1. Who we are
VisibleGen is operated by One Network Solutions Limited ("VisibleGen", "we", "us", or "our"). We provide website auditing, search-performance analytics, AI visibility monitoring, competitive research, and related reporting tools.
Questions or privacy requests may be sent to [email protected].
2. Information we collect
- Account and workspace information: your name, email address, authentication records, workspace membership, and preferences.
- Website and project information: domains, URLs, crawl results, page content needed for analysis, configured competitors, keywords, reports, and project settings.
- Google Search Console data: only after you authorize access, we receive the verified properties available to your Google account and search-performance data such as dates, pages, queries, countries, devices, clicks, impressions, click-through rate, and average position.
- Google Analytics data: only after you authorize access and select a property, we read property and account names plus aggregated website metrics such as sessions, users, page views, engagement, acquisition channels, and landing pages.
- YouTube data: only after you authorize your own channel, we receive channel identifiers and metadata, a bounded sample of public owned-video metadata and lifetime counters, and aggregate video performance for a requested 28-day period.
- Bing Webmaster Tools data: only after you authorize read-only access and select a verified site, we receive Bing search clicks, impressions, top queries and pages, crawl statistics and issues, index counts, and sitemap status.
- Microsoft Clarity data: only after you provide a Data Export API token, we receive aggregate behavior analytics such as sessions, users, engagement, scroll depth, popular URLs, acquisition dimensions, and frustration-event counts. VisibleGen does not import Clarity recording playback or heatmap images.
- Advertising account data: only after you separately authorize Google Ads or Meta Ads and select an account, we receive account metadata and aggregate reporting such as spend, impressions, reach, clicks, attributed actions and value, campaign performance, platforms, devices, networks, search terms where available, and geographic performance. VisibleGen does not create or modify campaigns.
- Usage and device information: IP address, browser and device attributes, request logs, timestamps, error reports, and security events.
- Billing information: subscription and transaction status from our payment provider. VisibleGen does not store complete payment-card numbers.
- Content Studio information: the briefs, instructions, evidence notes, URLs, drafts, version history, approvals, and provider/model metadata you save or generate in the Content Studio.
- Communications: messages, support requests, and feedback you send to us.
VisibleGen browser extensions
Guest mode does not require an account. When you enable search panels, automatic result loading is on by default and sends result domains and the selected market to VisibleGen; you can turn it off in extension Settings. Guest access defaults to 20 distinct domain previews per browser per UTC day, subject to the configured domain cap and a shared research budget. An anonymous browser credential is stored locally and only its hash is stored on the server, with a 30-day expiry. Guest research is isolated from account workspaces and encrypted, with provider content expiring within 24 hours. Temporary daily quota markers prevent repeated requests from resetting the allowance. Clearing browser storage does not guarantee additional access; abuse controls and shared spending caps apply.
Connecting an account is optional. The extension opens VisibleGen sign-in and asks you to approve research access for your current workspace. A short-lived, one-use connection request exchanges a browser-held proof for a research-only installation credential; your account login credential is not shared with the extension. Connected accounts have no daily domain-metric preview-count limit, while spending ceilings and other tool allowances still apply. Disconnecting revokes the installation credential.
The SEO companion extension stores its service connection token, settings, selected market, and saved domains and keywords in your browser. You can remove saved items, export them as CSV, disconnect the service, or uninstall the extension. CSV files you export are under your control; removing an item in the extension does not remove a previously downloaded file.
Search panels are enabled by you for Google and Bing. Requested research sends result domains, public page URLs, selected markets, and requested search terms to your connected VisibleGen service. Automatic result-domain loading is on by default after you enable search panels; you can turn it off in extension Settings. Tracking query parameters and URL fragments are removed before a public-page research request. The active-page check runs locally after your action and does not upload the page body, browser cookies, or your website session credentials.
Provider-backed research uses Aisa and its upstream SEO data service, Semrush, to obtain domain and keyword estimates. These requests contain the public research target and selected market, not your VisibleGen password or browser connection token. Provider API keys stay on our server. Third parties may process requests under their own terms and privacy policies. Traffic figures are estimates and may cover a parent domain; unavailable coverage is identified rather than invented.
Hosted connections, when activated, are tied to your account and current workspace membership. Connection tokens are stored as hashes on the server, expire after 30 days, and can be revoked in Account settings → Browser extensions. Research payloads are encrypted in a cache scoped to that workspace, expire within 24 hours, and are removed by scheduled cleanup. Report handoff links contain an opaque reference, expire after 10 minutes, and require the originating account and workspace; they do not contain your access token. We receive the IP address and necessary request/security metadata when your browser contacts the service, for delivery and abuse prevention. We do not sell extension data, use it for unrelated advertising or credit decisions, or collect click, scrolling, or keystroke analytics through this extension.
