Privacy Policy

1. Introduction

Vizuna ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our professional growth and effectiveness platform.

Data controller / responsible entity: The Nudge L.L.C-FZ (doing business as “Vizuna”)
Registered Address: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, password, organization affiliation
Professional Data: Reflections, VizunaAI messages (if enabled), trust scores, development actions, collaboration data
Context Information: Role type, team topology, industry, region (optional)

2.2 Information Collected via Our Website and Web Portal

When you visit the Vizuna marketing website, customer portal, or admin portal, we may collect the following:

Aggregate site analytics (Plausible): On our public marketing site we use Plausible Analytics, a privacy-focused, cookie-free analytics service. Plausible collects aggregate page view counts, referral sources, browser type, and country-level location. It does not use cookies, does not track individuals across sites, and does not collect personal data. See Plausible's data policy.
First-party product analytics (Vizuna behavior telemetry): Across the Vizuna marketing site and customer portal we run a first-party product analytics pipeline that we host ourselves (not a third-party tracker). Internal /admin pages are intentionally excluded from this dataset. It helps us diagnose bugs, improve flows, and prioritise product work. This system:
- Collects: page paths you view, the browser-level descriptor of elements you click (for example, button.cta-primary), approximate click coordinates within the viewport, maximum scroll depth, viewport dimensions, and session duration.
- Uses pseudonymous identifiers: a long-lived visitor_id is generated in your browser and kept in localStorage with a 12-month rotation window, and a session_id is kept in sessionStorage with a 30-minute idle timeout. A legacy anonymous_id remains temporarily during the 90-day transition window. We describe this system as pseudonymous, not fully anonymous, because these identifiers can tie together events from the same browser or session window.
- Does not collect: your name, email, password, reflection text, VizunaAI chat content, IP address, user-agent string, precise geolocation, or any third-party advertising identifier.
- Is not joined to your account: we do not attach your authenticated Vizuna user_id to these events, and we do not use them to build a cross-site advertising profile.
- Stays within Vizuna: events are sent to our own ingest endpoint ( /api/track) and stored in our own Supabase database. They are not shared with advertising, ad-measurement, or data-broker third parties.
- Is retained for up to 90 days on a rolling basis and then automatically deleted.
- Can be disabled: you can opt out by setting the vizuna_tracking_optout key in your browser's localStorage to true, or by contacting support@vizuna.com. When the opt-out flag is present, the tracker does not collect events on that device/browser.
Email capture: If you subscribe to receive insights on our website, we collect your email address. We store this in our intake system for follow-up and send an internal notification. We do not sell or share your email with third parties for marketing purposes.
Tracked outreach links (internal business development operations): When you click a Vizuna outreach link sent by our internal team, we may record the link identifier, destination URL, click timestamp, referring page (if available), browser/user-agent details, a hashed IP-derived identifier, and whether the click appears to be automated scanner/bot traffic. Vizuna does not currently use an outreach attribution cookie or downstream browsing attribution for this cold-email reporting flow.
Interactive survey diagnostic: If you complete an on-page survey (for example, a short operating environment diagnostic), we process your survey responses and any optional context you choose to provide to generate an on-page result. Do not include names, emails, or confidential details. We do not store the free-text you provide in that optional field, and we do not associate your survey responses with an account unless you separately submit your email through another form.

2.2.1 Cookies and similar technologies (summary)

We use a limited set of cookies and comparable browser storage technologies for the Service:

Strictly necessary cookies for authentication, session management, and security of the customer portal and admin portal.
Browser storage (localStorage / sessionStorage) for short-lived UI preferences, sign-in flow state, the first-party product analytics described above ( vizuna_anon_id, vizuna_session_id), and the vizuna_tracking_optout opt-out flag.
No third-party advertising cookies and no cross-site tracking pixels.

See our Cookie Policy for the full list, purpose, and retention of each category.

2.3 Information Automatically Collected (iOS App)

We automatically collect limited technical data needed to operate and secure the Service. This may include:

iOS device type and app version
Basic usage signals (which features you use)
Timezone information (to schedule notifications correctly)
Device token: a device-level identifier issued by Apple, used only to deliver push notifications. Device tokens are stored securely, are never logged in application logs, and are not shared with third parties for advertising or tracking.
Error and diagnostic logs: anonymous technical metadata (for example, error codes, request durations, feature flags) used solely to diagnose and fix technical issues. Diagnostic logs never include reflection text, chat content, emails, or other personal content.

3. How We Use Your Information

We use your information to operate the Service (account access, core features, and notifications), to generate insights and development actions, to keep the platform secure, and to improve Vizuna over time.

VizunaAI: If you enable VizunaAI, we use a third-party AI service provider (OpenAI and/or Anthropic, depending on configuration and availability) to help generate coaching responses, guided reflection prompts, and suggested Actions. We ask your permission in-app before any content is sent for AI processing.

Website diagnostics: If you use an on-page survey diagnostic on our website, we process the information you provide in the moment to generate your result. We do not intentionally request personal identifiers for this purpose.

Internal outreach measurement: We may measure the effectiveness of our internal business development outreach, including whether a cold-email link was clicked.

When enabled, the following categories of information may be shared with OpenAI and/or Anthropic to provide VizunaAI features:

Text you type into VizunaAI
Guided reflection chat messages (if you use a guided option)
Relevant in-app signals needed to answer (for example: scores and Action metadata)
Work context details you choose to share (optional)

We do not send your password.

We do not sell your personal data.

4. Legal Basis for Processing (GDPR/PIPA/PDPL)

Explicit Consent. You have provided explicit consent to data processing (required for signup, and for specific features such as VizunaAI).

