Privacy Policy

1. Who We Are and Scope of This Policy

1.1Operator. The VIZS.ai platform is operated by AdGPT com Inc., a Delaware corporation (Delaware file number [DELAWARE FILE NUMBER]), with its registered office at [DELAWARE REGISTERED AGENT / REGISTERED OFFICE ADDRESS] and its principal place of business at [PRINCIPAL PLACE OF BUSINESS ADDRESS] ("VIZS," "Company," "we," "us," or "our").

1.2Relationship to the Terms. This Privacy Policy ("Policy") supplements and is incorporated by reference into the VIZS Terms of Service / Master Subscription & Services Agreement (the "Terms" or "Agreement"), including Section 12.3 of the Terms, which provides that the processing of personal data is governed by this Policy and, where applicable, a Data Processing Agreement. Capitalized terms used but not defined in this Policy (including "Platform," "Services," "Customer," "Third-Party Platforms," "Publisher," "Order Form," "AI Visibility," and "Marketplace Placement") have the meanings given to them in the Terms. In the event of a conflict between this Policy and the Terms regarding the processing of personal data, this Policy prevails; in all other respects, the Terms prevail. Where a Data Processing Agreement has been executed, it prevails over this Policy with respect to Customer Personal Data (as defined below).

1.3What this Policy covers. This Policy applies to personal data that we process in connection with: (a) the websites located at vizs.ai and its subdomains (the "Site"); (b) the Platform and the Services; (c) CiteExchange, the Authority Exchange Marketplace described in Section 8 of the Terms (the "Marketplace"); (d) our integrations with Third-Party Platforms; and (e) our marketing, sales, support and business communications.

1.4What this Policy does not cover. This Policy does not apply to: (a) the privacy practices of Customers, Publishers or Third-Party Platforms (including LinkedIn, Google, Reddit, content management systems, website builders, hosting providers and AI systems), which are governed by their own policies; (b) personal data that a Customer processes through the Services as a controller, which is governed by that Customer's privacy policy and our Data Processing Agreement (see Section 4); or (c) employee and job-applicant data, which is addressed in separate notices.

1.5Business users. The Services are designed for and offered only to businesses and professionals acting in a business capacity. The Services are not offered to consumers for personal, family or household purposes.

2. Key Definitions

In this Policy:

2.1"Personal data" (also "personal information") means any information relating to an identified or identifiable natural person, and includes "personal information" as defined under the California Consumer Privacy Act (as amended by the California Privacy Rights Act) ("CCPA") and "information" and "sensitive information" as defined under the Israeli Protection of Privacy Law, 5741-1981, and the regulations thereunder, as amended (together, the "Israeli Privacy Law").

2.2"Customer Content" means all data, content and materials submitted to, uploaded to, connected to, generated for, or processed through the Services by or on behalf of a Customer, including website content, brand materials, prompts, instructions, business information, documents, AI Inputs, AI Outputs, Connected Account Data and any personal data contained in any of the foregoing.

2.3"Customer Personal Data" means personal data contained in Customer Content that we process on behalf of a Customer.

2.4"Connected Account" means any third-party account, website, content management system, social network, analytics property or other Third-Party Platform that a Customer or its Authorized User connects to the Services, including via OAuth, API key, application password, plug-in, script, webhook or other credential.

2.5"AI Inputs" means prompts, queries, instructions, documents, data and other materials submitted to AI functionality within the Services; "AI Outputs" means articles, research, recommendations, analyses, drafts, posts, summaries and other materials generated by the Services in response to AI Inputs or automated workflows.

2.6"Authorized User" means an individual whom a Customer permits to access the Services under the Customer's account.

2.7"Data Protection Laws" means all laws relating to data protection and privacy that apply to a given processing activity, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as incorporated into UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, the CCPA and other U.S. state privacy laws, and the Israeli Privacy Law.

3. Our Roles: Controller and Processor

3.1VIZS as controller. VIZS acts as a "controller" (and, to the extent the Israeli Privacy Law applies, as the "database controller" or "database owner") with respect to personal data that we collect for our own purposes, including Account Data, Billing Data, Site and usage data, marketing data, Publisher data, support communications, security logs, and data we use for legal compliance, fraud prevention and the establishment, exercise or defense of legal claims.

3.2VIZS as processor. VIZS acts as a "processor" or "service provider" (and, to the extent the Israeli Privacy Law applies, as a "holder" of data on behalf of the database controller) with respect to Customer Personal Data. When acting in that capacity, we process Customer Personal Data only on the documented instructions of the Customer, which consist of the Terms, the applicable Order Form, the Data Processing Agreement (if any), and the Customer's configuration and use of the Services, and as otherwise required by law.

