Privacy Policy

Visionary Vault Consulting is the controller of the information described in this policy. You can reach us about any privacy matter at [email protected].

We collect only what we need to deliver and support your website review.

• Information you give us. Your name, business name, email address, phone number, website address, industry, goals, and the answers you provide in the intake form, including any notes about your business or customers.
• Files you upload. Screenshots, brand assets, analytics exports, or other documents you choose to attach. Please do not upload sensitive personal data, health information, government identifiers, or customer lists — the Service is not designed to hold that kind of material.
• Publicly available website content. With your permission, we retrieve and analyze the publicly accessible pages of the website you submit, including page text, structure, links, and mobile presentation.
• Account and access data. If you are issued a private report link or a staff account, we store the credentials or access token needed to operate that access.
• Technical data. Standard server and security logs, such as IP address, browser type, timestamps, and pages requested, generated automatically when you visit the Service.
• Payment data. Payments are processed by an external payment provider. We receive confirmation of payment status and limited transaction details. We never collect, process, or store your full card number, CVV, or bank credentials.

• To perform your website review and prepare your report, action plan, and rewritten copy.
• To communicate with you about your engagement, including scheduling, questions, and delivery.
• To process payment and maintain accounting and tax records.
• To operate, secure, troubleshoot, and improve the Service.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your business information to market unrelated products to your customers.

Where the EU or UK GDPR applies, we process information to perform our contract with you, to pursue our legitimate interests in operating and securing the Service, to comply with legal obligations, and — where required — on the basis of your consent, which you may withdraw at any time.

Portions of the review are produced with the assistance of automated tools and third-party artificial intelligence services. To generate your report, content from your intake form and from the publicly available pages of your website may be transmitted to those providers for processing. We select providers that do not use submitted content to train their public models where that option is available. Every deliverable is reviewed by a human before it is released to you. No automated decision is made that produces a legal or similarly significant effect on you.

We share information only with providers who help us run the Service, and only as needed to do so:

• Application hosting, database, and file storage providers.
• Our payment processor, for checkout and payment confirmation.
• Email and notification delivery providers.
• Artificial intelligence providers used in analysis and drafting, as described above.

These providers are bound to use the information only to deliver services to us. We may also disclose information when required by law, subpoena, or valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy.

Reports are delivered through private, client-specific links. Each client can access only their own report. Internal audit notes and working materials are never shared between clients. Anyone holding your private link can view your report, so please treat that link as confidential and let us know if you believe it has been shared in error so we can revoke it.

• Intake submissions, uploaded files, and delivered reports are retained for twelve (12) months after delivery.
• After that period we delete or anonymize them, unless you ask us to keep them longer for follow-on work.
• Payment and invoicing records are kept for as long as tax and accounting law requires, typically seven (7) years.
• Security and server logs are retained for a short operational period and then rotated out.

You may ask us to delete your materials earlier; see your rights below.

We use encryption in transit, access controls, unique private links, and restricted administrative access to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any required authority as the law directs.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and request a copy.
• Correct information that is inaccurate or incomplete.
• Request deletion of your information, subject to our legal and record-keeping obligations.
• Object to or restrict certain processing, and request portability of information you provided to us.
• Withdraw consent where processing is based on consent.
• Be free from discrimination for exercising any of these rights.

California residents: we do not sell or share personal information as those terms are defined under the CCPA as amended by the CPRA, and we have not done so in the preceding twelve months. To exercise any right, email [email protected]. We will verify your request and respond within the time the applicable law allows.

We use only the cookies necessary to operate the Service, such as maintaining a signed-in session and protecting forms against cross-site request forgery. We do not use advertising cookies or third-party tracking pixels. Your browser can block cookies, but the staff sign-in area will not function without them.

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided information to us, contact us and we will delete it.

We operate from the United States, and our providers may process information in the United States or other countries. Where information is transferred from the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses.

The Service may link to sites we do not control, including your own website and our payment provider. This policy does not cover their practices, and we encourage you to review their privacy notices.

We may update this policy as the Service evolves or the law changes. The revision date at the top will always reflect the current version, and material changes will be communicated to active clients by email.

Questions, requests, or complaints: [email protected]. We aim to respond within a few business days. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.