Contractual Necessity. Processing is necessary to provide the Service you request.

Legitimate Interests. We process certain data to improve the Service, to support security and fraud prevention, and to operate first-party product analytics. For product analytics, we have a legitimate interest in understanding how people use our own website and product so we can debug, improve, and prioritise work. This processing is limited to pseudonymous events, is not combined with identifying information, is retained for no more than 90 days, and is subject to the opt-out described in Section 2.2.

Where the ePrivacy Directive or equivalent local rules require consent for storing or reading non-essential information on your device (for example, the anonymous_id used for first-party product analytics), you can express or withdraw that preference at any time using the opt-out described in Section 2.2.

Consent Withdrawal: You may withdraw your consent at any time. For AI-specific features (VizunaAI), you can disable VizunaAI in your app settings without deleting your account. To opt out of first-party product analytics, set the vizuna_tracking_optout flag in your browser (see Section 2.2) or contact support@vizuna.com. To withdraw consent for all processing, you may delete your account via in-app settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. Data Retention

5.1 Default retention (Option A — default)

We retain your personal data while your account is active so the Service can provide longitudinal insights and progress tracking. When you request account deletion:

Your account is scheduled for permanent deletion and a 30-day cooling period begins
You will be signed out, and access to your account may be restricted while deletion is pending
After the cooling period ends, we permanently delete your account and associated personal data from our active systems, except where we are legally required to retain certain business records

Data Deletion: You can request account deletion at any time through the app settings. Permanent deletion is not immediate and completes after the 30-day cooling period. For step-by-step instructions, see our Account Deletion page.

5.2 Enterprise-configurable retention (Option C — by contract)

For certain enterprise customers, Vizuna may agree to a different retention schedule for specific categories of customer data. Any such schedule must be explicitly stated in the applicable contract documents (for example, an Order Form and/or executed DPA) and will override this default for that customer to the extent of any conflict.

5.3 Business and legal records

Vizuna may retain certain business records (for example, contracts, invoices, and tax/accounting records) for at least 7 years or longer where required by applicable law, even if a user account is deleted. These records are retained for legal/compliance purposes and are separate from in-product reflection content.

5.4 Outreach tracking records

Recipient-level outreach tracking records are retained for a limited period tied to internal business development, operational analysis, security review, and legal/compliance needs. We review these records periodically and delete or stop using them when they are no longer needed for those purposes.

5.5 First-party product analytics events

Behavior telemetry events collected under Section 2.2 (page views, clicks, scroll depth, session duration, viewport size, and pseudonymous session and anonymous identifiers) are retained for a maximum of 90 days on a rolling basis and are then automatically deleted by a scheduled cleanup job. We do not export these events to third-party analytics or ad-measurement platforms.

6. Cross-Border Data Transfers

Your data may be processed and stored outside your country of residence, including in the United States and European Union. We use cloud infrastructure providers (Supabase) that maintain appropriate security measures and comply with applicable data protection laws.

When transferring data outside your jurisdiction, we ensure appropriate safeguards are in place, including:

Standard contractual clauses (SCCs) where applicable
Compliance with GDPR, PIPA, and PDPL requirements
Encryption in transit and at rest

8. Your Rights

Depending on your location, you may have the following rights:

Right to Access: Request a copy of your personal data (via "Export My Data" in settings)
Right to Rectification: Update your profile information at any time
Right to Erasure: Delete your account and data (via "Delete Account" in settings)
Right to Restrict Processing: Limit how we process your data
Right to Data Portability: Export your data in a machine-readable format
Right to Object: Object to certain types of processing
Right to Withdraw Consent: Withdraw consent at any time (disable VizunaAI via settings, or delete your account for full withdrawal)
Right to Lodge a Complaint: Lodge a complaint with a supervisory authority in your jurisdiction if you believe your data protection rights have been violated

To exercise these rights, contact us at support@vizuna.com or use the in-app features.

9. Security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption in transit (TLS/SSL) and at rest
Secure authentication and access controls
Regular security assessments and updates
Role-based access controls (RBAC)
Anonymization of sensitive data

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date
Notify you via email or in-app notification
Require re-consent for material changes (new consent version)

Your continued use of our services after changes constitutes acceptance of the updated policy, unless re-consent is required by law.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

Email: support@vizuna.com

Data Protection Officer (DPO): We have not appointed a formal Data Protection Officer. Privacy inquiries are handled via support@vizuna.com.

13. Regional Disclosures

13.1 European Economic Area (EEA)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR). When you use Vizuna as an individual (direct signup), we act as a data controller for your personal data. When you use Vizuna through an enterprise customer, your organisation is the data controller and we act as a data processor on their behalf, subject to a Data Processing Addendum. You have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

13.2 South Korea

If you are located in South Korea, this Privacy Policy complies with the Personal Information Protection Act (PIPA). We require explicit consent before processing your personal information, as provided during signup.

13.3 United Arab Emirates

If you are located in the UAE, this Privacy Policy complies with the Personal Data Protection Law (PDPL). We process your data with your explicit consent and in accordance with PDPL requirements.

13.4 California (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act. We do not sell or share (as defined by CCPA/CPRA) your personal information. You have the right to: know what personal information we collect, request deletion of your personal information, correct inaccurate personal information, and not be discriminated against for exercising your rights. To exercise these rights, contact us at support@vizuna.com or use the in-app features.

14. Automated decision-making

Vizuna does not engage in solely automated decision-making that produces legal or similarly significant effects on individuals (for example, automated employment decisions).