Privacy notice
Last updated
This notice explains what personal information Firms on Record collects, why, how long we keep it and what you can ask us to do with it. We do not sell personal information, we do not share it for advertising, and the site uses no tracking or advertising cookies.
Visitors
- No tracking. Browsing the directory, the guides and the free tools sets no cookies. There are no analytics, advertising or social-media trackers.
- Server logs. Our hosting provider (Vercel) keeps short-lived technical logs of requests, such as IP address, time and page, to run and protect the service.
- Free tools and forms. What you type into a tool (for example, a website address) is used to produce the result. To stop abuse we count requests per IP address with our rate-limit provider (Upstash); forms also run a Cloudflare Turnstile check in your browser.
- Videos. A video on a profile loads from YouTube (privacy-enhanced mode) or Vimeo only when you press play. From then on, that platform’s own privacy policy applies.
Businesses in the directory
Listings start from public licensing records (see data sources): business name, address, phone, license details and, for law firms, the number of attorneys registered at the firm. Anyone can ask for a correction or removal through remove or correct a listing.
Firm accounts
- Account email. Used to sign in and to send transactional emails (sign-in codes, claim decisions, billing notices). We send no marketing email.
- Sign-in codes. Stored only as a keyed hash, valid for 15 minutes and once.
- Claim evidence. Your name, role, work email, the firm’s website, the license or registration number you give, the responsible attorney and office address (law firms), the results of our automatic website check, and notes from a confirmation call.
- Attestation. Your name, the time, the statement you accepted and a hash of your IP address. We store a keyed hash, not the address itself.
- Profile content. What you add to your profile, including images. Images are converted on our server and their metadata, such as camera details and location, is removed before they are stored.
- Billing. Kelviq, our merchant of record, collects payment details and billing address. We receive the plan, its status and dates, a customer reference and the events Kelviq sends us. We never receive full card numbers.
Cookies
We set only session cookies needed for sign-in: fo_account keeps a firm account signed in for up to 14 days, and fo_admin does the same for site administrators. Both are httpOnly and signed. If we ever add another kind of cookie, we will update this notice first.
Who processes data for us
Vercel (hosting), Supabase (database, hosted by AWS in Ireland), Cloudflare (Turnstile checks and image storage), Upstash (rate limiting), Resend (email delivery), Kelviq (payments), Sentry (error reports) and VisibAI (AI visibility measurements of claimed profiles: business name, website and location only). They process data only to provide their service to us.
How long we keep it
- Sign-in codes: deleted within a day after they expire.
- Account and profile content: while the account exists, and up to 30 days after a deletion request is completed.
- Claim evidence and attestations: while the profile is claimed and for 3 years after, as our record of who is responsible for the profile.
- Billing records and payment events: 7 years, for accounting and tax.
- Form submissions (corrections, removals, new listings, advertising inquiries): 2 years.
Your choices and requests
You can ask us for a copy of your information, to correct it or to delete it by emailing francesco@getvisibai.com from the address on your account. We confirm requests by email before acting and answer within 45 days. Deleting an account removes your sign-in and your link to any profile; the public listing itself stays unless you also ask for its removal. Records we must keep (attestations, billing) are kept for the periods above.
California privacy rights
If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect and how we use it, to get a copy of it, to have it corrected or deleted, and not to be treated differently for using these rights. You may use an authorized agent. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you, so there is nothing to opt out of. In the last 12 months we collected: identifiers (email address, a keyed hash of an IP address), professional information (name, role, firm), commercial information (plans bought) and internet activity limited to server logs. We use them only for the purposes described above.
Children
The site is for businesses and adults. It is not directed to children under 13, and we do not knowingly collect their information.
Changes
We will update this notice when our practices change and show the date it was last updated. Firms with an account will be emailed about significant changes.
Contact
Firms on Record is operated by [Operator legal name and address]. Questions about this page: francesco@getvisibai.com.