Privacy policy – Visibilai: AI Visibility & GEO

Last updated: 6 November 2026

Who we are

Visibilai is a Shopify app run by Snir Tam, Ehud Manor 19, Raanana 4334919, Israel (“we”). For the data in this policy we act on behalf of the merchant who installed the app (the store). Contact: support@visibilai.app. Website: https://visibilai.app.

In short

• We store store data (products, suggested shopper questions, audits, fixes, plan) to run the app for the store that installed it.
• We store no personal data about the store's customers: no names, emails, phone numbers or addresses. For AI-referred orders we keep only the order id, name, time, AI channel, how it was traced (a referrer host or campaign source, and whether the storefront pixel agreed), total and the ids of the products in it.
• Visibilai asks AI assistants test questions about your products (ChatGPT on every plan, Perplexity on Growth and Enterprise, Claude on Enterprise) and writes drafts with OpenAI. What goes out is questions, store and product information, never customer or order data. You see a notice and click to accept it before the first question is sent.
• We do not sell data, show ads, or use store or customer data to train AI models.
• Uninstall the app and the access tokens are deleted at once; everything else we hold for the store is deleted when Shopify asks us to erase it, 48 hours after uninstall.

What we read from Shopify

The app asks Shopify for these permissions:

• Read products: products, collections, prices, images and categories, so we can recognise your products in AI answers and find missing details.
• Write products: only to apply a fix you approved, and to undo it. Nothing is written without your approval.
• Read orders: the last 60 days of orders, to find orders that came from AI assistants. We read the order id, name, time, total, sales channel, referrer or campaign source and the products in it. We never ask Shopify for the customer's name, email, phone or address.
• Store details (name, contact email, domain, currency, country, time zone and plan).
• Product changes: Shopify tells us when a product is changed or deleted (a webhook, signed by Shopify). We read only the product's id from it, mark our copy as out of date and read that product again; a deleted product is removed from our copy.
• Read and write metaobjects and their definitions: only to apply a category attribute fix you approved (Shopify stores values such as "Linen" as standard entries), and to remove entries Visibilai created when you undo it.
• Read and write content: we read your blogs and pages to suggest articles; we create an article only as an unpublished draft after you approve it, publish it only on a date you choose, and change no other article or page.
• Read markets and locales, read and write translations: the countries and languages you sell in, and, only for a translation you approve, a translation of Visibilai's own product fields (which you can undo).
• App proxy: to serve, from your own store address (/apps/visibilai), the store facts files you choose to publish (Store facts for AI tools) and, only if you switch on Bing indexing (IndexNow), its key file. The same content for every visitor.
• Write pixels and read customer events: to add Visibilai's web pixel to your storefront, only when you click "Turn on AI visit counting" (it is off until then, and you can turn it off in Settings). Shopify runs it in a sandbox and loads it only for shoppers who allow analytics where your store asks for consent. When a shopper arrives from an AI assistant (the page they came from, or a tracking link), it sends us the assistant's name, the kind of page they landed on and a random number that identifies that browser session (one visit per browser session; it ends after 30 minutes without activity and is kept in the browser's local storage until then), and once more if that session completes a checkout. If that checkout is an order, the pixel also sends the order's number with the assistant's name, so Visibilai can count that order when Shopify's own order data does not say where the shopper came from; Shopify's data always wins when the two disagree. We add one to a daily total, keep the order number only for that purpose (it is deleted with the order), and keep nothing else: no IP address, no browser details, no cookies, no customer or cart data.

Google (optional)

You can connect your own Google account to see your store's traffic from Google next to your AI traffic. Nothing is read until you click Connect and agree on Google's own screen. Visibilai asks for read-only access to Search Console (and your account's email address, to show which account is connected) and, only if you add it, Merchant Center. We read your property's search clicks, impressions, positions, top searches, top pages and countries, and Merchant Center's free listing and agentic checkout totals. If you also connect Google Analytics (a separate step, read-only), we list your Google Analytics properties so you can pick your store's, then read that property's visits, purchases and purchase revenue per day and traffic source, and the product pages those visits started on. These are totals Google already aggregates: no data about individual searchers, visitors or shoppers. Visibilai never changes anything in your Google accounts. The tokens Google gives us are stored encrypted and used only to read these numbers once a day. Disconnect in Settings or on the Traffic page: we remove our access at Google and delete the tokens and every Google number we copied. Disconnecting Google Analytics alone deletes its numbers and stops reading it; if nothing else uses the same Google connection we also remove our access at Google, and otherwise the Analytics permission stays until you remove Visibilai at myaccount.google.com/permissions. You can also remove Visibilai at myaccount.google.com/permissions. Visibilai's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements; we do not use it for advertising, do not sell it, and do not use it to train AI models.