3.3Customer responsibilities. Each Customer is the controller of Customer Personal Data and is solely responsible for: (a) establishing and documenting a valid lawful basis for all processing of Customer Personal Data it instructs us to perform; (b) providing all notices to, and obtaining all consents, authorizations and permissions from, individuals, Authorized Users, employees, Connected Account holders and other third parties as required by Data Protection Laws and by the terms of each Third-Party Platform; (c) ensuring that Customer Content, and its collection and submission to the Services, is lawful and does not infringe any third-party rights; (d) responding to requests from individuals regarding Customer Personal Data; and (e) the accuracy, quality and legality of Customer Content. Customer represents and warrants that it has satisfied, and will continue to satisfy, these obligations, consistent with Sections 7.3, 9.2 and 9.3 of the Terms.

3.4Requests regarding Customer Personal Data. If we receive a request from an individual relating to Customer Personal Data, we will, where legally permitted, direct the individual to the relevant Customer or forward the request to the Customer, and we will not respond directly except as required by law or as instructed by the Customer. If you are an individual whose personal data was submitted to the Services by one of our Customers, please contact that Customer directly.

4. Data Processing Agreement

4.1Where we process Customer Personal Data that is subject to the GDPR, UK GDPR, the CCPA or another Data Protection Law that requires a written processing contract, the processing is governed by the VIZS Data Processing Agreement available at [DPA URL] or as executed between the parties (the "DPA"), which is incorporated into the Terms by reference upon the Customer's acceptance of the Terms, to the extent such Data Protection Law applies.

4.2The DPA includes, where applicable, the Standard Contractual Clauses described in Section 13, a description of the processing, the security measures we maintain, and the conditions under which we engage Subprocessors.

5. Personal Data We Collect

We collect the following categories of personal data. The specific data collected depends on how you interact with us and which features you use.

5.1Data you provide to us directly

(a)Account Data: name, business email address, phone number, job title, employer or company name, password (stored in hashed form), user role and permissions, profile photo, language and time-zone preferences, and authentication data (including multi-factor authentication settings).

(b)Billing and Transaction Data: billing contact name, billing address, company tax or VAT identification number, purchase history, subscription plan, Order Form details and invoice records. Payment card data is collected and processed directly by our payment processor, Stripe, Inc. and its affiliates ("Stripe"). We do not store full payment card numbers or security codes on our systems. We may receive from Stripe limited information such as the card brand, the last four digits, expiration date, billing country, payment status, and fraud-risk signals. Stripe's processing is governed by the Stripe Privacy Policy (https://stripe.com/privacy).

(c)Customer Content: website URLs and content, brand guidelines, approved claims, product and business information, competitor lists, keywords, documents, images and other materials you submit; and AI Inputs.

(d)Communications Data: the content of emails, chats, support tickets, survey responses, feedback, call notes and meeting recordings (where you have been notified and, where required, have consented) that you exchange with us.

(e)Marketplace Data (CiteExchange): for buyers, details of requested placements, orders and related communications; for Publishers, publication names and URLs, contact details, editorial guidelines, pricing, payout details, and tax information (such as [W-9/W-8 FORMS OR OTHER TAX DOCUMENTATION]) and, where required, identity-verification information [CONFIRM WHETHER KYC IS PERFORMED AND BY WHOM].

(f)Event and Marketing Data: information you provide when you request a demo, subscribe to communications, attend a webinar or event, or download content.

5.2Data collected through Connected Accounts and integrations

When you or an Authorized User connect a Connected Account, you authorize us to access and process data from that account to the extent of the permissions (scopes) you grant. Depending on the integration, this may include:

(a)Authentication Credentials: OAuth access tokens and refresh tokens, API keys, application passwords and similar credentials ("Credentials"). Credentials are stored in encrypted form and are used solely to provide the functionality you have enabled. We do not request or store your passwords for Third-Party Platforms where OAuth or token-based authorization is available [CONFIRM].

(b)LinkedIn: basic profile information (such as name, profile photo, headline and member/organization identifiers), the identity of company pages you administer, and the content, metadata and performance metrics of posts published through the Services, in each case within the scopes you authorize.

(c)Websites and Content Management Systems: site identifiers, content, pages, posts, media, categories, metadata, and author or user information necessary to publish content to platforms including [LIST OF SUPPORTED CMS/SITE PLATFORMS, E.G., WORDPRESS, WEBFLOW, SHOPIFY, WIX, CUSTOM API].

(d)Google: where you connect Google services such as [GOOGLE SEARCH CONSOLE / GOOGLE ANALYTICS / OTHER GOOGLE APIS - CONFIRM], account identifiers, email address, and the property, performance, search and analytics data available within the authorized scopes.

(e)Reddit: where you connect a Reddit account or use our Reddit integration, your Reddit username and account identifiers and, within the authorized scopes, [DESCRIBE REDDIT FUNCTIONALITY: E.G., MONITORING OF PUBLIC THREADS, DRAFTING OR POSTING COMMENTS/POSTS], together with associated content and metadata.

(f)Other integrations: such other data as is made available by a Third-Party Platform under the permissions you grant, as described at the time of connection.