Restricted database recovery backups follow the existing six-day rotation. Before a restored backup returns to service, extension research payloads and connection tokens must be removed, and provider access remains paused until spending and service access are checked again. Disconnecting a browser stops its service access; research-cache expiry and cleanup still apply. Contact [email protected] for an account or workspace deletion request. This companion beta can also connect to a local app or a compatible service you choose; that service's storage and retention practices apply to requests it receives. Public hosted research is not available until the hosted connection is activated.
3. How we use information
We use information to:
- provide, secure, maintain, and improve VisibleGen;
- crawl authorized websites and produce audits, analytics, alerts, and reports;
- authenticate users, administer workspaces, and prevent abuse;
- send the text, instructions, and evidence notes you explicitly submit to the AI provider you select when you request generation or writing assistance, and retain the resulting draft and evidence record for your review;
- process subscriptions and provide customer support;
- send service-related notices and communications you request; and
- comply with applicable law and enforce our Terms of Service.
4. Google API data
Each integration is optional. VisibleGen requests https://www.googleapis.com/auth/webmasters.readonly when you connect Search Console, https://www.googleapis.com/auth/analytics.readonly when you separately add Google Analytics, and https://www.googleapis.com/auth/adwords when you separately connect Google Ads. Search Console and Analytics permissions cannot modify those properties. Google does not offer a narrower reporting-only Ads OAuth scope: the Ads permission can allow changes for a Google user with edit access, but VisibleGen uses it only for reporting and does not provide campaign-creation or campaign-editing controls.
Connected Google reports and OAuth tokens are not automatically sent to our third-party AI services. Our separate AI writing tools process the text and instructions you submit when you request writing assistance. We do not use imported Google data to train general-purpose AI models. We do not access Gmail, Drive, Google Photos, or other Google Workspace content through these integrations.
Google data is available only to authorized members of your workspace and the infrastructure needed to deliver these features. Human access by our personnel is limited to your explicit consent for specific data, security investigations, or legal obligations. Google data is not shared for independent analytics, marketing, advertising, or a service provider's own purposes. Any transfer associated with a business sale or merger requires your explicit prior consent, as required by Google's Limited Use rules.
We use Google data only to provide the Traffic Analytics, website-engagement, search-opportunity, paid-search intelligence, and owner-authorized YouTube channel/video analytics features you request. Google Ads snapshots may include account identifiers, campaign performance, search terms, devices, networks, and geographic performance. We do not sell Google user data, use it to place advertising, transfer it to data brokers, or use it to train generalized advertising or AI models. Access and refresh tokens are encrypted at rest and are never exposed to other VisibleGen customers.
Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
Atlas for WordPress
Atlas for SEO & GEO is a WordPress plugin operated by One Network Solutions Limited. Its core SEO features run entirely on your own website. The optional features below use the Atlas service at atlas.visiblegen.com.
Connecting a site. When a site administrator clicks "Connect to Atlas", the site sends its address, site name, and WordPress and plugin versions to Atlas and receives an access key, which is stored encrypted on that website. Disconnecting revokes the key.
AI tools. When you click an Atlas AI tool (for example Optimize, FAQ, Key takeaways or Social posts), the post's title, text, focus keyword and, for Optimize, its SEO title and meta description are sent to Atlas, which uses Anthropic's Claude to generate suggestions. We keep a usage record (tool, token counts, credits charged) but not the post text. Google data is never sent to AI providers.
Google Search Console in Atlas. When a site administrator connects Search Console from the Atlas dashboard, Atlas requests the scopes openid, email and https://www.googleapis.com/auth/webmasters.readonly. We store the Google account email (to show which account is connected) and encrypted access and refresh tokens, linked to that WordPress site. Atlas reads aggregated performance data (clicks, impressions, click-through rate, average position, top queries and pages) for the matching property, limited to that site's pages, and shows it on the Atlas dashboard in that site's WordPress admin, which only its administrators can open. A summary is cached on Atlas for up to 6 hours and on the WordPress site for up to 3 hours; we do not keep a historical archive. Disconnecting asks Google to revoke access and deletes the stored tokens and cached summary from Atlas. The Google-data restrictions in section 4, including Limited Use, apply to Atlas.
