Privacy Policy

1. Who we are

vioscaleAI (“vioscaleAI”, “we”, “us”) operates the independent, evidence-based software-intelligence platform at www.vioscale.ai and the separate vendor portal at account.vioscale.ai. We are the controller of the personal data described in this policy.

• General and privacy contact: support@vioscale.ai
• Registered company: Vioscale Technologies Ltd (registered in England and Wales, company number 14751646)
• Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Data protection contact: you can reach us on any data protection matter at support@vioscale.ai. We have not appointed a statutory Data Protection Officer; data protection matters are handled by our privacy team.
• Article 27 representative: Vioscale Technologies Ltd is established in the United Kingdom, so a representative under Article 27 of the UK GDPR is not required.

2. What we collect, how, and why

We keep data collection deliberately narrow. We process the following categories of personal data:

a. Account data

For developer and API accounts, and separately for vendor accounts, we store your email address, an optional display name, a scrypt hash of your password (we never store the password itself), and the timestamp at which your email was verified. We collect this directly from you when you register, to create and secure your account.

b. Vendor claim and submission data

When a vendor claims a software listing, we process the software being claimed, domain-verification tokens used to prove control of the associated domain, and an append-only audit log of profile edits. This lets us verify legitimate control and preserve the integrity and provenance of the record.

When a vendor submits new software, we store what they submit (the product name, homepage, category, description, links, and logo) and the account that submitted it. If they pay the fast-track review fee, we also keep a record of that payment: the amount, when it was paid, the review deadline it set, and Stripe’s reference for it. We keep this to meet the deadline, to answer questions about the payment, and for our accounting records.

c. API-consumer data

For API access we store a hash of each API key (never the key in clear text), your credit balance, and usage events. This is needed to authenticate requests, meter usage, and bill or rate-limit fairly.

A usage event records the endpoint or tool called, the time, how long it took, how many results came back and which products they were, and the search terms and filters you sent, stored as you wrote them. We keep these to see what people are trying to find, to decide what to index next, and to investigate abuse. Please write a query as you would a search, and do not include confidential details or personal information about yourself or anyone else in it. These events are kept for the period in Section 4 and are never sold or shared for anyone else's purposes.

The same applies when you reach us through an AI assistant rather than directly. Our MCP server is how assistants such as Claude and ChatGPT query vioscaleAI, and a call that arrives through one is recorded in the same way, labelled as coming from that channel. We receive the query the assistant sends and the credential it signed in with; we do not receive your conversation with the assistant, and because the assistant's own servers make the call, the network address we see is theirs rather than yours.

d. Our own measurement of how the site is used

We measure how every visitor uses the public site. This first-party measurement is part of how the service works and is funded, so it applies to everyone who uses the site and is not controlled by the cookie banner. It uses no cookies and reads nothing stored on your device.

When you view public pages or call the API, our servers receive your IP address and User-Agent string as part of the request. We do not retain the raw IP address: before storage it is combined with the User-Agent and replaced with a keyed hash (HMAC-SHA256, truncated), so the stored identifier cannot be reversed to your IP. Alongside that hash we record:

• page views of software profiles, comparisons and alternatives pages;
• listing impressions: which products were shown to you on a category page;
• outbound clicks: when you click through to a vendor’s own website, the product you clicked;
• searches and API usage;
• the country you are in, but not your city or precise location. We keep the country instead of your IP address, not as well as it.

We use this to understand how the site is used, keep it secure, decide what to index and build next, give software vendors reports on how often their products are viewed and clicked, and sell advertising on the site. Vendors and advertisers only ever receive aggregated statistics, such as how many people viewed a product or category in a given country. They never receive the pseudonymous identifier or anything else that identifies you, and we do not sell this data or share it with third parties for their own purposes.

If you use the evaluation assistant, we store the question you asked exactly as you wrote it, together with the products we showed you and whether you downloaded the result. We use this to see what people are trying to choose and to decide what to index and build next. Please do not include confidential details or personal information about yourself or anyone else in the question; write it as you would a search.

e. Google Analytics and Microsoft Clarity (only with your consent)

If you accept analytics in the cookie banner, we also use Google Analytics to measure which pages are visited and how people arrive at them, with its advertising features turned off, and Microsoft Clarity to see how pages are used, such as clicks, scrolling and session replays. Clarity masks form inputs, numbers and email addresses, and we mask the evaluation assistant’s conversations in full, so what you type there is not sent to Microsoft. Neither is loaded unless you accept them (see our Cookie Policy).