You may revoke our access at any time through the Services (where available) or through the settings of the relevant Third-Party Platform. Revocation may disable related features and does not affect content already published.

5.3Data collected automatically

(a)Device and Usage Data: IP address, browser type and version, operating system, device identifiers, referring and exit pages, pages and features viewed, clickstream data, timestamps, session duration, approximate location derived from IP address, crash reports and diagnostic data.

(b)Cookies and similar technologies: see Section 11.

(c)Security and Audit Logs: login events, access logs, API calls, actions taken within accounts (including publishing actions and approvals), and fraud and abuse signals.

5.4Data from public sources and third parties

(a)Public web and AI-system data: to provide AI Visibility analysis, monitoring and research, the Services query AI systems and search engines and retrieve, crawl and analyze publicly available web pages, publications, forums and social media content (including public Reddit content) relating to brands, products, topics and competitors designated by Customers. Such content may incidentally include personal data, such as the names, usernames, titles and public statements of individuals ("Public Data"). We process Public Data only to the extent necessary for these purposes and do not use it to build profiles of private individuals for purposes unrelated to the Services.

(b)Business partners and data providers: resellers, referral partners, event co-sponsors and providers of business contact information [CONFIRM IF ANY ARE USED].

(c)Payment and fraud-prevention providers: including payment status and risk signals from Stripe.

5.5Sensitive data

We do not intentionally collect, and you must not submit to the Services, special categories of personal data (such as data concerning health, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, sex life or sexual orientation, or criminal records), government identification numbers, financial account numbers (other than via Stripe), or data concerning children, except where strictly necessary and expressly agreed in writing. Credentials constitute "sensitive personal information" under the CCPA; we use them solely to provide the Services you request and for security purposes permitted by law, and not to infer characteristics about any individual.

6. How We Use Personal Data and Our Legal Bases

We use personal data for the purposes below. Where the GDPR or UK GDPR applies, we rely on the legal bases indicated.

Provide and operate the Services. Examples: Account creation; authentication; AI Visibility analysis; article and research generation; scheduling and publishing to Connected Accounts; Marketplace transactions; reporting. Legal basis (GDPR/UK GDPR): Performance of a contract; for Customer Personal Data, the Customer's instructions (Customer determines its own legal basis).

Billing and payments. Examples: Charging subscriptions via Stripe; invoicing; collections; tax compliance. Legal basis (GDPR/UK GDPR): Performance of a contract; legal obligation.

Customer support and communications. Examples: Responding to inquiries; service, security and administrative notices; changes to the Terms or this Policy. Legal basis (GDPR/UK GDPR): Performance of a contract; legitimate interests.

Security, fraud and abuse prevention. Examples: Monitoring for unauthorized access, misuse, spam, deceptive content and violations of the Terms; enforcing Section 7.8 and Section 9.6 of the Terms. Legal basis (GDPR/UK GDPR): Legitimate interests; legal obligation.

Improve and develop the Services. Examples: Analytics; debugging; quality assurance; developing new features using aggregated and de-identified data (Terms Section 11.4). Legal basis (GDPR/UK GDPR): Legitimate interests.

Marketing. Examples: Sending product updates, newsletters and offers to business contacts; measuring campaign effectiveness. Legal basis (GDPR/UK GDPR): Legitimate interests; consent where required by law.

Legal, compliance and protection of rights. Examples: Complying with law, court orders and lawful requests; establishing, exercising or defending legal claims; enforcing the Terms; audits; corporate transactions. Legal basis (GDPR/UK GDPR): Legal obligation; legitimate interests.

Public Data processing. Examples: Monitoring brand mentions and citations across AI systems and the public web. Legal basis (GDPR/UK GDPR): Legitimate interests (of the Customer and VIZS).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may request information about this balancing assessment using the contact details in Section 22. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

7. Artificial Intelligence Processing

7.1Use of AI. As described in Sections 2.3 and 7 of the Terms, the Services use proprietary and third-party artificial intelligence technologies, including large language models, autonomous and semi-autonomous AI agents, automation and human review, to analyze AI Visibility, generate articles, research and other AI Outputs, recommend opportunities and coordinate publishing.

7.2Third-party AI providers. AI Inputs, Customer Content and related context may be transmitted to third-party AI model and infrastructure providers acting as our Subprocessors or service providers ("AI Providers"), currently [LIST AI PROVIDERS, E.G., MODEL PROVIDERS AND CLOUD AI SERVICES]. We engage AI Providers under terms that restrict them to processing data for the purpose of providing their services to us. [CONFIRM: We use AI Provider enterprise or API offerings under which customer data is not used to train the provider's models by default.] When the Services query public AI systems (for example, to measure how a brand is represented in AI-generated answers), the queries are designed to contain only the brand, product, topic or other information necessary for that measurement.