Hosting. Atlas data is hosted in Germany.
YouTube channel and video analytics
VisibleGen uses YouTube API Services for this optional connection. Before connecting, you must agree to this Privacy Policy and the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
Before starting Google authorization, we record your explicit acknowledgements with your user, workspace and project identifiers, the acceptance time, and the displayed policy and collection-notice versions. These records identify the notices you accepted; Google authorization and your selected channel determine the read access enabled for this connection.
The connection uses https://www.googleapis.com/auth/youtube.readonly and https://www.googleapis.com/auth/yt-analytics.readonly to read an owner-authorized channel. These scopes permit read access to your YouTube account data; VisibleGen retains public owned-video samples only and excludes private, unlisted and unavailable videos. The connector does not upload, edit or publish videos.
We retain the channel ID, name, handle and uploads-playlist identity, supported channel lifetime counters, and one page of up to 25 owned uploads. Retained public-video records include IDs, titles, source links, publication dates and supported lifetime counters. Video performance reports request the last 28 completed days in Pacific time and include aggregate views, watch time, average view duration, likes, comments, shares and subscriber changes. Lifetime counters remain separate from this period; reports may lag and the sample does not establish complete channel-library coverage. When collection is enabled, connected channels can refresh weekly and when you choose Sync or Collect videos.
We check that Google authorization remains valid at least twice daily, separately from weekly video collection. These credential checks do not collect new video or performance data. Retained YouTube reports are hidden when current authorization cannot be confirmed; expired or invalid authorization requires you to reconnect.
Channel metadata expires 23 days after its latest successful Google channel read; each video/analytics sample expires 23 days after collection. Authorization checks do not extend these data-retention periods. Expired evidence is hidden from reports and hourly cleanup removes expired records, including expired connections and their encrypted credentials. Disconnecting YouTube in Social Profiles requests Google revocation and deletes its local credentials and associated metric snapshots from the active database. Google revocation can also invalidate other VisibleGen YouTube connections authorized by the same Google account; those connections may need to reconnect. If revocation is not confirmed, local removal still completes and VisibleGen directs you to your Google Account permissions to revoke access directly. Disconnecting does not delete videos on YouTube. Restricted recovery backups follow the scheduled 6-day rotation. Before a restored backup returns to service, its YouTube connections, credentials, acknowledgements and metric samples must be removed; reconnection requires fresh owner authorization.
YouTube data is used for the connected Social analytics features and follows the Google-data access, sharing and AI restrictions above. It is not automatically sent to AI providers by this connector or used to train general-purpose AI models.
5. Bing Webmaster Tools data
VisibleGen requests the Bing Webmaster Tools read-only scope (webmaster.read). It cannot submit URLs, edit site settings, or otherwise manage your Bing property. OAuth access and refresh tokens are encrypted at rest and are deleted from VisibleGen when you disconnect the integration.
We use Bing data only to provide the connected search-performance, crawl-health, index-coverage, and sitemap features you request. We do not sell this data or use it for advertising.
6. Microsoft Clarity data
When you connect Microsoft Clarity, the project Data Export token is encrypted at rest and used only to request aggregate analytics for your project. VisibleGen stores the resulting aggregate snapshots, not session-recording content, DOM playback, keystrokes, or heatmap images. The token and cached snapshots are deleted when you disconnect Clarity or delete the VisibleGen project.
You are responsible for configuring Clarity consent, masking, and disclosures on the monitored website and for following Microsoft's eligibility and privacy requirements. Do not use Clarity on websites or applications directed to people under 18.
7. Meta Ads data
VisibleGen requests Meta's ads_read permission only. It is used to list ad accounts available to the authorizing user and import aggregate reporting for the account you select. VisibleGen does not request ads_management and cannot create, edit, publish, or delete Meta campaigns.
Meta access tokens are encrypted at rest and are never returned to the browser after authorization. Cached reporting and the token are deleted when you disconnect Meta Ads or delete the project. Meta Ads data is not sold, used to place advertising, transferred to data brokers, or used to train generalized advertising or AI models.
Native Facebook and Instagram connections
These optional integrations retain the managed Pages and professional accounts you select, granted permissions, encrypted access credentials, profile metadata, published-post metadata and aggregate account and post analytics. VisibleGen uses these records to show your connected analytics and publish the drafts you explicitly approve.
business_management discovers authorized Business Manager assets; pages_show_list and pages_read_engagement identify and read managed Pages; instagram_basic identifies the selected professional account. read_insights and instagram_manage_insights read native analytics. Although Meta’s Business Manager permission allows broader actions, VisibleGen uses it for discovery and offers no business-administration actions in this connection flow.
pages_manage_posts and instagram_content_publish publish supported content to the account selected on an approved calendar draft. Approving a draft authorizes publication. This flow requests no private-message permission. Removing the connection does not remove posts already published on Meta.
