Legal Privacy policy.
What we collect, why we collect it, and how you stay in control.
The short version
- We collect what we need to run your account, take payment and prepare your reports. We do not sell personal information or provide it to others, apart from the service providers in section 7.
- We may use de-identified data from generated reports to improve our service. It does not identify you.
- We use a small number of service providers, several of them in the United States. Section 7 names them.
- We use an AI provider to help prepare reports. It does not receive your name, email address or phone number.
- You can ask to see, correct or delete your information, and we explain how in section 11. This policy covers visitors and customers in Australia, the United Kingdom, the European Economic Area, the United States and Asia.
This summary is for convenience. The full policy below applies.
01Who we are and what this policy covers
Vyzpro, of PO BOX 604, Mount Waverley, Victoria, 3149, Australia ("Vyzpro", "we", "us") is responsible for the personal information described here. This policy covers people who visit vyzpro.com, create an account, buy a service, or contact us. Our terms and conditions explain how our services work.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not the Act strictly applies to us. Where the data protection law of another place applies to you, such as the UK GDPR, the EU GDPR, Singapore's Personal Data Protection Act or a US state privacy law, we also follow it as it applies to us. Sections 11 and 14 set out the rights that come with those laws.
Our services are for businesses. We use "personal information" and "personal data" for information about an identifiable individual, such as the owner or employee of a business.
02What we collect
Account details. When you create an account, we collect your name, email address, the country your business is based in, an optional phone number, and a scrambled (hashed) copy of your password; we never store the password itself. We also record when you accepted our terms, whether you asked for marketing emails, and when you sign in.
Orders and sites. When you add a site for review, we collect its address, the market you serve and the addresses of any competitors you name. If you leave competitors blank, we choose them from public search results and record them with your site so later monthly reports use the same ones. We keep records of your orders and of the reports we deliver to you.
Payments. If you pay online, our payment provider collects your payment details. We do not see or store your full card number. We keep a customer reference from the payment provider and records of your payments.
Contact and support. When you contact us, we collect your name, email address and message, a one-way code made from your internet address and the date to help us spot spam, and a log of the emails we send you (the address and the type of email, not its contents).
Security and device information. To protect accounts we keep short-lived counters of sign-in and sign-up attempts, keyed to a one-way code made from your internet address or email. We do not store your internet address itself in those counters. Our servers may log technical information such as pages requested and browser type.
We collect this information from you, from your use of the Site, and from our payment provider. We do not knowingly collect sensitive information such as health or financial account details, and you should not include it in messages to us.
03Information in your report
To prepare a report we review publicly available information about your website and your competitors, and the search and AI results for relevant questions. This is business information. If it includes personal information, such as a named staff member or a business contact detail published on a website, we use it only to prepare the report.
04Why we use your information
We use your information to:
- run your account, confirm your email address and keep your account secure;
- prepare and deliver your review and any Monitor reports;
- contact you about your request, your order and your reports;
- manage payments, invoices, tax and our records;
- protect the Site against spam, fraud and misuse, and improve it;
- use de-identified data from the reports we generate to improve our service, as described below; and
- send you marketing, if you agree.
If the UK GDPR or the EU GDPR applies to you, our legal bases are these. To make and carry out our contract with you, we handle your account, order and report information. For our legitimate interests in running, securing and improving the Site and answering enquiries, we handle contact, security and technical information, and we balance those interests against your rights. To meet legal duties, such as tax and accounting records, we keep order and payment records. Where you give consent, for marketing emails and for marketing cookies, we rely on that consent, and you can withdraw it at any time.
De-identified report data. We may use data from the reports we generate, with your name, email address, phone number and other account details removed, to improve our methods, checks and services. We do not use it to identify you, we do not sell it, and we do not give it to anyone else.
06How we use AI and automated tools
We use automated tools, including an artificial intelligence service, to research and write reports, and our team reviews each report before it is released. We do not use these tools to make decisions about you that have legal or similarly significant effects.
