Privacy policy
How Feedbach AS handles personal data when you use Online Visibility Report.
Who we are
Online Visibility Report is operated by Feedbach AS (org. no. 933393585). We are the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at support@online-visibility-report.eu.
The data we hold about you
When you use the service as a customer, we process:
- Account data — when you sign in we store your email address as a unique identifier.
- Payment data — card payments are handled by Stripe. We never see or store your card number. Stripe collects your billing name, and (optionally) address and VAT ID; we store only a payment reference and whether the report was paid.
- Contact — if you email us, we receive your email address and whatever you include in your message, which we keep only to handle your enquiry.
- Your report inputs — the subject (a business/brand), the need and target regions you enter, and the report we generate for you.
- Technical data — strictly necessary storage in your browser; see the cookie policy.
Why we process it, and our legal basis
- To provide the service — creating your account, generating and delivering reports, and taking payment. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
- To meet legal obligations — keeping accounting and tax records for payments. Legal basis: legal obligation (Art. 6(1)(c)).
- To secure and improve the service, prevent fraud and abuse, and answer your messages. Legal basis: our legitimate interests (Art. 6(1)(f)).
The reports we generate
You ask for a report about a business, brand, product or service. We gather publicly available information from the open web and from the subject's own website, and use AI services to analyse it and write the report.
We only produce reports about organizations — not about private individuals. We block requests whose subject is a natural person at the point of entry.
Reports may still mention individuals connected to a business that appear in public sources — for example a founder or an executive named on a company website. Where that happens we process that public, business-context information on the basis of our legitimate interests (Art. 6(1)(f)) in providing a market-visibility analysis. Because we collect it from public sources and do not hold contact details for those individuals, notifying each one would involve disproportionate effort, so we rely on Art. 14(5)(b) and describe the processing here instead. If you are mentioned in a report and want it corrected or removed, contact us at support@online-visibility-report.eu.
Who we share data with
We use a small number of processors to run the service. Each only processes data on our instructions:
| Service | Purpose | Data shared | Location | Transfer safeguard |
|---|---|---|---|---|
| Google (Google Ireland Ltd / Google LLC) | Generates the report from the subject and prompt (Gemini) and measures the subject website’s performance (PageSpeed Insights). | The subject name, the stated need, target regions and the subject’s website URL(s) — i.e. the prompt and page addresses. | EU and United States | Google Cloud Data Processing Addendum with EU Standard Contractual Clauses. |
| Stripe (Stripe Payments Europe Ltd / Stripe Inc.) | Processes card payments and calculates VAT for report purchases. | Billing name, address, VAT ID and card details (entered directly into Stripe), plus a reference to the report purchased. | Ireland and United States | Stripe Data Processing Agreement with EU Standard Contractual Clauses. |
| Server hosting (Norway (EEA)) | Running the application | User email and report data | Norway (EEA) | Processed within the EEA — no third-country transfer. |
Where data is processed
Our own systems — the database, sign-in service and report storage — run on infrastructure in Norway (EEA), within the EEA. Some of our processors (Google, Stripe) also process data in the United States; those transfers are covered by the EU Standard Contractual Clauses under each provider's data processing agreement.
How long we keep it
- Reports are automatically deleted six months after they are generated.
- Account data is kept for as long as your account is active. You can delete individual reports or your whole account at any time, which removes the associated data from our systems.
- Payment and invoice records are kept for as long as Norwegian bookkeeping law requires (currently five years), even after you delete your account.
Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, and to receive a copy in a portable format. You can exercise most of these yourself in the app, or contact us and we will help.
If you believe we handle your data incorrectly you can complain to Datatilsynet (the Norwegian Data Protection Authority) (https://www.datatilsynet.no). We would appreciate the chance to resolve it first — write to us at support@online-visibility-report.eu.
Changes
We may update this policy as the service evolves. This version was last updated on 2026-06-26.