7.3No training on Customer Content. We do not use Customer Content or Customer Personal Data to train, retrain or fine-tune generalized AI models that are made available to other customers or third parties, and we do not authorize AI Providers to do so, unless (a) the Customer expressly opts in or agrees in writing, or (b) the data has first been aggregated and de-identified such that it can no longer reasonably be linked to the Customer or to any individual, consistent with Section 11.4 of the Terms. This is consistent with Section 12.6 of the Terms. We may use Customer Content to provide, configure and personalize the Services for that Customer (for example, maintaining brand voice settings within that Customer's account).

7.4Accuracy of AI Outputs. AI Outputs are generated probabilistically and may contain inaccuracies, including inaccurate statements about individuals. Consistent with Section 7.4 of the Terms, the Customer is responsible for reviewing AI Outputs before publication and for not including personal data about any individual in AI Inputs or published content without a lawful basis. Individuals who believe an AI Output published by a Customer contains inaccurate personal data about them should contact the Customer that published it; we will reasonably assist our Customers in addressing such requests.

7.5No solely automated decisions with legal effects. We do not make decisions about individuals based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on them within the meaning of Article 22 of the GDPR. Automated fraud and abuse screening may result in a transaction or account being flagged for human review.

8. Automated Publishing and Connected Accounts — Customer Responsibility

8.1Customer authorization. The Services may publish, schedule or post content (including AI Outputs) automatically to Connected Accounts, including LinkedIn profiles and pages, websites, content management systems and Reddit, in accordance with the settings, approvals and workflows configured by the Customer. By enabling automated publishing, the Customer authorizes VIZS to perform such actions on the Customer's behalf as its agent and instructs us to do so.

8.2Customer responsibility. As between VIZS and the Customer, the Customer is solely responsible for (a) all content published to its Connected Accounts through the Services, including its accuracy, legality and any personal data it contains; (b) ensuring that it, and each Authorized User who connects an account, has the authority to connect that account and authorize publishing; (c) compliance with the terms, policies, community rules and automation and disclosure requirements of each Third-Party Platform (including LinkedIn's User Agreement, Reddit's User Agreement and community rules, and Google's terms); (d) applicable advertising-disclosure and consumer-protection laws (consistent with Sections 8.6 and 9.3 of the Terms); and (e) reviewing, approving, disabling or deleting scheduled content.

8.3Published content is public and outside our control. Content published to a Third-Party Platform becomes subject to that platform's privacy policy and terms and may be publicly accessible, indexed, cached, copied, archived or ingested by search engines and AI systems. Deleting content from the Services, or terminating your account, does not remove content already published to Third-Party Platforms, and VIZS cannot guarantee the removal of any published content or its copies.

8.4Third-Party Platform changes. Consistent with Section 10 of the Terms, Third-Party Platforms may change their APIs, permissions or policies, revoke access, or restrict or suspend accounts, and VIZS is not responsible for their independent acts or omissions.

8.5Google API Services User Data Policy. VIZS's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, do not sell it, and do not use it for advertising. We likewise comply with the applicable data-use restrictions of the LinkedIn, Reddit and other Third-Party Platform API terms.

9. How We Disclose Personal Data

We do not sell personal data for money. We disclose personal data only as described below:

(a)Service providers and Subprocessors that perform services on our behalf, including cloud hosting, data storage, AI Providers, email delivery, customer support, analytics, security and monitoring, and payment processing by Stripe (see Section 10).

(b)Third-Party Platforms at your direction, when you connect a Connected Account or instruct the Services to publish or transmit content. Such disclosures are made at the Customer's direction and are not a "sale" or "sharing" by VIZS.

(c)Marketplace participants: we disclose to Publishers the information necessary to fulfil a Marketplace Placement (such as the buyer's business name, brief and content) and to buyers the information necessary to evaluate and complete a placement (such as the Publisher's publication details). Publishers are independent third parties and controllers of the data they receive, consistent with Section 8.2 of the Terms.

(d)Within the Customer's organization: information associated with a Customer account may be visible to the account owner and administrators and other Authorized Users of that account.

(e)Affiliates: our current and future parent companies, subsidiaries and affiliates under common control, who are bound to use personal data consistently with this Policy.

(f)Professional advisers: lawyers, accountants, auditors and insurers, under duties of confidentiality.

(g)Legal and law enforcement: see Section 18.

(h)Business transfers: see Section 17.

(i)With consent or at your direction.

(j)Aggregated or de-identified data, which does not identify any individual, for any lawful purpose. We will maintain and use such data in de-identified form, will not attempt to re-identify it except as permitted by law, and will contractually require any recipient to do the same.

10. Subprocessors and Service Providers

10.1We engage Subprocessors that are bound by written agreements imposing data-protection obligations no less protective than those required by Data Protection Laws. A current list of our Subprocessors is available at [SUBPROCESSOR LIST URL] or on request.

