Privacy Policy

The data controller is:

For anything about your data, write to privacy@visionswarm.it.

Controller. We decide how and why we process your account, payment, usage and contact data. This policy covers that processing.

Processor. For the material you upload and everything a simulation generates from it (agents, dialogues, reports, chats), you are the controller and we process it on your behalf and on your instructions, under the Data Processing Agreement you accept with the Terms of Service. If that material contains personal data of other people, you are responsible for having a legal basis to use it.

• Account: name, email address and account identifier, managed through Clerk. We never see or store your password.
• Payments: plan, subscription status, trial and renewal dates, the Stripe customer identifier; your VAT number or tax ID, billing address and payment method are collected and kept by Stripe. We never see your card number.
• Usage: credits used, number of simulations and agents, and a record of each AI call (model, tokens, cost) linked to the simulation.
• Simulations (processed as processor, section 2): the name, the question you ask, the source material, the generated agents, dialogues, knowledge graph, reports, your chats with agents and with the analyst, and, if you enable anonymization, the table that links masked values to the real ones.
• Contact form: name, email, and the company, role, reason and message you write.
• Support tickets: your message, its type, your email and plan, and, if you leave the option on, the page address, the simulation concerned and your browser and screen size.
• Company logo: the image you upload for your reports.
• Acceptance records: the date and version of the Terms of Service and this policy you accepted.
• Technical logs: application events with your account identifier, the requested address, the outcome and errors.

We do not process your data on the basis of consent, we do not use it for marketing, and we do not sell it or use it to train AI models.

We use these providers. Each processes data only to provide its part of the service.

We share data with authorities only when the law requires it.

To run a simulation, generate a report or answer in a chat, the relevant text is sent to the AI providers listed above through their business APIs. None of them uses API data to train its models. They keep requests and responses for a limited period for safety and abuse monitoring:

• Anthropic: Inputs and outputs are deleted within 30 days; up to 2 years if flagged for a usage-policy violation. Official page
• OpenAI: Abuse-monitoring logs are kept for up to 30 days. Official page
• Google (Gemini API, paid tier): Logged for a limited period for abuse detection, as set out in Google's terms. Official page

Anonymization (Pro and Business plans): names of people and companies, amounts and identifiers in your material are masked before the simulation runs, and restored in your report. To find them, the text is analysed once by an AI model. The table linking masked and real values stays on our servers and is deleted with the simulation.

Fictional names (on by default): people named in your material become characters with invented names, found the same way. The real names are not kept and do not appear in chats or reports.

Deleting your account deletes every simulation as above, your logo, your support tickets and the contact messages sent from the same email address.

We use only cookies needed for the service to work. We use no analytics, advertising or profiling cookies.

The app also saves a few preferences in your browser's local storage (theme, sidebar state, default agent numbers). They never leave your device. Booking a demo opens Cal.com, which applies its own cookie policy.

To count visits and see which pages and buttons are used, we use Vercel Web Analytics. It sets no cookies and stores nothing on your device: a visitor is recognised for at most 24 hours through a hash of the request, and we only see aggregate figures (pages viewed, referrers, country, device type, clicks on the main buttons), never who you are.

You can ask us to:

• access your data and receive a copy (Settings, Data & account, lets you download it yourself)
• correct inaccurate data
• delete your data (you can delete simulations and your account yourself in the app)
• restrict processing
• receive your data in a portable format
• object to processing based on our legitimate interest

Write to privacy@visionswarm.it. We answer within one month. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

The measures in place today:

• All traffic is encrypted with HTTPS (TLS).
• Every request is checked against your signed-in session on the server, and every simulation, report and chat is available only to the account that created it, including the live updates channel.
• Cached AI answers are kept separate for each simulation and deleted with it.
• The servers accept connections only for the website, the API and administration; the database and the application are not reachable from the internet directly.
• The in-memory store is password-protected. It also writes its contents to the server's disk so they survive a restart; entries expire on their own and are deleted together with the simulation they belong to.
• Request rate limits, protective HTTP security headers, and monitoring of AI usage with automatic alerts.

When this policy changes, its version and date change, and we ask you to review it before you continue using the service.