (formerly Sendinblue, SAS): transactional email delivery (e.g., account verification, password reset, email address change confirmations). We share your email address with Brevo solely for the purpose of delivering these service-critical communications.
Google reCAPTCHA: bot detection and abuse prevention. reCAPTCHA may collect behavioral signals, IP address, and browser/device information to assess whether interactions are made by a human user. This data is transmitted to Google and is governed by Google's Privacy Policy and Terms of Service.
Meta Platforms, Inc. (Instagram, Facebook): Visxy uses the Meta Graph API to operate a comment-triggered marketing automation feature on its own Instagram Business account and Facebook Page. Comment content and commenter identifiers ingested via the Meta API are used solely to classify comments, send automated DMs, post public replies, and enforce deduplication and rate limits. This data is not shared with any other third parties, is not used for advertising profiling, and is not linked to Visxy user accounts. We operate this integration in accordance with Meta's Platform Terms and Developer Policies.
Advertising Networks: used to display ads to Guest and Free Account users. Specific providers will be listed here once finalized.

We do not sell your personal information to third parties.

6. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymize your personal data, except where retention is required for legal, accounting, or fraud-prevention purposes (e.g., transaction records).

License and copy records (Section 2.4) are retained as part of your subscription history for the life of your account, including after individual Premium periods end, so that your record of commercial usage rights remains available to you. These records are removed when you delete your account (see Section 7), subject to the legal and accounting retention exceptions above.

Data collected via the Meta Graph API (comment identifiers, commenter identifiers, and DM delivery logs) is retained only for as long as necessary to operate the automation feature — specifically, to enforce deduplication and rate limits. This data is not retained beyond its operational purpose and is not archived or used for any secondary purpose.

7. Account Deletion & Email Changes

You may delete your account at any time from your account settings; this permanently removes your profile, favorites, history, and license and copy records.
You may change your account email address at any time. For your security, this requires confirmation via links sent to both your old and new email addresses.

8. Your Rights

Depending on your location, you may have rights under applicable data protection laws (such as the GDPR or CCPA), including the right to:

Access the personal data we hold about you;
Request correction or deletion of your data;
Object to or restrict certain processing;
Request a copy of your data in a portable format;
Withdraw consent where processing is based on consent.

To exercise these rights, contact us at support@visxy.com. You may also delete your account directly via your account settings.

Where processing is carried out by third-party providers on our behalf (such as Sentry for error monitoring), those providers operate under Data Processing Agreements and support data subject rights requests. Requests received by us will be forwarded to the relevant provider where applicable.

If our advertising partners are considered to involve a "sale" or "share" of personal information under laws such as the CCPA, we will provide a way to opt out (e.g., a "Do Not Sell or Share My Personal Information" mechanism) once those partners are finalized.

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. Data Security

We implement reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. International Data Transfers

Your information may be processed and stored in countries other than your own. Our key third-party providers operate as follows:

Supabase, Paddle, Google (Analytics, sign-in), Apple: data may be processed in the United States or other countries where these providers maintain infrastructure.
Meta Platforms, Inc.: comment and DM log data processed via the Meta Graph API may be stored on Meta's infrastructure, which operates globally including in the United States. Meta's data transfer practices are governed by Meta's own Data Policy and applicable transfer mechanisms.
Sentry: error monitoring data is stored on Google Cloud infrastructure, currently in the United States. Sentry offers an EU data residency option; if we migrate to EU residency in the future, this Policy will be updated accordingly.

Where personal data is transferred from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with data transfer restrictions, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or the provider's certification under applicable data transfer frameworks. Sentry is GDPR and CCPA compliant and maintains a Data Processing Agreement (DPA) that covers such transfers.

By using the Service, you acknowledge that your data may be transferred to and processed in the United States or other countries, which may have different data protection laws than your jurisdiction.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

13. Contact

For privacy-related questions or requests, contact us at: support@visxy.com