Effective date: 1 November 2026. This policy replaces the version dated 27 August 2025.
This Privacy Policy explains how She Knows Digital Sp. z o.o. (“we”, “us” or “our”) collects, uses, shares and protects personal data when you use InvuAI, including the website at www.invuai.com and the application at app.invuai.com (the “Service”). It applies to account holders, invited team members, and people who visit our website or contact us.
The Service is for business use. It is designed to track brands, products and markets, not individuals.
1. Who we are
She Knows Digital Sp. z o.o., registered in Poland, KRS 0000944812, NIP 5482741469, is the controller of the personal data described in this policy, except where section 3 says we act as a processor.
For any privacy question or request, email hello@invuai.com or use our contact form.
2. The personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, company, password (stored only in hashed form by our authentication provider), account settings and preferences | You, when you sign up or update your profile |
| Google sign-in data | Name, email address and profile picture from your Google account | Google, if you choose to sign in with Google |
| Team data | Email addresses of people invited to a team, whether they accepted, and which account they belong to | The account owner who sends the invitation |
| Subscription and billing data | Plan, billing period, payment status, Stripe customer and subscription identifiers, invoices | You and Stripe. We do not receive or store full card details. |
| Communications | Messages, feedback and bug reports you send us, replies in your inbox, contact and demo requests | You |
| Usage and technical data | Log-in times, actions in the app, IP address, browser and device information, error logs | Collected automatically when you use the Service |
| Website analytics | Pages visited, referrer, approximate location, device type | Google Analytics on www.invuai.com, only if you accept analytics cookies |
Project content, such as brand and competitor names, websites, prompts, keywords, tags, notes and action plan items, and the results we collect for it, is business information and should not contain personal data. See section 3.
3. Project content and our role
You must not put personal data about individuals, such as names of private individuals, contact details or customer records, or any special category data, into prompts, keywords, notes or uploads. If project content does contain personal data, we process it on your behalf as your processor, you are the controller, and the data processing terms in section 11 of our Terms apply.
The answers we collect from AI engines and search engines are third-party content. They may mention public figures, businesses or other people because of how those engines respond. We store them as part of your results and do not use them to profile anyone.
4. How we use personal data and our legal bases
| Purpose | Legal basis (UK GDPR and EU GDPR) |
|---|---|
| Creating and running your account, signing you in, providing the Service, including teams | Performance of our contract with you; for team members, our and the account owner’s legitimate interests in providing shared access |
| Sending team invitations | Legitimate interests of the account owner and us in letting customers invite colleagues |
| Billing, invoicing and collecting payment | Performance of contract; legal obligation (tax and accounting) |
| Service emails, such as email confirmation, password resets, “first results ready” and billing messages | Performance of contract |
| The optional weekly report email | Your choice to switch it on in Profile & Settings (you can switch it off at any time) |
| Support, answering messages and feedback | Performance of contract; legitimate interests in helping users |
| Keeping the Service secure, preventing abuse and enforcing limits and our Terms | Legitimate interests in protecting the Service, users and us |
| Improving the Service, using usage data and aggregated statistics | Legitimate interests in developing the Service |
| Website analytics | Consent, given through the cookie banner |
| Occasional product news by email | Legitimate interests in telling business customers about relevant changes; you can opt out at any time |
| Complying with law and defending legal claims | Legal obligation; legitimate interests |
We do not sell personal data, and we do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
5. AI and data providers
To produce results, we send your project content (brand and competitor names, websites, prompts, keywords and market) to third-party providers:
- DataForSEO retrieves answers from ChatGPT, Gemini and Perplexity, and Google search, AI Mode, AI Overview and Shopping results, on our behalf.
- OpenAI is used to analyse answers (for example tone and brand mentions), generate prompt suggestions and gap analyses, and run some ChatGPT checks.
These providers receive project content, not your account details. This is another reason not to include personal data in project content.