Bing Webmaster Tools and report uploads (optional)

You can connect your own Bing Webmaster Tools account, read-only, to see your store's clicks, impressions, top searches, top pages and index state in Bing. Nothing is read until you click Connect and agree on Bing's own screen. The only permission Visibilai asks for is Webmaster.read. These are totals Bing already aggregates, with no data about individual searchers. The tokens Bing gives us are stored encrypted and used only to read these numbers once a day. Disconnect on the AI assistants page: we delete the tokens and every Bing number we copied (Bing has no revoke button for us, so you can also remove Visibilai in Bing Webmaster Tools under Settings, API Access).

You can also upload reports you export yourself: Bing's AI Performance export and Merchant Center's AI report. We keep only the aggregate rows, never the file, and you can delete them.

Visibilai does not send questions to Microsoft's or Google's assistants (their terms do not allow it).

What we store

• Your store's myshopify.com domain and the access token Shopify gives the app (with its refresh token, expiry and the permissions granted). We use offline tokens only, so no staff names or emails are stored.
• Your plan and subscription status as Shopify reports them (plan, status, subscription id, billing interval, trial end), whether your store is a Shopify development store, when you saw the welcome page, when you first installed Visibilai, and the date and time you clicked "I understand" on the notice about prompt tracking (until then no assistant is asked).
• Per calendar month: how many AI writing calls and product rewrites your store used, how many AI writing calls were given back because they failed, and what asking the AI assistants cost us for your store (a dollar amount, which your plan caps, and how many answers came back). Counts and amounts only, no content.
• When we asked Shopify to show its own review prompt (at most three times), which action you had just completed (for example a fix applied), and Shopify's answer (shown, not shown and why, or that you already left a review). Never what you wrote in a review.
• What you send with the Feedback button or the form on the Support page: its type, your message, the app page you were on, whether we may email you about it, and its status. For support messages also whether your plan had Priority support when you wrote, and when we replied.
• Background tasks for your store (for example "read the catalog" or "run the GEO audit"): the kind, a small input such as a question or product id, status, attempts, the last error and times.
• Your store's contact email and store name as Shopify provides them (or an address you entered in Settings), your email choices and a random unsubscribe token.
• One row per email we sent or tried to send you: its kind, subject, status and time. Unsubscribe and resubscribe records are kept as proof of your choice.
• Our own product statistics, never shown to anyone outside Visibilai: for your store, the date of a few milestones (installing, your first readiness audit, your first approved and applied change, a weekly mark that you opened the app, starting, converting or cancelling a trial) and the plan name. No personal data.
• Store facts used to recognise your store in AI answers: store name, primary domain and URL, myshopify.com domain, currency, country, Shopify plan name, whether it is a development or Plus store, and how many products we read.
• Your products as we last read them: id, title, handle, vendor, product type, public URL, barcode (GTIN), lowest price and currency, featured image URL, product category, status, whether it is published to the Online Store, update times, and a mark that Shopify told us the product changed and it is waiting to be read again.
• Your prompt panel: the test questions a shopper might ask an AI assistant about your products, which Visibilai asks the assistants of your plan each week (see "What we send to AI providers"). For each: the text, its wordings (up to three; one for prompts you write), category, country, language, the kind of need it covers (for example category, price, comparison or your store's own name, which is kept apart as a control), where the idea came from (your catalog, your orders' product types, your Search Console searches, a template or you), whether we suggested it or you wrote it, and whether it is active.
• Each prompt-tracking scan: why it ran (first checks after install, the week, or an extra check you asked for), its status, which AI assistants were asked, how many answers were planned, answered and failed, what it cost us, the week and times.
• Each AI assistant answer to one of your prompts, as a sample: the prompt and wording, its kind of need, the assistant and model, the country, how many web searches it ran, the answer text, the links and sources it cited, the provider's raw response (so answers can be read again when our reader improves; cleared after 90 days), cost and times. Answers are shown only to your store; Perplexity's answer text is shown only inside the app.
• Brands and products an answer recommended or named as options: the name, whether it is yours or a competitor's, your product id when it is yours, its link, its position and whether your site was cited.
• Brands that appeared in AI answers next to yours, detected by Visibilai or added by you: name, domain, how it was added, whether you track it, and when we first saw it.
• Weekly totals for the charts of answers and how often your store was named, per store, product, prompt, competitor and assistant. Counts only.
• Suggested changes to your products and their evidence: product id, type, status, the proposed value, the value before it was applied (for undo), the last error and times.
• Orders that came from an AI assistant: the order id and order number, when it was placed, the AI channel, how we know (a referrer host or utm_source, never a full URL, and which methods agreed), the order total and currency, and the ids of the products in the order. No customer name, email, phone or address.
