Privacy Notice for visibilitas.de

This privacy notice explains which personal data we process when you use the website and the "Visibilitas" platform at https://visibilitas.de, for which purposes we do so, and which rights you have.

This is a translation of the binding German version. In case of any discrepancy, the German text prevails.

1. Controller

RIT Services GmbH
Am alten Güterbahnhof 57
50825 Cologne, Germany

Represented by the managing director Matthias Wessner
Telephone: +49 221 9759994-1
Email: info@rit.services
Commercial register: Amtsgericht Köln, HRB 115067
VAT identification number: DE367518494

2. Contact for data protection matters

We have not appointed a data protection officer, as there is no legal obligation to do so. For all questions about data protection and to exercise your rights, contact us at info@rit.services or by post at the address above.

3. Our role towards you

Visibilitas is a tool for companies and agencies that want to measure and improve the visibility of websites in search engines and AI systems. That gives us two roles:

• We are the controller for operating the website and the platform as such: visiting the website, your user account, signing in, technical logs, system emails, billing, feedback and support. This privacy notice applies to that processing.
• We are a processor for the content an organization creates in the platform or has processed through it: projects and websites, keywords, competitors, retrieved page content, generated text, reports, credentials for connected systems (for example WordPress, Google Search Console, Google Analytics), data from those systems, AI queries and their answers and, where enabled, the visitor and lead data of the web analytics and marketing automation modules. The organization is the controller for that content. We process it solely on its instructions on the basis of a data processing agreement under Art. 28 GDPR, which every organization concludes with us at registration and can view at visibilitas.de/avv.

If an agency uses the platform for its own clients, the agency is the processor towards its clients and we are its sub-processor. If you have questions about content an organization has stored about you — for instance because you are named on an analysed website — please contact that organization. We support them in answering.

4. Hosting and technical logs

The platform runs on a server environment we operate ourselves. The servers are located in data centres in Germany and Finland; we rent them from the data centre operators listed in section 17. Those operators provide only the hardware and have no access to our systems or data. All storage media are encrypted.

Each time the website is accessed, our web server automatically processes the following data in log files: IP address, date and time of access, the address requested, the amount of data transferred, the HTTP status code, the browser and operating system used, and the previously visited page if your browser transmits it. The IP address is shortened as the log is written, so that it can no longer be attributed to a person.

The purpose is the secure and stable operation of the platform, in particular detecting and defending against attacks and analysing faults. The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR). Log files are deleted after no more than 30 days, unless a specific security incident requires longer retention in order to investigate it.

Fonts and all other parts of the website are served from our own servers. Accessing the website establishes no connections to third-party servers unless you have consented to web analytics under section 6.

5. Cookies and local storage in your browser

We set technically necessary cookies only after you sign in: an access cookie that identifies you as a signed-in person for 15 minutes, and a sign-in cookie that extends your session for 7 days without re-entering your password. Both cookies cannot be read by scripts (HttpOnly), are transmitted only over encrypted connections, and are necessary to provide the service you use; no consent is required for them (§ 25(2) no. 2 TDDDG). Both cookies are deleted when you sign out.

In addition, your browser stores your chosen language and your audience-measurement setting (section 6) on your device. These settings contain no personal data and are not transmitted to us.

We do not use cookies or comparable techniques for analytics or advertising purposes. The audience measurement described in section 6 works without cookies. We do not embed advertising networks, social media plugins or third-party content that could evaluate your behaviour.

6. Web analytics

Matomo (no cookies, on our servers)

To measure reach we use the analytics software Matomo, which we operate ourselves on our servers in the EU. No data is transmitted to the manufacturer or any other third party. Matomo is configured so that it sets no cookies and stores no characteristics of your device for recognition. Your IP address is shortened by its last two bytes before storage, so that it can no longer be attributed to a person. We record the pages accessed, the time, the browser type, the approximate origin derived from the shortened IP address, and the previously visited page.

The purpose is to understand which pages and features are used, in order to improve the website and the platform. The legal basis is our legitimate interest in evaluating usage without reference to a person (Art. 6(1)(f) GDPR); because no information is stored on or read from your device, no consent under § 25 TDDDG is required. You may object to this at any time by choosing the "Do not track" option in the web analytics settings at the bottom of the page. The raw data is deleted after 180 days; after that, only aggregated statistics without any reference to a person remain.

7. Registration and user account

When you create an account, we process your name, your email address, your password (only as a cryptographic hash — we do not know your password), your language, an optional profile picture, the time of registration and of your last sign-in, and your role and permissions in the organization.

To confirm your email address we send you a verification link valid for 24 hours. Password reset links are valid for one hour. Expired keys are deleted.

You can optionally enable two-factor authentication with an authenticator app. In that case we store secret key material for the one-time password procedure and recovery codes as a hash. The app runs on your device; we receive no data from it.