10.2Our principal service providers include: Stripe (payment processing, billing and fraud prevention); [HOSTING / CLOUD PROVIDER]; [DATABASE PROVIDER]; [AI PROVIDERS]; [EMAIL / COMMUNICATIONS PROVIDER]; [ANALYTICS PROVIDER]; [CUSTOMER SUPPORT / CRM PROVIDER]; [ERROR-MONITORING PROVIDER].

10.3Where required under the DPA, we will provide advance notice of new Subprocessors and an opportunity to object on reasonable data-protection grounds, as set out in the DPA. We remain responsible for our Subprocessors' performance of their data-protection obligations to the extent required by Data Protection Laws.

11. Cookies, Analytics, Do Not Track and Global Privacy Control

11.1Cookies. We and our service providers use cookies, pixels, local storage, SDKs and similar technologies ("Cookies") to operate the Site and Services, keep you signed in, remember preferences, secure accounts, understand usage and measure marketing. Categories include: (a) strictly necessary; (b) functional; (c) analytics and performance; and (d) marketing/advertising [CONFIRM WHETHER ANY ADVERTISING OR RETARGETING COOKIES/PIXELS ARE USED]. Further detail is available in our cookie notice or banner at [COOKIE NOTICE URL].

11.2Your choices. Where required by law (including in the EEA and UK), we will obtain your consent before placing non-essential Cookies, and you can withdraw consent at any time through our cookie settings. You can also block or delete Cookies through your browser settings; blocking strictly necessary Cookies may impair the Services.

11.3Do Not Track. Because there is no consistent industry standard for "Do Not Track" browser signals, we do not currently respond to them, except as described in Section 11.4.

11.4Global Privacy Control. Where required by applicable law, we treat a Global Privacy Control ("GPC") signal as a valid request to opt out of the sale or sharing of personal information and of targeted advertising for the browser or device sending the signal (and, if known, the associated account).

12. Marketing Communications

12.1We may send marketing emails to business contacts in accordance with applicable law, including the U.S. CAN-SPAM Act, Section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law, 5742-1982, the EU ePrivacy rules and the UK PECR. Where consent is legally required, we will obtain it first.

12.2You may opt out at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at privacy@vizs.ai. We will process opt-out requests within the period required by law. Opting out of marketing does not stop transactional, security, billing, legal or service communications, which are necessary for the Services.

12.3We do not send marketing text messages without prior express consent where required by law.

13. International Data Transfers

13.1VIZS is a corporation established in the United States (State of Delaware), with [OPERATIONS / PERSONNEL] in Israel [CONFIRM]. We and our service providers may process personal data in the United States, Israel, the European Economic Area, the United Kingdom and [OTHER COUNTRIES WHERE DATA IS HOSTED OR PROCESSED]. These countries may have data-protection laws different from those of your country.

13.2Because VIZS is established in the United States, personal data subject to the GDPR, UK GDPR or Swiss law that is provided to us is transferred to the United States. Where personal data is transferred to Israel, we rely on the European Commission's decision recognizing Israel as providing an adequate level of protection (and the corresponding UK and Swiss adequacy recognitions). For transfers to the United States and to any other country that has not been recognized as adequate, we rely on an appropriate transfer mechanism, such as the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions (where VIZS or the relevant recipient is certified [CONFIRM WHETHER VIZS IS OR WILL BE DPF-CERTIFIED]), or another lawful mechanism, together with supplementary measures where appropriate.

13.3To the extent personal data is collected, stored or processed in Israel or is otherwise subject to the Israeli Privacy Law, transfers of such data out of Israel are carried out in accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.

13.4You may request a copy of the relevant safeguards by contacting us under Section 22.

14. Data Security

14.1We maintain commercially reasonable administrative, technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration and disclosure, consistent with Section 12.2 of the Terms and, where applicable, the Israeli Privacy Protection (Data Security) Regulations, 5777-2017. These measures include [CONFIRM: encryption in transit (TLS) and at rest; encryption of Credentials; role-based access controls; multi-factor authentication for administrative access; logging and monitoring; vendor due diligence].

14.2No guarantee. No method of transmission over the internet or of electronic storage is completely secure. To the maximum extent permitted by applicable law, we do not guarantee or warrant the absolute security of any personal data, and we are not responsible for unauthorized access resulting from circumstances outside our reasonable control, including acts or omissions of Third-Party Platforms, or a Customer's or Authorized User's failure to secure its own credentials, devices or Connected Accounts.

14.3Your responsibilities. Consistent with Section 9.5 of the Terms, Customers must keep their credentials confidential, use strong authentication, restrict access to Authorized Users, promptly revoke access for departing personnel and promptly report any suspected unauthorized access to security@vizs.ai [CONFIRM ADDRESS] or privacy@vizs.ai.