• Only if you turned on AI visit counting: for an order completed in a browser session that began at an AI assistant (and where the shopper allows analytics), the order id, which assistant, whether it was recognised from the page they came from or from a tracking link, the kind of page they landed on (never a query string) and the time. It is used only to count that order when Shopify's own order data does not say where the shopper came from, and it is deleted with the order. No name, email, address, IP address, device details or cookie.
• Orders that came from a site that only looks like an AI assistant we do not recognise yet (for example a chat. or .ai address, or a tracking link marked as AI): the order id and number, when it was placed, the site's address (never a full link), the total and currency. Kept apart and never counted as AI orders. No customer data.
• The sales channel names Shopify reports on your orders (for example "Online Store"), how many orders carried each in the last check and when we first and last saw them. This is how we learn new AI channels.
• Whether visit counting is on for your store, the id of the pixel Shopify created for it, a random key the pixel sends with every event, the address events go to, when it was switched on, the last problem switching it on, and when the last event arrived.
• Daily totals of visits that arrived from an AI assistant: the day, the assistant, the kind of page the visit landed on (for example a product handle, never a query string) and how many visits and completed checkouts. No IP addresses, no user agents, no visitor ids.
• Daily totals of all your orders (count and revenue per currency, test and cancelled orders left out), so we can show which share came from AI assistants.
• Your numbers from before you installed Visibilai: AI orders and revenue, and all orders and revenue, over the days before your install date that Shopify still let us read (up to 60), with that window.
• Your store's AI readiness audits: the date, the score, the results of each store check (for example whether AI crawlers can reach your pages) and the suggested top actions.
• Your store's SEO audits (switched off by default; kept for when they are switched on): the date, the SEO score, the result of each check (for example whether your pages can be indexed, or how many product images lack alt text) and the suggested actions. Counts and product ids only, no customer data.
• A note for each change Visibilai applied or undid for you (which suggestion, which product, when), kept so the next audit can show what changed your scores. Ids and types only, no customer data.
• The latest AI readiness score of each product and why (missing details, title, description, reviews, images, eligibility, visibility). Product ids only, no customer data.
• Article ideas and drafts we suggest for your blog: topic, kind, the AI searches it answers, country and language, title, draft text, linked products, the id of the unpublished draft in Shopify once you approve it, and the publish date you chose, if any.
• The countries you target: country, language, currency, whether it is your primary market, whether you switched it on in Visibilai (and when), and when a plan change switched it off.
• Searches the AI assistants ran while answering your prompts: the search text, which assistant, how often and when, and which of your pages answers it.
• "Prove it" tests you start: the change tested, which products got it and which were held back, the dates, and the result.
• Only if you connect Google (optional): the Google account email and Google's id for it, the permissions Google granted, Google's access and refresh tokens (encrypted, never shown to anyone), the Search Console property and Merchant Center account you chose, the Google Analytics property you chose and its currency and time zone, how far our copies of the numbers go, the last problem reading them, and when you connected. Deleted when you click Disconnect; the tokens are deleted the moment you uninstall.
• Only if you connect Google: your property's clicks, impressions and average position in Google Search per day (up to 16 months), as Search Console reports them.
• Only if you connect Google: the top searches (up to 250) that showed your store in Google over the last 7, 30 and 90 days, with clicks, impressions and position. Search Console leaves out rare searches for privacy.
• Only if you connect Google: your top pages in Google Search (up to 250) over the last 7, 30 and 90 days, with clicks, impressions and position.
• Only if you connect Google: clicks, impressions and position in Google Search per searcher country over the last 7, 30 and 90 days.
• Only if you add Merchant Center: free listing clicks and impressions per day, and agentic checkout buy-button clicks and purchases where Google offers that report. Totals only, no shopper data.
• Only if you connect Google Analytics: per day, the visits (sessions), purchases and purchase revenue your Google Analytics property recorded in total, as Google Analytics reports them (the last 90 days). Totals only, no visitor data.
• Only if you connect Google Analytics: per day and traffic source that Visibilai recognises as an AI assistant (for example chatgpt.com), or that looks like one but is not certain, the visits, purchases and purchase revenue Google Analytics recorded. A source is a website or campaign name, never a person.
• Only if you connect Google Analytics: per day, AI assistant and product page (the product's handle only), the visits, purchases and purchase revenue Google Analytics recorded for visits that started on that product page.
• Only if you connect Google or Bing: for each product page of your store, the clicks and impressions it got in Google or Bing search per day (product pages only, up to 120 days), as Search Console or Bing Webmaster Tools report them. Visibilai compares the pages it changed with the pages it did not touch. Totals only, no shopper data.