For access through the application programming interface you can create API keys. We store the key as a hash, its name and the time of creation and last use, until you revoke it.

The purpose is to provide your account and to secure access to it. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR). We store account data until you delete your account or the organization you belong to is deleted.

8. Organizations, invitations and the data processing agreement

Whoever creates an organization provides its company name, legal form and address, as well as their own name and function as an authorised representative, and concludes the data processing agreement. We store this information together with the time of conclusion, the version of the agreement and the IP address as evidence for as long as the organization exists, and afterwards for the duration of the statutory retention periods as a contract document without content data. We delete the IP address after 12 months.

Administrators can invite further people by email. To do so they enter that person's email address and role; we send the invited person an email with an invitation link valid for 7 days. The legal basis is the user agreement with the organization (Art. 6(1)(b) GDPR) and, towards the invited person, our legitimate interest and that of the organization in adding members to a shared tool (Art. 6(1)(f) GDPR). If you receive an invitation you do not want, you need do nothing; it expires automatically.

9. Trial, plans and billing

You can try the platform free of charge for 14 days; no payment data is required. During the trial we process the same data as for an account under section 7, plus the start and end of the trial.

If you book a paid plan, we process the chosen plan, the billing period, the billing email address, usage counters (for example the number of analyses and AI queries) and the customer and subscription identifiers of our payment provider. Payment is handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. You enter payment data such as your card number or bank details directly with Stripe; we neither receive nor store them. Stripe is an independent controller for payment processing and is subject to its own legal obligations, for instance regarding fraud prevention. Stripe's privacy policy is available at stripe.com/privacy.

The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR) and, for retaining invoice data, our legal obligation under commercial and tax law (Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB). We retain invoice data for 10 years from the end of the calendar year in which the invoice was issued.

10. Organization content, projects and connected systems

All content that you or other members of your organization create in the platform, or have retrieved through the platform, is processed by us on behalf of the organization (section 3). This includes:

• Projects: domains, keywords, competitors, audience and tone-of-voice settings, brand voice, campaigns.
• Website analysis: the platform retrieves publicly accessible pages of the project website and of the competitors named, and stores page content, snapshots, technical metrics and recommendations. If retrieval is blocked, we use the ScrapingBee service (section 17), which receives only the address to be retrieved.
• Search engine and SEO data: for rank tracking and keyword and backlink analysis we query the data services DataForSEO and SerpApi (section 17). They receive only keywords, domains, country, language and device type.
• AI services: for visibility queries, content generation and optimisation suggestions, the platform transmits page content, keywords, the organization's settings, query texts and drafts to the AI services of Anthropic, OpenAI and Google (section 17) and stores their answers. We use these services exclusively through their commercial programming interfaces with model training contractually excluded. The organization can restrict which AI services are used per project.
• Connected systems: if the organization connects a content management system (for example WordPress) or a Google account, we store the credentials and OAuth tokens provided, encrypted with a key that applies to that organization alone. Through the Google connection we read only the metrics of the released Search Console and Analytics properties (clicks, impressions, positions, sessions, traffic sources, countries). Our use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements; we use this data only to display the metrics in the platform and to generate recommendations, and we do not pass it on to third parties. The organization can disconnect at any time in the project settings or in its Google account; we then delete the tokens immediately.
• Publishing: on the organization's instruction, the platform publishes content in the connected content management system, including automatically according to rules the organization defines.
• Website copies: on request, the platform creates a copy of the project website on our infrastructure for preview and delivery.
• Web analytics and marketing automation modules: if the organization enables these modules, we operate instances of the Matomo and Mautic software for its websites, including a consent banner. The organization, or its client, is the controller for the data processing on those websites; the privacy notice published there informs the visitors.

Content remains stored for as long as the project or the organization exists and is deleted when the organization is deleted under section 15. Page snapshots are replaced by newer ones after 90 days; the most recent snapshot of a page is kept until that page is retrieved again.

11. System emails

We send you emails that are necessary for using the service: registration confirmation, invitations, password resets, notifications about completed analyses, reports, information about your plan and important notices about the platform or the data processing agreement. We send promotional emails only with your consent.

For delivery we use the Resend service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The provider receives your email address, your name and the text of the respective message; our emails contain content from your projects only where a report summarises it. The provider is certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the adequacy decision of the European Commission (Art. 45 GDPR). In addition, we have agreed the European Commission's standard contractual clauses with the provider.

The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR). Notifications shown in the platform are deleted after 180 days.

12. Activity log

The platform records who created, changed or deleted which projects, content, integrations, roles or memberships and when, and which publications and automated actions were carried out. The activity log serves the organization as evidence and us for security and fault analysis. The legal basis is the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in traceability (Art. 6(1)(f) GDPR). Entries are deleted after 365 days, and at the latest when the organization is deleted.