Native analytics retain their provider metric names and reporting periods. Missing or empty observations are distinct from measured zero. Connected Meta reports and credentials are not automatically sent to AI providers by these analytics features, sold, or used to train general-purpose AI models.
Removing an account in Social Profiles deletes its local credentials and associated metric snapshots from the active database. Calendar drafts and publication records can remain; contact [email protected] to request deletion of these records. Recovery backups follow the scheduled 6-day retention period; deletion must be reapplied after a restoration. Revoke Meta-side access separately in Meta’s Business Integrations settings.
Native social records and recovery backups are hosted in Germany. Authorized administrator access is from Pakistan. Infrastructure providers may also process data under their applicable agreements; server location alone does not describe every provider support location.
8. Sharing and service providers
We do not sell personal information. We may share limited information with:
- hosting, infrastructure, email, analytics, security, and customer-support providers acting on our instructions;
- payment processors for subscriptions and fraud prevention;
- AI or search-data providers when you enable a feature that requires them, subject to the feature's disclosed settings;
- professional advisers and authorities where reasonably necessary to comply with law, protect rights, or investigate abuse; and
- a successor in a merger, acquisition, financing, or sale, subject to appropriate confidentiality protections.
These general categories do not override the stricter Google-data restrictions in section 4.
9. Retention and deletion
We retain account and project information while your account or workspace remains active and as reasonably necessary for the purposes described here. Retention periods may also reflect security, backup, billing, dispute-resolution, and legal requirements.
Content Studio assets retain their current draft, immutable version history, approval record, and any evidence notes submitted for generation while the asset exists. Evidence notes are user-supplied context, not independently verified facts, and generated drafts still require human review. Permanently deleting an individual asset removes its active record and saved versions from the active database. Removing a project from the dashboard may leave project records in a recoverable state; contact us to request permanent project or account deletion.
We retain imported Search Console performance rows while the project remains connected. Google Analytics reports are read on demand; we do not retain a historical event-level Analytics dataset. Google Ads retains the latest aggregate report snapshot, normally refreshed every six hours, rather than a growing archive of snapshots. Temporary Google report caches expire within one hour (Analytics realtime reports within 45 seconds).
Disconnecting Search Console removes that project's stored Search Console/Analytics OAuth credentials and imported Search Console rows from the active database. Disconnecting Google Ads removes its credentials and report snapshot. Deleting a website or workspace also removes those local Google credentials and imported reports, even if the website or workspace can later be restored; reconnecting then requires new authorization. We clear known report caches during deletion; any already-running response can remain in an expiring cache for no longer than one hour. Data on Google's own services is not deleted by these actions.
Database backups run daily with a scheduled 6-day retention period, so deleted Google data may remain in restricted-access backups until rotation. Backups are used for recovery, not normal reporting. Restored YouTube connections and samples must be removed before service resumes; other deletion requests must be reapplied after restoration. You may also revoke VisibleGen directly from your Google Account permissions. Account or data-deletion requests may be sent to [email protected] or to the support email address shown on Google's VisibleGen consent screen.
Disconnecting Bing or Microsoft Clarity deletes the corresponding encrypted provider credentials and cached project snapshots from the active VisibleGen database. Provider-side data remains subject to the provider's own retention controls.
10. Security
We use technical and organizational safeguards designed to protect information, including encryption in transit, encrypted OAuth credentials at rest, access controls, audit logging, least-privilege permissions, and monitored infrastructure. No system can guarantee absolute security, so we encourage strong, unique passwords and prompt reporting of suspected misuse.
11. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, restrict, or export personal information, or to object to certain processing. You may manage project integrations in VisibleGen, revoke connected-provider access at any time, and opt out of non-essential communications using the instructions provided in them.
12. International processing
VisibleGen and its providers may process information in countries other than your own. Where required, we use appropriate safeguards for international transfers and apply this policy to the information wherever it is processed.
13. Children
VisibleGen is a business service and is not directed to children under 16. We do not knowingly collect personal information from children through the service.
14. Changes to this policy
We may update this policy as the service or legal requirements change. We will post the revised version here, update the date above, and provide additional notice when a change materially affects your rights.