• How your store looked at the start and each week after: your audit scores, the number of open issues, how many products meet Shopify Catalog's requirements, which AI crawlers your store lets in, structured data coverage, pages in Bing's index, your search totals and top searches and pages for the last 28 days, and AI visits and orders over the last 90 days. Counts and scores only, no customer data. It is what the Dashboard compares your results with.
• Where your store is in the first week after Visibilai's first changes (the 7-day observation week), the products those first changes touched, and the read-outs of what moved afterwards: counts and ranges only, no customer data.
• Only if you connect Bing Webmaster Tools (optional): the permission Bing granted (read-only), Bing's access and refresh tokens (encrypted, never shown to anyone), the Bing site you chose, how far our copy of the numbers goes, the last problem reading them, and when you connected. Deleted when you click Disconnect; the tokens are deleted the moment you uninstall.
• Only if you connect Bing: your site's clicks and impressions in Bing search per day, as Bing Webmaster Tools reports them.
• Only if you connect Bing: the top searches (up to 250) that showed your site in Bing over the last 90 days, with clicks, impressions and average position.
• Only if you connect Bing: your top pages in Bing search (up to 250) with clicks, impressions and position, and for the first ten the page's HTTP status and last crawl date as Bing reports them.
• Only if you connect Bing: per day, how many pages Bing crawled, how many crawl errors it saw and how many of your pages it has in its index.
• Only if you upload a report (Bing's AI Performance export or Merchant Center's AI report): the file name, which report it is, how many rows were read, the period it covers and any rows we skipped. The file itself is not kept. Uploading again replaces it; you can delete it any time.
• Only if you upload a report: its aggregate rows (a day's total, a cited page, a grounding query or topic Bing lists, a share-of-voice line) with the counts and shares the report gives. No shopper data.
• Only from earlier versions of the app (the guided check was switched off on 2 November 2026 and no new rows are written): the question you asked in an AI assistant yourself (a copy of one of the shopper questions we suggested), whether your store was named (yes, no or not sure), where, whether you were signed in, and the date. The assistant's answer is never typed in or kept.
• Which AI answers have been read for tone (one mark per answer, so each is read once), and how many passages it gave. Deleted with the answer.
• How an assistant described your store: per passage of an answer that names your store (or a competitor named alongside it), the tone, short themes, the price, material, returns and shipping facts it states with whether they match your store's data, the passage itself and its source links. No shopper data. Deleted with the answer.
• Only if you open Bing indexing (IndexNow): your store's IndexNow key (public by design: search engines read it on your store's own address), whether you switched it on and when, the result of the last key file check, and how far the sending has got.
• Only while Bing indexing (IndexNow) is on: the public page addresses of your store Visibilai told IndexNow about (or skipped, and why), the reason (a fix, a product or collection update, a published article), the answer and the time. No shopper data. Kept for 90 days.
• Only if you use Structured data: when you approved the Visibilai structured data embed (if you did), what you approved, what the last check found your theme already provides, when the checks ran, and when a plan change switched the embed off.
• Your store's public /llms.txt file (which Shopify generates) as we last read it for the GEO audit page: its address, text, size, and when we read it and saw it change. No shopper data.
• Only if you use the review check: which review app(s) we found in your store and how, how many products we read and how many had a star rating we can use, when we read them, and whether you allowed review highlights in your structured data. No review text and no reviewer names are kept here. If you allow review highlights, up to three reviews per product, with the reviewer's display name as written in your review records, are copied into that product's structured data in your store. Visibilai does not keep them.
• Only if you use the review check: per product, where its star rating came from, the rating and the number of reviews as your review app saved them in Shopify, and how many review highlights are on the product. No review text and no reviewer names.
• Only if you use Store facts for AI tools: the text you wrote, which parts you chose to share (contact email, shipping and returns policy, products, questions and answers), the questions and answers you wrote, whether you published it and allowed the footer link, and the document as last built from your store (the same text anyone can open at your store's /apps/visibilai/knowledge.md once you publish).
• Only if you use Structured data: per checked page (your home page and up to 20 product pages), its address, what structured data it has, the problems found with the suggested fix, and a preview of what the embed would add.
• The free technical check on our website (not the Shopify app): the store web address typed in, a one-way hash of the visitor's IP address (never the address itself) and the result shown (what the store's robots.txt, sitemap, home page and a few product pages say). It asks no AI assistant anything, and keeps no email address. Rows from the earlier version of the check, which also stored the category and country typed in and, only with consent, an email address, are deleted on the same 30-day schedule. Kept for 30 days.
• Daily counters that limit how often the free check can be used (per hashed IP address and in total). Kept for two days.
• One row per day with how much AI work Visibilai has used across all stores, so spending can be kept under a daily limit. It holds numbers only: no store, no person and no content.