3. Legal bases (UK GDPR, DPA 2018, and EU GDPR)

Our lead data protection framework is the UK GDPR together with the Data Protection Act 2018. Where the UK GDPR, or the EU GDPR for individuals in the EU or EEA, applies, we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b)): creating and operating your developer, API, or vendor account, providing the vendor portal, and delivering API access you have requested.
• Legitimate interests (Article 6(1)(f)): our own measurement of how the site is used (Section 2d), including aggregated reporting to vendors and the sale of advertising based on aggregated audience statistics; securing the platform against abuse and attack; and improving the product. We have weighed these interests against your rights and freedoms. Because the IP address is stripped before storage, no cookie is used, nothing identifying is passed to vendors or advertisers, and the data is used in aggregate, we consider the impact on you to be low and not to override your interests. This measurement is a condition of using the public site; if you do not want it, please do not use the site. You may still object (see Section 6), and we will consider any objection as the law requires.
• Consent (Article 6(1)(a)): Google Analytics and Microsoft Clarity, and the cookies they set (Section 2e). You can withdraw consent at any time from the Cookie settings link in the footer, without affecting the lawfulness of processing before withdrawal.
• Legal obligation (Article 6(1)(c)): where we must retain or disclose data to comply with applicable law, such as tax, accounting, or a lawful request from an authority.

4. How long we keep it (retention)

We keep personal data only as long as necessary for the purpose it was collected. Our retention policy is as follows.

• Account and profile data: retained for the life of the account and for 24 months after the account is closed, after which it is erased or anonymised. During the period following closure the data supports recovery and helps prevent abuse.
• Analytics, consent-log, and API or MCP usage events (including the search terms and filters sent with a call): retained for 14 months, after which events are deleted or further aggregated.
• Transactional email logs: retained for 12 months to support deliverability, security, and account-related record-keeping.
• Vendor claim and edit audit logs, raw crawl snapshots, and published source evidence: retained for as long as the related fact remains published, since provenance is part of the product and preserves the integrity of the public record.
• Hashed API keys: retained until the key is revoked, after which the hash is removed subject to any short reconciliation window for billing and security logs.
• Payment records (subscriptions and one-off fees such as fast-track review): retained for 6 years after the end of the financial year in which the payment was made, as UK tax and company law requires.

5. Sharing and processors

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We run no third-party advertising trackers, and we take no vendor payment that affects data handling or ranking. We use a small number of service providers acting as processors on our instructions: our hosting and infrastructure providers (Vercel, Neon, Upstash and Amazon Web Services), which run the site and store its data, including the measurement data in Section 2d; our email provider (Resend, when configured) to send transactional and verification email; and our payment processor (Stripe) to take and manage API payments, subscriptions, and one-off fees such as fast-track review. Card details are handled by Stripe and never reach our servers. Processors are bound by contract to protect the data and use it only as we direct. We give software vendors, and in future advertisers, aggregated statistics only (for example, how many people viewed a product or category in a given country), never personal data. If you accept analytics, we also use Google Analytics and Microsoft Clarity to see how the site is used; Google and Microsoft handle that data under their own privacy policies, as described in our Cookie Policy.

6. Your rights

Depending on your location, you may have the right to: access a copy of your data; rectify inaccurate data; erase your data; restrict processing; port your data to another provider; object to processing based on legitimate interests; and withdraw consent at any time. Where the UK or EU GDPR applies, you also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the UK Information Commissioner’s Office (ICO), ico.org.uk. If you are in the EU or EEA, you may also lodge a complaint with your local supervisory authority.

To exercise any of these rights, use our data request page or email support@vioscale.ai. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your rights.

7. California privacy rights (CCPA/CPRA)

If you are a California resident, this section applies to you. In the preceding 12 months we have collected the following categories of personal information: identifiers (such as email address and a keyed hash derived from your IP address and User-Agent); internet or network activity (page views, listing impressions, outbound clicks, searches and API-usage events, User-Agent); approximate location (country only); and account credentials in hashed form. We collect these for the business purposes described above.

We do not sell or share your personal information. Under the CCPA and CPRA you have the right to know what we collect, to delete it, to correct it, and to limit the use of sensitive personal information. Because we do not sell or share personal information and do not use sensitive personal information for purposes that trigger the limit-use right, there is nothing to opt out of, but you may still exercise your other rights.

Do Not Sell or Share My Personal Information: vioscaleAI does not sell or share your personal information, so no opt-out action is required. We honour these rights without discrimination.

8. International data transfers

Where personal data is transferred outside the EEA, the UK, or your home jurisdiction, we rely on an approved transfer mechanism, such as an adequacy decision or the Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), together with any supplementary measures needed to protect your data.

9. How we protect your data

We apply security measures appropriate to the risk. Passwords are stored as scrypt hashes, never in clear text. Session cookies are httpOnly and HMAC-signed. The raw IP address is stripped and replaced with a keyed HMAC hash (over the IP and User-Agent) before any analytics record is stored. API keys are stored only as hashes. In the event of a personal data breach likely to result in a risk to your rights, we are committed to notifying the relevant supervisory authority and affected individuals without undue delay and in line with applicable law.

10. Children

The service is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the effective date above and, where appropriate, notify you. Your continued use of the service after an update constitutes acceptance of the revised policy.