14.4Breach notification. If we become aware of a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data that we process (a "Personal Data Breach"), we will take reasonable steps to contain and investigate it and will notify affected Customers, individuals, and supervisory or other authorities (including the Israeli Privacy Protection Authority, where applicable) as and when required by applicable Data Protection Laws and the DPA. With respect to Customer Personal Data, we will notify the affected Customer without undue delay, and the Customer, as controller, is responsible for any notifications it is required to make to individuals and authorities. Notification of a Personal Data Breach is not an admission of fault or liability.

15. Data Retention and Deletion

15.1We retain personal data only for as long as necessary for the purposes described in this Policy, including to provide the Services, comply with legal, tax, accounting and regulatory obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. Indicative retention periods are:

Account Data. Retention: For the term of the account and up to [24] months thereafter, unless a longer period is required by law.

Customer Content and Customer Personal Data. Retention: For the term of the subscription; deleted or returned within [30/60/90] days after termination, subject to the DPA and the export rights in Section 16.4 of the Terms.

Credentials (OAuth tokens, API keys). Retention: Until the Connected Account is disconnected, access is revoked, or the account is terminated, after which they are deleted or invalidated within [30] days.

Billing and Transaction Data. Retention: As required by tax and accounting law (generally up to [7] years).

Communications and support data. Retention: Up to [3] years after the last interaction.

Security and audit logs. Retention: Up to [12-24] months, or longer where needed to investigate an incident.

Marketing data. Retention: Until you opt out or withdraw consent, plus a suppression record to honor your opt-out.

Data subject to legal hold. Retention: Until the relevant claim, investigation or legal obligation is resolved.

15.2Backups. Deleted data may persist in backup systems for up to [BACKUP RETENTION PERIOD] until overwritten in the ordinary course, during which time it remains protected and is not used for any other purpose.

15.3Deletion requests. Customers may delete Customer Content through the Services where the functionality is available, or request deletion by contacting privacy@vizs.ai. Deletion does not extend to content published to Third-Party Platforms (see Section 8.3), aggregated or de-identified data, or data that we are required or permitted by law to retain.

16. Your Privacy Rights

16.1General. Depending on where you live and subject to applicable exceptions, you may have the right to: (a) access the personal data we hold about you and receive a copy; (b) correct inaccurate data; (c) delete your data; (d) restrict or object to processing, including processing based on legitimate interests and for direct marketing; (e) data portability; (f) withdraw consent; (g) opt out of targeted advertising, sale or sharing of personal data, and profiling in furtherance of decisions with legal or similarly significant effects; and (h) lodge a complaint with a supervisory authority.

16.2How to exercise your rights. Submit a request to privacy@vizs.ai or via [PRIVACY REQUEST WEB FORM URL] [AND, IF REQUIRED FOR CALIFORNIA, A TOLL-FREE NUMBER - SEE NOTE]. We will verify your identity before fulfilling a request, using information reasonably matched to information we hold, and may decline requests we cannot verify. An authorized agent may submit a request on your behalf with proof of written authorization; we may require you to verify your identity directly. We will respond within the period required by applicable law (generally one month under the GDPR, extendable where permitted, and 45 days under the CCPA, extendable by 45 days). We may decline or limit requests that are manifestly unfounded, excessive or repetitive, or where an exception under applicable law applies, and will explain our reasons where required.

16.3Non-discrimination. We will not discriminate or retaliate against you for exercising your privacy rights.

16.4Appeals. If we decline to take action on your request, you may appeal by emailing privacy@vizs.ai with the subject line "Privacy Request Appeal." We will respond to appeals within the period required by applicable law. If you are dissatisfied with the outcome of an appeal, you may contact the attorney general or privacy regulator of your state.

17. Business Transfers

If VIZS is involved in, or is negotiating, a merger, acquisition, financing, due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of its assets or shares, or a transition of service to another provider, personal data may be disclosed to or transferred to the counterparty, successor or assignee as part of that transaction, subject to appropriate confidentiality obligations. The successor will be bound by this Policy with respect to personal data transferred, unless and until it is amended in accordance with Section 23.

18. Legal Requirements and Protection of Rights

We may access, preserve and disclose personal data, including Customer Content and communications, where we believe in good faith that doing so is necessary to: (a) comply with applicable law, regulation, subpoena, court order, search warrant or other legal process, or a lawful request from a governmental, regulatory or law-enforcement authority; (b) enforce or investigate potential violations of the Terms, this Policy or other agreements; (c) detect, prevent or address fraud, security or technical issues, or deceptive or unlawful content; (d) protect the rights, property or safety of VIZS, its officers, directors, employees, Customers, users or the public; or (e) establish, exercise or defend legal claims. Where legally permitted and reasonably practicable, we will seek to notify the affected Customer of a governmental request for Customer Content, and we may challenge requests we consider overbroad or unlawful.

19. Region-Specific Disclosures

19.1European Economic Area, United Kingdom and Switzerland

(a)Controller. AdGPT com Inc. is the controller for the processing described in Section 3.1.