What we send to AI providers

Prompt tracking. To check how AI assistants answer shopper questions about your products, Visibilai sends test questions (and product names from your catalog) to OpenAI, and to Perplexity and Anthropic on plans that include them. We do not send customer or order data. The first question is sent only after you click "I understand" on the notice on the Welcome page; we record the date and time of that click.

• Who is asked, by plan: OpenAI (ChatGPT) on every plan; Perplexity on the Growth and Enterprise plans; Anthropic (Claude) on the Enterprise plan. Through their official, paid business APIs, with web search switched on, as a shopper would ask. Gemini and Copilot are never asked, and no consumer app is scraped.
• What is sent: one test question at a time, as written in your prompt panel (a few wordings of each), and the country you sell to as an approximate location. A question can contain a category name, a price range or a product type from your catalog, and it contains your store's name only in the brand check, which asks about your store by name. We send no system prompt about your store.
• What comes back and how long we keep it: the answer text, the links it cited, which brands it named and which searches it ran. We keep these while the app is installed so the history works; the provider's untouched raw response is deleted after 90 days. Answers are a sample: assistants answer differently each time and for each person, so Visibilai shows ranges, never a ranking or what every shopper sees. Perplexity's answer text is shown only in the app.
• Writing and research (OpenAI): to write your prompt panel (your category names, product counts, price ranges, a few example product titles, your store and brand names so the questions can avoid or use them, and cleaned phrases from your Search Console searches); to suggest improvements (one product's title, description, type, vendor and options, and the category attributes Shopify allows); to write the copy, key facts, Q&A, translations and article drafts you ask for (the product and store details they are about); and to read an answer (the answer text and the brand names that appear in it) and the tone in which it describes a brand.
• Never: customer data, order data, access tokens or your contact email.
• Deletion: everything we hold from this (prompts, answers, ranges) is deleted when Shopify asks us to erase your store's data, 48 hours after you uninstall. Pausing or deleting a prompt in the app stops it being asked. Data a provider holds under its own terms is governed by that provider's policy (see below).

We use the providers' paid business APIs. We do not allow store or customer data to be used to train AI models, and we choose providers whose API terms do not train on our requests by default (and turn off any data-sharing option in our accounts). Their own policies govern how long they keep a request.

Our crawler (VisibilaiBot) also reads your store's public pages, as an AI crawler would, to check what they can read. It obeys robots.txt and reads only public pages.

