Privacy Policy

Who we are

V Turn AI ("we", "us") provides a visibility intelligence platform that analyses websites and measures brand visibility across search engines and AI answer engines. This policy explains what data we handle and why.

For any privacy question, write to support@vturnai.com.

Data we collect

• Account data: your name, email address and hashed password, managed by our authentication provider. We never store your password in a readable form.
• Project data: the website addresses, brand names, business descriptions, target countries, audiences and competitors you enter.
• Crawl data: publicly accessible content from the websites you add, including page HTML, metadata, headings, structured data, links and text. We only fetch what any search engine could fetch.
• Measurement data: the prompts you track, the answers returned by AI engine APIs, and the metrics derived from them.
• Integration data: metrics retrieved from services you connect, such as Google Search Console, Bing Webmaster Tools, Google Analytics 4 and PageSpeed Insights.
• Billing data: subscription status and payment events from Razorpay. We never receive or store your card details.
• Operational data: audit logs, usage counters and error records needed to run the service securely.

How we use your data

• To crawl and analyse the websites you have added to your account.
• To measure and report your visibility across search and AI answer engines.
• To generate prioritised recommendations and reports.
• To enforce plan limits and prevent runaway third-party API costs.
• To send service notifications such as scan completion, critical issues, trial expiry and payment failures.
• To secure the service, investigate abuse and diagnose faults.

Websites you analyse

You must have the right to analyse any website you add. Our crawler identifies itself honestly as VTurnAIBot, respects robots.txt directives by default, applies crawl delays, and never attempts to access authenticated, private or internal resources.

We block requests to private networks, loopback addresses and cloud metadata endpoints, and we validate DNS resolution before every fetch so the crawler cannot be used to reach internal infrastructure.

Third-party services we send data to

• AI engine providers (OpenAI, Google, Anthropic, Perplexity, xAI and, where enabled, Microsoft): we send the prompt text you configured plus your brand and domain so the answer can be analysed. We do not send your account credentials.
• Google (Search Console, Analytics, PageSpeed Insights): accessed with the scopes you authorise.
• Bing Webmaster Tools: accessed with the API key you supply.
• Razorpay: handles subscription payments and receives the billing details you enter directly with them.
• Supabase: hosts our database and authentication.
• Vercel: hosts the application.
• An email provider, only if one is configured, for notification emails.

How we protect credentials

OAuth tokens and third-party API keys are encrypted at rest with AES-256-GCM before being written to the database. The table holding them is unreadable to every browser-facing database role; only server-side code holding the encryption key can decrypt them.

We never expose AI provider keys, database service-role keys, payment secrets or OAuth client secrets to the browser, and no API response returns a stored token.

Data retention

• Crawl and measurement data is retained while your account is active so you can see trends over time.
• Deleting a project deletes its crawl data, prompts, AI runs, opportunities and reports.
• Deleting your account removes your profile, projects and stored credentials. Billing records are retained where we are legally required to keep them.
• Audit logs and error records are retained for a limited period for security and diagnostic purposes.

Your rights

You can access, correct, export or delete your data from within the application, or by contacting us. Where a legal basis of consent applies (for example marketing email), you can withdraw it at any time without affecting your use of the service.

Cookies

We use only the cookies required to keep you signed in and to remember your theme preference. We do not use advertising cookies and we do not sell personal data.

Changes to this policy

If we make a material change we will update the effective date above and notify account holders in the application before the change takes effect.