(b)Representatives. Our EU representative under Article 27 GDPR is [EU REPRESENTATIVE NAME AND ADDRESS]. Our UK representative under Article 27 UK GDPR is [UK REPRESENTATIVE NAME AND ADDRESS].

(c)Data Protection Officer. [DPO NAME / CONTACT, OR STATE "We have not appointed a DPO because we are not required to do so; privacy inquiries may be directed to privacy@vizs.ai."]

(d)Complaints. You have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or place of the alleged infringement (in the UK, the Information Commissioner's Office). We encourage you to contact us first so we can try to resolve your concern.

(e)Provision of data. Provision of Account and Billing Data is a contractual requirement; without it we cannot provide the Services.

19.2California (CCPA/CPRA) — Notice at Collection and Privacy Notice

This section applies to residents of California and supplements the rest of this Policy. During the preceding 12 months, we have collected the following categories of personal information:

Identifiers. Examples: Name, email, phone, IP address, account IDs, social media handles. Sources: You; Connected Accounts; automatically. Business purposes: Providing Services; security; support; marketing. Disclosed to: Service providers; Third-Party Platforms at your direction; Marketplace participants.

Customer records (Cal. Civ. Code §1798.80(e)). Examples: Billing address, limited payment data (via Stripe). Sources: You; Stripe. Business purposes: Billing; fraud prevention. Disclosed to: Stripe; service providers.

Commercial information. Examples: Subscriptions, Order Forms, Marketplace transactions. Sources: You; our systems. Business purposes: Providing Services; accounting. Disclosed to: Service providers; Marketplace participants.

Internet or network activity. Examples: Usage, clickstream, logs, Cookies. Sources: Automatically. Business purposes: Analytics; security; improvement. Disclosed to: Service providers.

Geolocation (approximate). Examples: Location derived from IP address. Sources: Automatically. Business purposes: Security; localization. Disclosed to: Service providers.

Audio/electronic information. Examples: Call or meeting recordings (with notice). Sources: You. Business purposes: Support; quality. Disclosed to: Service providers.

Professional or employment-related information. Examples: Job title, employer, LinkedIn profile data. Sources: You; Connected Accounts; public sources. Business purposes: Providing Services; sales. Disclosed to: Service providers.

Inferences. Examples: Product-interest and engagement inferences about business users. Sources: Our analysis. Business purposes: Improvement; marketing. Disclosed to: Service providers.

Sensitive personal information. Examples: Account log-in and Credentials. Sources: You; Connected Accounts. Business purposes: Providing Services; security only. Disclosed to: Service providers (as needed to operate the Services).

(a)Retention. See Section 15.

(b)No sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising, as those terms are defined under the CCPA, and we have not done so in the preceding 12 months. [CONFIRM: if marketing pixels/retargeting are used, this statement must be revised and a "Do Not Sell or Share My Personal Information" link added.] We have no actual knowledge of selling or sharing the personal information of consumers under 16.

(c)Sensitive personal information. We use and disclose sensitive personal information only for purposes permitted under Cal. Code Regs. tit. 11, § 7027(m), and therefore do not offer a right to limit its use.

(d)Your rights. California residents have the right to know/access, delete, correct, and opt out of sale or sharing (although we do not sell or share), and the right not to be discriminated against for exercising those rights. See Section 16 for how to submit a request.

(e)Financial incentives. We do not offer financial incentives in exchange for personal information.

(f)Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes.

19.3Other U.S. States

Residents of states with comprehensive privacy laws (including, without limitation, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may have some or all of the rights described in Section 16, subject to the scope and exemptions of those laws, including exemptions for data processed in a business-to-business or employment context. We do not process personal data for targeted advertising, sale or profiling with legal or similarly significant effects [CONFIRM], and we do not process sensitive data without consent where consent is required. Nevada: we do not sell covered information as defined under Nevada law; Nevada residents may nonetheless submit an opt-out request to privacy@vizs.ai.

19.4Israel

To the extent the Israeli Privacy Law applies to our processing of personal data (including where personal data is processed in Israel, by personnel located in Israel, or in databases maintained in Israel), such processing is subject to the Israeli Privacy Law, including Amendment No. 13. Subject to the law, you have the right to review personal data about you held in a database and to request its correction or deletion if it is inaccurate, incomplete, unclear or not up to date, as well as the right under Section 17F of the Israeli Privacy Law to request removal from direct-mailing lists. You are not under a legal obligation to provide personal data to us; however, without certain data we cannot provide the Services. The purposes for which data is collected, and the recipients of data, are described in Sections 6 and 9. Requests may be directed to privacy@vizs.ai. [DPO OR PRIVACY CONTACT DESIGNATED UNDER THE ISRAELI PRIVACY LAW, IF REQUIRED.] You may also contact the Israeli Privacy Protection Authority.

19.5Other jurisdictions

If you reside in a jurisdiction not specifically addressed above, you may have rights under local law, and we will honor such rights as required by that law.

