Legal
Privacy Policy
Effective 3 November 2026
This policy explains what personal data Visuara (“Visuara”, “we”) collects when you use our website and service, why we collect it, who handles it, and the choices you have.
The short version
- We collect what we need to sign you in and run the service, and nothing for advertising.
- We do not sell your data, show ads, or use your footage or product images to train AI models.
- Your media is kept in private storage and is reached only through short-lived links after an access check.
- You can ask us for a copy of your data, or ask us to correct or delete it, at any time.
This summary is for convenience. The full text below is what applies.
01Who is responsible
Visuara is the controller of account and usage data. Contact us at the contact address shown in your account emails.
For the videos and images a workspace uploads, the customer decides what is uploaded and why, and we process that content on the customer’s instructions. If you appear in a video processed through Visuara and have a question, please contact the organisation that uploaded it. You can also write to us and we will help you reach them.
02What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, and a Google account identifier if you use Google sign-in. We do not use passwords. | You, or Google at your request |
| Workspace | Workspace name, members, roles, plan and invitations, including the email address of each person invited. | You and your colleagues |
| Your content | Videos, product images and 3D models, plus what the service creates from them: keyframes, tracking data, previews, decisions and renders. | You |
| Activity | An audit log of actions such as approvals and downloads, and how much of your plan you have used. | Your use of the service |
| Technical | IP address, used for sign-in protection and rate limits, and request logs with the path, status and timing. Request logs leave out email addresses, tokens and query strings. | Your browser or device |
03Google sign-in
If you choose Google sign-in, Google shares your name, email address and account identifier with us, using the openid, email and profile scopes. We use them only to create and secure your account. We cannot see your Google password, and we do not access your Gmail, Drive, Contacts, Calendar or YouTube data.
Visuara’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, use it for advertising, or use it to train AI models.
04How we use data and our legal bases
| Purpose | Legal basis, where one is required |
|---|---|
| Sign you in and provide the service you asked for, including analysing and rendering your videos | Performance of our contract with you |
| Send sign-in, invitation and essential account emails | Performance of our contract with you |
| Protect the service: rate limits, abuse prevention and audit records | Our legitimate interest in keeping the service and its customers secure |
| Operate and improve reliability using technical logs and usage counts | Our legitimate interest in running a dependable service |
| Comply with the law and respond to lawful requests | Legal obligation |
What we do not do. We do not sell or “share” personal data as California law defines those terms, and we do not show advertising. We do not use your footage or product images to train AI models. Visuara tracks surfaces in a video, and it does not use facial recognition or try to identify the people who appear in it. Automated results are recommendations and do not produce legal or similarly significant decisions about people.
06Who handles your data
We use these service providers, who process data for us under their own data-protection terms and security programmes:
| Provider | What it does |
|---|---|
| Vercel | Hosts the website and API, runs video processing, and stores media privately |
| Neon | Hosts the database |
| Our email provider | Delivers sign-in and invitation emails |
| Provides sign-in, if you choose it |
Members of your workspace can see its content, according to their role. Apart from that, we disclose data only when the law requires it, to protect people or the service from harm, or to a successor in a merger or sale, in which case this policy continues to apply until you are told otherwise.
07International transfers
Our providers process data in the United States and may process it in other countries, so your data may be handled outside the country where you live. Where the law requires safeguards for those transfers, we rely on measures such as the standard contractual clauses in our providers’ data-protection terms.
08How long we keep data
| Data | How long |
|---|---|
| Your content and audit records | For the life of the workspace, or until you ask us to delete them |
| Sign-in links and codes | Valid for 10 minutes and usable once, then deleted automatically, normally within about a day |
| Sessions | Valid for up to 7 days, then deleted automatically |
| Abandoned uploads | Deleted automatically after the upload window closes, normally within about a day |
| IP addresses used for rate limits | Normally up to about a day |
| Request logs | A short period set by our hosting provider |
| A removed member | Their email address is replaced at once and their sessions are deleted. A record of the change stays in the audit log. |
When you ask us to delete a workspace, we remove it from our active systems within 30 days. Copies in our providers’ backups expire on those providers’ schedules.
09Security
We use technical and organisational measures designed to protect your data, including:
- encryption in transit (HTTPS) and HTTP-only, secure session cookies;
- private media storage, reached only after an access check and through links that expire in minutes;
- sign-in codes and session tokens stored only in hashed form;
- isolation between workspaces, and role checks on every request.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires. Please report suspected security problems to the contact address shown in your account emails.
10Your rights
Depending on where you live, including the EEA, the UK, California and India, you may have the right to:
- access your personal data and receive a copy in a portable format;
- correct inaccurate data, or have your data deleted;
- object to or restrict certain processing, and withdraw consent where we rely on it;
- appoint someone to act for you where the law allows, and not be treated worse for using your rights;
- complain to your data protection authority.
To use these rights, write to the contact address shown in your account emails from your account email address. We may need to confirm it is you, and we aim to respond within 30 days. If your data is part of a customer’s workspace, we may refer your request to that customer.
11Children
Visuara is a business tool, is not directed at children, and requires users to be at least 18, as set out in the Terms of Service. We do not knowingly collect account data from anyone under 16. If you believe a child has created an account, contact us and we will delete it.
12Changes to this policy
We may update this policy as the service changes. For a material change, we will update the effective date and email workspace owners before it takes effect.
13Contact
Questions or requests about privacy: the contact address shown in your account emails.