Third parties (subprocessors)

• Shopify: the platform the app runs on, and billing.
• Fly.io: hosting of the app (United States).
• Neon or Fly.io Managed Postgres: the database (United States).
• OpenAI: prompt tracking on every plan (ChatGPT), and writing and research tasks, as described above.
• Perplexity: prompt tracking on the Growth and Enterprise plans. Anthropic: prompt tracking (Claude) on the Enterprise plan. Each receives only the test questions described above.
• Google, only if you connect it: the source of your Search Console and Merchant Center numbers (we read from Google; we send it nothing about your store or customers).
• Microsoft (Bing Webmaster Tools), only if you connect it: the source of your Bing numbers (we read from Bing; we send it nothing about your store or customers).
• IndexNow (api.indexnow.org, shared with Bing and other participating search engines), only if you switch Bing indexing (IndexNow) on: it receives your store's address, its IndexNow key and the addresses of public pages that changed. Nothing about your customers.
• Resend: email delivery. It receives your contact email and the content of the emails we send you.
• Our team chat (Slack or Discord), if enabled: a copy of feedback and support messages you send.

How we use it

Only to run the app for you: audit, explain and fix how well search engines and AI assistants can find and read your products, and report AI-referred orders. Emails: a one-time welcome after you install, one short weekly recap about your own store (it has a switch in Settings), and important notices about your account; one click in any email unsubscribes from all, no login. Product news only if you opt in. We also keep a few counts about how the app is used (see MetricEvent above), for our own planning. We do not sell data or use it for advertising.

Retention and deletion

• While the app is installed, we keep your data so the history and trends work.
• Finished background tasks are deleted after 90 days, and email log rows after 180 days (except unsubscribe records).
• When you uninstall, we delete the access tokens at once (Shopify's, and Google's and Bing's if you connected them), cancel queued work, stop audits and stop emails. When Shopify asks us to erase your store's data (48 hours after uninstall), we delete every row we hold for your store, in every table listed above.
• When Shopify passes on a customer's erasure request, we delete the AI-order rows of that customer's orders. A customer's data request is answered the same way: we hold no personal data about them, only the AI-order rows of the orders Shopify lists, which we give to the store on request.
• Deleted data can stay in our database provider's encrypted backups until those expire (at most 30 days).

What stays in your store after uninstall

Fixes you approved changed your own products (a product category, category attributes, the AI-facing title, description, key facts or Q&A in product metafields, and their translations), and article drafts you approved are in your blog. They are your store's data and stay after uninstall. Undo a fix on the Fixes page first if you want it removed. Theme blocks from the app are removed by Shopify automatically.

Our legal bases

Where the GDPR or a similar law applies, we use your personal data as a merchant to provide the service you installed (contract), to keep it secure, improve it and tell you about your account (legitimate interests), to meet legal duties, and, where the law asks for it, with your consent. For the store data we process on your behalf, you decide the purpose and the legal basis, as described in section 8 of the terms.

Security and international transfers

We use encrypted connections, a database encrypted at rest and limited access, and we encrypt the tokens of the optional Google and Bing connections. No system is perfectly secure, so we cannot promise absolute security. We tell affected merchants without undue delay about a personal data breach that affects their data. We operate from Israel, and the app and its database run in the United States. Our providers process data in the countries shown above. Where the law requires a safeguard for such a transfer, we rely on standard contractual clauses or another lawful mechanism.

Your rights

You can ask for a copy of your data, its correction or its deletion at any time. Customers of a store should contact that store; Shopify forwards their requests to us. Depending on where you live, you may also have the right to receive your data, to object to or restrict how we use it, to withdraw consent, and to complain to your data protection authority (in Israel, the Privacy Protection Authority). We answer requests within the time the law allows. We do not sell personal data or share it for targeted advertising, as those terms are used in California and similar laws. We do not make decisions with legal or similarly significant effects about anyone by automated means alone.

Children and changes to this policy

Visibilai is for businesses and is not directed at children. We may update this policy; we show the date at the top, and tell merchants in advance of a material change, by email or in the app.

Contact

Questions or requests: support@visibilai.app
Snir Tam, Ehud Manor 19, Raanana 4334919, Israel