6. Who we share personal data with
We share personal data only with the service providers we use to run the Service (our sub-processors), and as described in section 7. Each processes data under contract and only for the services it provides to us.
| Provider | What it does for us | Location |
|---|---|---|
| Supabase | Database, authentication, file storage and server functions | Switzerland (Zurich) |
| Vercel | Hosting and delivery of the website and app | United States and global edge network |
| Stripe | Payments, subscriptions, invoices and the billing portal | United States and EU |
| Resend | Sending emails, such as invitations, first-results emails and weekly reports | United States |
| Sign in with Google; Google Analytics on the website, with your consent | United States and other locations | |
| OpenAI | AI analysis of project content and answers (see section 5) | United States |
| DataForSEO | Retrieving AI answers and search data (see section 5) | Estonia, using its own sub-processors in the EU and United States |
We may update this list as our providers change. The current list is always in this policy.
7. Other disclosures
- Within your team. Team members can see the account’s projects and results. The account owner can see who has been invited and whether they joined.
- Business transfers. If we sell, merge or transfer all or part of our business, personal data may be transferred to the buyer, subject to this policy.
- Legal reasons. Where required by law, court order or a public authority, or where needed to establish, exercise or defend legal claims, or to protect the rights, property or safety of us, our users or others.
- With your consent or at your direction.
8. International transfers
Our main database is hosted in Switzerland, which the UK and the European Commission recognise as providing adequate protection. Some providers listed in section 6 process data in the United States and other countries. Where personal data is transferred outside the UK or the European Economic Area to a country without an adequacy decision, we rely on the safeguards our providers offer, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or certification under the EU-US Data Privacy Framework and its UK extension.
9. How long we keep data
- Account data and project content: while your account is active. If you delete your account, deletion is scheduled and you can cancel it within 7 days; after that, your account and its data are permanently deleted from our live systems.
- Team invitations: until the invitation is accepted, cancelled or the account is deleted.
- Billing records: for as long as tax and accounting law requires, generally five to seven years.
- Communications: for as long as needed to deal with your message and keep a record of it, and deleted with your account.
- Logs and technical data: for a limited period, normally no longer than needed for security and troubleshooting.
- Backups: deleted data may remain in backups for a short period until they are overwritten on a rolling basis.
- Website analytics: for the period set in our Google Analytics settings.
We may keep data longer where the law requires it or where it is needed for legal claims. Aggregated statistics that do not identify anyone may be kept indefinitely.
10. Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), encryption at rest by our database provider, access rules that limit each account’s data to that account and its team, hashed passwords, and payment details handled only by Stripe. Access to production systems is limited to people who need it. No system is completely secure, and we cannot guarantee the security of data transmitted to or stored on the Service. Please use a strong, unique password and keep your login details safe.
11. Your rights
Depending on where you are, you may have the right to: access your personal data; correct it; delete it; restrict or object to its processing, including objecting to processing based on legitimate interests and to direct marketing; receive it in a portable format; and withdraw consent at any time, without affecting processing before withdrawal.
You can update your profile and delete your account yourself in Profile & Settings. For anything else, email hello@invuai.com. We will respond within one month, which may be extended where the law allows. We may need to verify your identity, and we may decline requests where the law permits, for example where they are manifestly unfounded or excessive.
If your data is in project content controlled by an account owner, such as a team, we may refer your request to that account owner.
You also have the right to complain to a data protection authority. Our lead authority is the President of the Personal Data Protection Office in Poland (UODO). You can also complain to the authority where you live or work, such as the Information Commissioner’s Office (ICO) in the UK. We would appreciate the chance to deal with your concern first.
California. We do not sell or share personal information for cross-context behavioural advertising. California residents may request access to, deletion or correction of their personal information using the contact details above, and will not be discriminated against for doing so.
12. Cookies
The website uses Google Analytics only if you accept analytics cookies in the banner, and you can change your choice at any time using “Cookie settings” in the footer. The app uses strictly necessary storage to keep you signed in and remember preferences. See our Cookie Policy for details.
13. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe we have, contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new effective date, and tell account holders about material changes by email or in the Service.
15. Contact
She Knows Digital Sp. z o.o., registered in Poland, KRS 0000944812, NIP 5482741469.
Email: hello@invuai.com, or use our contact form.