20. Children

The Site and Services are intended solely for business use by individuals who are at least 18 years of age and who have the legal capacity to enter into binding contracts. Individuals under 18 are not permitted to use the Services. We do not knowingly collect personal data from children under 18 (and in particular not from children under 13, within the meaning of the U.S. Children's Online Privacy Protection Act). If we learn that we have collected personal data from a person under 18, we will delete it promptly. If you believe that a minor has provided us with personal data, please contact privacy@vizs.ai. Customers must not submit personal data of children to the Services.

21. Governing Law, Dispute Resolution and Limitation of Liability

21.1Governing law. Consistent with Section 18 of the Terms, this Policy, our processing of personal data, and any and all disputes, claims, controversies or causes of action of any kind arising out of or relating to this Policy or to our processing of personal data (each, a "Dispute") are governed exclusively by the laws of the State of Israel, without regard to its conflict-of-laws principles, notwithstanding that the Company is incorporated in the State of Delaware.

21.2Exclusive jurisdiction and venue. THE COMPETENT COURTS LOCATED IN TEL AVIV–JAFFA, ISRAEL, HAVE SOLE AND EXCLUSIVE JURISDICTION OVER ANY AND ALL DISPUTES. ALL LEGAL MATTERS, CLAIMS, LAWSUITS, ACTIONS AND PROCEEDINGS OF ANY KIND RELATING TO A DISPUTE MAY BE BROUGHT ONLY IN SUCH COURTS AND IN NO OTHER COURT, TRIBUNAL OR FORUM IN ANY COUNTRY. You and we irrevocably submit and consent to the personal jurisdiction of those courts and irrevocably waive any right to any other venue or forum and any objection to venue in those courts, including any objection based on forum non conveniens.

21.3Jury trial and class action waivers; time limit. To the fullest extent permitted by applicable law: (a) any right to a trial by jury in any Dispute is waived; (b) Disputes may be brought only on an individual basis and not as a plaintiff, representative or class member in any class, collective, consolidated or representative action or proceeding; and (c) any Dispute must be commenced within one (1) year after the claimant knew or reasonably should have known of the facts giving rise to it, failing which it is permanently barred.

21.4Mandatory law. This Section 21 applies to the maximum extent permitted by law. If, and only to the extent that, a mandatory, non-waivable provision of applicable Data Protection Laws grants you a right that this Section purports to exclude (such as the right to lodge a complaint with a data protection supervisory authority), that right applies only to the minimum extent required, and the remainder of this Section, including the exclusive jurisdiction of the courts of Tel Aviv–Jaffa, remains in full force and effect.

21.5Informal resolution. Before initiating any proceeding concerning this Policy, you agree to first contact us at privacy@vizs.ai and to allow us thirty (30) days to attempt to resolve the matter informally, except where prohibited by law or where urgent injunctive relief is required.

21.6Limitation of liability. The disclaimers, exclusions and limitations of liability set out in Sections 13 and 14 of the Terms apply to any claim arising out of or relating to this Policy or our processing of personal data, to the maximum extent permitted by applicable law. Nothing in this Policy limits liability for fraud, willful misconduct, or any liability that cannot lawfully be excluded or limited, or any right of a data subject that cannot be waived under Data Protection Laws.

21.7Company obligations only. To the maximum extent permitted by applicable law, all obligations under this Policy are obligations of AdGPT com Inc. alone, and no shareholder, director, officer, employee or agent of the Company shall have any personal liability under or in connection with this Policy, except to the extent such liability cannot be excluded under applicable law.

21.8No third-party beneficiaries; no expansion of rights. This Policy is a notice of our practices. Except as required by Data Protection Laws, it does not create any rights in favor of any third party, nor does it expand any obligation of VIZS beyond those set out in the Terms, the DPA and applicable law.

22. Contact Us

Questions, requests and complaints regarding this Policy or our privacy practices may be directed to:

AdGPT com Inc. (VIZS.ai) Attn: Privacy Email: privacy@vizs.ai Address: [PRINCIPAL PLACE OF BUSINESS ADDRESS] [EU/UK representative contact details, if appointed]

23. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Services or the law. We will post the updated Policy on the Site and update the "Last Updated" date. If we make material changes, we will provide reasonable advance notice by email to the account owner, through the Services or by a prominent notice on the Site, before the changes take effect, and will obtain consent where required by law. Unless otherwise stated, changes take effect on the date stated in the updated Policy, and continued use of the Services after that date constitutes acknowledgment of the updated Policy, to the extent permitted by law. We will not apply material changes retroactively to personal data collected under a prior version without your consent where such consent is required by law.

24. Miscellaneous

24.1Severability. If any provision of this Policy is held invalid or unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect.

24.2Language. This Policy is provided in English and Hebrew. In the event of any inconsistency between the versions, the English version prevails, except where applicable law requires otherwise.

24.3Headings. Headings are for convenience only and do not affect interpretation. The words "including" and "include" mean "including without limitation."