Privacy Policy

1. Who Controls Your Information

Structured Visibility Systems Limited is the controller of the personal information described in this policy, except where we act as a processor on behalf of a customer (for example, business information a customer asks us to publish on their behalf).

2. The Information We Collect and Where It Comes From

Directly From You

• Contact details: name, email address, business name
• Business information you enter into StructuredAF to generate your structured data (services, courses, credentials, expertise, and similar)
• Messages you send us via email or our contact form
• Payment confirmation details from Creem (we don't receive or store card information)

Automatically, When You Use Our Website or App

• IP address, approximate location, browser and device information
• Pages visited and how you interact with our site and app
• Cookies and similar technologies, only where you've consented (see Section 8)

From Our Recognition Report Tool

When you use our free Recognition Report tool, we analyse publicly available information on the domain you submit in order to generate your results.

3. How We Use It and Our Lawful Bases

Purpose	Lawful basis
Create and administer your account	Contract
Provide the subscribed Service, including generating and delivering your structured data	Contract
Transactional and service messages (setup, billing, support replies)	Contract
Legal, tax and accounting records	Legal obligation
Security, fraud prevention and keeping the Service running	Legitimate interests
Optional analytics and advertising technologies	Consent
Newsletters and marketing emails	Consent
Improving the Service using aggregated, anonymised usage data	Legitimate interests

Where we rely on legitimate interests, we've considered that interest against your rights and freedoms before relying on it.

4. Information You Choose to Publish Publicly

StructuredAF is designed to publish selected business and professional information on your website, so that it can be read by AI systems, search engines and visitors. If you're a sole trader or run a personal brand, some of that information may be personal data about you.

If the information you provide includes personal data about someone else, such as a team member, client, or reviewer, you're responsible for having their permission, or another lawful basis, to include and publish it. See our Terms of Service for the full requirement.

5. Who Receives Information

We share information with the following providers, each of whom is only permitted to use it for the purposes described.

Provider	Purpose	Data involved	Role
Supabase	Account and application storage	Account, business and usage data	Processor, EU region
Bento	Email marketing and on-site behavioural tracking	Contact details, preferences, engagement data	Processor
Creem	Purchase, tax, subscription and refund administration	Purchase and billing information	Merchant of Record, subject to its own buyer terms
Kinsta / Sevalla	Website and application hosting	Technical logs, hosted data	Processor
Google Cloud Platform	Underlying infrastructure used by our hosting providers	Technical logs	Subprocessor of Kinsta / Sevalla
Analytics and advertising providers (Google, Meta, Bing)	Measurement and advertising	Device, cookie and usage information	Only activated after consent, see Section 8

Where a provider processes personal data on our behalf, our agreement with that provider includes data-protection obligations appropriate to the services it provides.

Customer Support

All customer support is handled directly via email by a real human. We do not use third-party helpdesk software or AI chatbots.

We Never Sell Your Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. International Transfers

Some of our providers may process information outside the UK, including in the United States and the European Union. Where this happens, appropriate safeguards recognised under UK data protection law are in place for that transfer.

7. How Long We Keep Information

Data	Retention
Active account and business data	For the duration of your subscription, then a further 30 days after expiry or cancellation
Database backups	Up to 7 days, in line with our hosting plan's backup cycle
Support correspondence	For as long as reasonably necessary to resolve your enquiry and for a short period afterwards for reference
Analytics data	According to the default retention settings of each analytics tool
Marketing subscribers	Until you unsubscribe or opt out
Unsubscribe record	Kept as a suppression record, so we don't email you again
Purchase and accounting records	For the period required for tax, accounting and legal purposes

The right to erasure isn't absolute. We may retain information where it remains necessary for a legal obligation, a legal claim, fraud prevention, or another lawful purpose. Deleting information we need to provide the Service may require us to close your account, since StructuredAF cannot function without your business data.

8. Cookies and Marketing

We use a consent management tool that blocks non-essential cookies and tracking scripts until you actively consent to them. Nothing in the Analytics or Marketing categories below runs before you make a choice.

Essential

Required for the website and application to function. These can't be switched off.

Analytics (consent required)

Google Analytics and Bento's on-site tracking script, used to understand how our site and content are used. Google Analytics runs in a restricted, cookieless mode until you consent, then switches to full measurement.

Marketing (consent required)

Meta Pixel, Google Ads, and Bing Ads, used for advertising and retargeting.

You can change your cookie choices at any time using our cookie preferences tool, usually available via a small icon on the page, or by clearing cookies in your browser. For a full, up-to-date list of the specific cookies in use, see our Cookie Policy, which is generated automatically from our current cookie settings.

9. Security

We use appropriate technical and organisational measures designed to protect personal information, taking account of the nature of the data, the risks involved and the available technology. No system can be guaranteed completely secure.

If a personal data breach occurs, we'll notify the ICO within 72 hours where the legal threshold for reporting is met, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

10. Your Rights and Complaints

Your Rights Under UK GDPR

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your personal data, subject to the limitations in Section 7
• Restriction: Request we limit how we use your data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent for marketing or cookies at any time

To exercise any of these rights, contact privacy@structuredaf.com. We normally respond within one month.

Automated Decision-Making

We do not make solely automated decisions about you that have a legal or similarly significant effect. StructuredAF is a human-first company, a real person reviews anything that matters.

Complaints

If you're not satisfied with how we've handled your information, you can contact us first at privacy@structuredaf.com, or make a complaint directly to the Information Commissioner's Office (ICO) at ico.org.uk.

11. Children

We do not knowingly collect personal information from children under 16. Our services are designed for business owners and entrepreneurs. If you believe we've collected information from a child under 16, please contact us immediately.

12. Changes and Contact

We may update this policy to reflect changes in our practices or legal requirements. We'll notify you of significant changes and update the date at the top of this page.