Our AI provider receives the website addresses you give us, the market you serve, public information gathered about your site and your competitors (which can include business contact details and staff names that those sites publish), and, for Monitor, content from your earlier reports with your name removed. It does not receive your name, email address or phone number. Under the commercial terms we have with the provider, it may not use this content to train its models.
Reports and code snippets are created with the help of AI, as our terms and conditions explain. We do not use AI transcription or notetaking tools on calls or meetings with you. If that changes, we will tell you first and update this policy.
08Overseas disclosure and international transfers
We are based in Australia. Our service providers in section 7 store or process information in the United States and other countries where they operate. Before we disclose personal information overseas, we take reasonable steps to make sure the recipient protects it in a way that is consistent with the Australian Privacy Principles, usually by contract.
If you are in the UK or the European Economic Area, your information is transferred to Australia and to those countries. Where the law requires a transfer safeguard, we rely on one, such as the standard contractual clauses approved for that purpose, and we can give you a copy on request. If you are in Singapore or another place with transfer rules, we take steps to make sure the recipient gives your information a comparable standard of protection.
09Storage, security and breaches
Your account details are stored in our database and your reports in a protected location that is not reachable from the web. Reports download only after you sign in, the site uses secure connections, and we limit who can access personal information. No system is perfectly secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.
If a data breach is likely to cause you serious harm, or the law otherwise requires it, we will tell you and the relevant regulator as the law requires and as soon as we reasonably can.
10How long we keep it
We keep personal information only while we need it. In general: account and order records stay while your account is open and for up to seven years afterwards for tax, accounting and legal purposes; when an account is deleted, its details are removed from our database, and the reports we generated stay in a protected location, separate from your account details, where we use them only in de-identified form as described in section 4, and we delete them if you ask; contact enquiries are kept for up to 24 months; email delivery logs are kept for up to 12 months; and security counters are kept for short periods. After that we delete or de-identify the information.
11Your rights
You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. Contact us through our contact page. We will respond within 30 days, or sooner where the law says so. We may need to confirm your identity first, and we may decline a request where the law allows or requires us to.
Depending on where you live, you may also have these rights:
- UK and EEA: to receive a copy of your data in a portable form, to restrict or object to our handling of it, to withdraw consent at any time, and to complain to your data protection authority, such as the Information Commissioner's Office in the UK.
- United States: depending on your state, to know what we collect, and to have it corrected or deleted. We do not sell personal information. If you accept marketing cookies, Google's tools can collect information that some state laws treat as "sharing" for advertising; you can stop this at any time in Cookie settings. We do not treat you differently for using these rights.
- Singapore, Hong Kong and other parts of Asia: to withdraw consent for uses that need it, and to ask for access to and correction of your personal data.
12Marketing
We send marketing emails only if you agree, and every marketing email lets you unsubscribe. You can also withdraw consent by contacting us through our contact page. We keep sending the service messages you need, such as order and password emails.
13Children
Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you think we have, contact us and we will delete it.
14Notes for specific places
United Kingdom and European Economic Area. Vyzpro is the controller of your personal data. You can contact us through our contact page about your rights, and you may also complain to your local data protection authority.
United States. This section is our notice at collection under US state privacy laws. The categories of personal information we collect are in section 2, and the purposes are in section 4. We keep them for the periods in section 10.
Singapore and other parts of Asia. By using our services you agree we may collect, use and disclose your personal data as this policy describes, including by sending it outside your country as section 8 describes. Where a law of your country requires a specific notice or consent that this policy does not give, contact us.
15Complaints
If you have a concern about how we handled your information, contact us through our contact page and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, or the data protection authority where you live.
16Changes to this policy
We may update this policy from time to time. The date at the top shows when we last updated it. If we make a significant change, we will tell account holders by email or on the Site.
17Contact
Privacy questions: use our contact page. Post: PO BOX 604, Mount Waverley, Victoria, 3149, Australia.