AI Visibility Service Privacy Policy
Effective date: 2026-09-12 · v0.1 - 2026-09
Draft - legal review pending before publication
The English version of this document is the legally binding version. Translations are provided for information purposes only - in case of discrepancy, the English version prevails.
This policy applies to the AI visibility service at entexia.com/ai-vidnost. The general privacy policy applies to the rest of the platform.
1. Controller and contact
The data controller is Iteca, Tomaž Ornik s.p., Slovenia. Privacy questions and data subject requests are received at privacy@entexia.com.
You may lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si).
2. Which data is processed
The IP address is never stored raw. Only its SHA-256 hash with an application secret is stored, and the address cannot be read back from it.
| Data | Source | Why |
|---|---|---|
| E-mail address | Entered in the form | Sending the confirmation link and the link to the report |
| Domain | Entered in the form | Subject of the analysis |
| Industry (optional) | Entered in the form | Building the query set |
| Hash of the IP address | Browser request | Limits on the number of free analyses |
| Timestamp of both consents | Form submission | Evidence of when each consent was given |
| Campaign tags utm_source, utm_medium and utm_campaign | Address of the page you arrive from | Identifying which traffic source led to the analysis |
| Analysis results | Measurement of the publicly reachable site and of model answers | Content of the report |
| Name, company and tax number | Entered when buying a paid analysis | Issuing the invoice |
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Running the free analysis and delivering the report | Steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) | 12 months from creation of the analysis |
| Running the paid analysis, portal access and support | Contract (Art. 6(1)(b) GDPR) | 12 months from the customer's last activity |
| Issuing and keeping the invoice | Legal obligation (Art. 6(1)(c) GDPR) | Period set by tax law |
| Product news by e-mail | Consent (Art. 6(1)(a) GDPR) | Until withdrawn |
| Preventing abuse of the free analysis | Legitimate interest (Art. 6(1)(f) GDPR) | Same as the analysis it relates to |
4. There are two consents and they are separate
Consent to process the data you enter is mandatory. Without it the analysis cannot run, because without an e-mail address there is nowhere to send the report.
Consent to receive product news is optional and does not affect the analysis. You may withdraw it at any time, through the unsubscribe link in every such message or by writing to privacy@entexia.com.
Both consents are stored with a timestamp so that it can later be established when each one was given.
5. Retention and anonymisation
A free analysis is kept for 12 months from creation. A paid analysis is kept for 12 months from the customer's last activity.
After that period the record is anonymised, not deleted. Anonymisation clears the e-mail address, the IP hash and the signed link token. The report then stops being reachable, including for anyone who saved the link.
For a customer record the e-mail address is replaced with a non-deliverable address, and name, company and tax number are cleared.
Measurement results remain. They describe a publicly reachable domain and, after anonymisation, are no longer linked to an individual.
6. Access to the report
The report is reachable through a signed link. The token in the link has 64 characters and comes from a cryptographically secure source; there are no sequential identifiers in the address, and the token is compared in constant time.
The link is valid for 12 months. The report page carries the header X-Robots-Tag: noindex, so it does not enter search engines.
Anyone holding the link can open the report. Do not publish the link.
7. Who receives the data
Model providers receive the queries and the content of the publicly reachable page being analysed. Your e-mail address is not sent to them.
The transfer instruments for third countries are part of the legal review of this draft and are deliberately not stated in this version; stating them without a verified source would be misleading.
| Recipient | Role | Location |
|---|---|---|
| Anthropic PBC | Claude model answers in the measurement | USA |
| OpenAI, L.L.C. | GPT model answers in the measurement | USA |
| Gemini model answers in the measurement | USA | |
| Hetzner Online GmbH | Server hosting | Germany |
| Stripe Inc. | Payment for the paid analysis | USA |
| Postmark (Wildbit) | Sending e-mail | USA |
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Send your request to privacy@entexia.com.
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
9. Cookies used by the service
The remaining cookies of the website are described in the general privacy policy.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| vidnost_seja | Customer portal sign-in | 12 hours | Strictly necessary |
10. Changes to this policy
When this policy changes, the effective date and the version label at the top of the document are updated.