13. Feedback and support

You can send us feedback and questions through the feedback function in the platform and by email to info@rit.services. We process the information you provide, an optionally attached screenshot, your email address and, for feedback sent from within the platform, your user account and the page you were on, in order to handle your request and improve the platform. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in improving the service (Art. 6(1)(f) GDPR). We delete requests 12 months after they are received.

Support access to an organization's content takes place only after an administrator of that organization has granted it for a specific case and for its duration; every access is logged. Further information about support provided by our affiliated company in Pakistan is in section 18.

14. Security monitoring

To detect attacks and faults, we evaluate the logs described in section 4 and our application's error messages on our own systems. Error messages may contain your user identifier, the function called and technical details of the error, but no content from your projects. The legal basis is our legitimate interest in the security and stability of the platform (Art. 6(1)(f) GDPR). Error messages are deleted after 90 days.

15. Data export, deletion and backups

You can view your data at any time in the settings and export it as a file. You can delete your account; administrators can delete the entire organization. When an organization is deleted, we destroy the organization's encryption key and delete all records, stored page content, website copies and credentials for connected systems no later than 30 days after the deletion request; until then the deletion can be undone.

We create encrypted backups daily and keep them for 30 days. Deleted data is therefore also removed from the backups no later than 30 days after deletion. The backups are encrypted by us and stored with the storage service Backblaze (section 17) in a data centre in the Netherlands; the storage service has no access to the key and cannot read the data. We use backups solely to restore service after technical failures.

16. Retention periods at a glance

17. Recipients and processors

We pass on personal data only where it is necessary to operate the platform. We use the following service providers as processors; the numbering matches the list of sub-processors in our data processing agreement:

Stripe Payments Europe, Limited (section 9) is not a processor but an independent controller for payment processing. Public data sources we query without transmitting personal data (for example Google PageSpeed Insights, WHOIS services, the Internet Archive, image databases) receive only the address of the project website or a search term.

Beyond that, we pass on data only where we are legally obliged to do so, for instance to authorities on the basis of a lawful order.

18. Transfers to third countries

Your account and project data is stored on our servers in the European Union. Recipients outside the EU are involved in the following cases:

• Email delivery via Resend (USA): see section 11.
• Backups with Backblaze: the backups are held in a data centre in Amsterdam, but our contractual partner is the US company Backblaze, Inc. It is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the European Commission's standard contractual clauses apply. Because the data is encrypted by us before transfer and the key remains solely with us in the EU, Backblaze can never receive readable data.
• AI services from Anthropic, OpenAI and Google (USA): our contractual partners are the Irish companies; processing takes place on the infrastructure of the respective US parent company. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). For Anthropic and OpenAI the transfer is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the respective data processing agreements; we have assessed and documented the legal situation in the USA for these transfers. All three services contractually do not use the transmitted data to train their models and store inputs and outputs for no more than 30 days for abuse monitoring. The organization decides which content it brings into the platform and can restrict the AI services per project.
• Search result data from SerpApi (USA): the basis is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). SerpApi receives only keywords, country, language and device type and does not store the queries.
• Administration and support by Rasalhague IT Services (Private) Limited (Pakistan): our affiliated company maintains our server environment by remote access. The encryption keys and database credentials are held in a separate environment that only our staff in the EU can access; the administrators in Pakistan can therefore reach encrypted data only. For support requests they receive data only in pseudonymised form through a gateway we operate in the EU, only for the organization concerned, only after that organization has granted access for the specific case, and only for its duration. The mapping back to plain data stays with us in the EU. The basis for the transfer is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) with a documented assessment of the legal situation in Pakistan; encryption and pseudonymisation are the supplementary safeguards. Every organization can exclude support access from outside the EU in its settings; the default is "not allowed".

We provide a copy of the standard contractual clauses on request. No other transfers to third countries take place.

19. Your rights

You have the following rights in respect of your personal data:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability in a common, machine-readable format (Art. 20 GDPR),
• objection to processing based on our legitimate interest (Art. 21 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

Right to object: where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

You can obtain access to, export and delete your account directly in the platform settings. For all other matters, write to info@rit.services. If your request concerns content an organization processes about you (section 3), we forward it to that organization or name the contact person for you.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, ldi.nrw.de. You can also contact the supervisory authority where you live or work.

20. No automated decision-making

We do not take decisions with legal effect for you based solely on automated processing. The AI features of the platform assess websites and generate text; they do not assess people.

21. Data security

We protect your data with technical and organisational measures in line with the state of the art: encrypted transmission (TLS), encrypted storage, additional encryption of credentials for connected systems with a key per organization, role-based access rights, optional two-factor authentication, lockout after failed sign-in attempts, and daily encrypted backups with tested restoration. Details are available at visibilitas.de/security.

22. Changes to this privacy notice

We adapt this privacy notice when the platform, the service providers used or the legal situation change. The current version is always available at visibilitas.de/privacy. We inform registered users by email about material changes.