What we send, who receives it, how long we keep it.
Zenvisibility asks five AI models what they say about your locations, and scores the answers. The only things we send a model are your own published marketing text and public facts about your sites. We keep the verbatim answers for 90 days so you can audit a score, then delete them — while keeping the report they produced.
Last updated 14 September 2026
What we send to model providers, and why
To ask a model what it says about one of your locations, it has to know which brand and which location. That is the entire payload:
- Your brand knowledge base— the marketing description built during setup from your own website and public sources.
- The location’s name, city, state and country.
- Public listing enrichment— the category, rating, review count and address we hold from Google Places for that site.
No end-customer personal data is sent to any model. Not because we filter it out, but because we never collect it. There is no patient, guest, member or customer record anywhere in the product. If your business holds such records, they stay in your systems: we never see them, and cannot leak them.
The disclosure a careful reviewer will find on their own, so we say it first. We ask five providers the same question, then turn each answer into structured data. That extraction step runs on a single model, and it is OpenAI’s. So Anthropic’s, Google’s, xAI’s and Perplexity’s full raw responses are all sent to OpenAI. There is no setting that routes extraction elsewhere today. If your policy cannot permit that, tell us at the start of the conversation rather than after signature.
Sub-processors
Every row below is read out of our source code rather than written from memory, and names the model it uses. If a row and our code ever disagree, the code is right and this page is a defect — tell us and we will fix it.
| Sub-processor | What it does | Model | What data reaches it | Region |
|---|---|---|---|---|
| Anthropic | One of the five analysis models, and the model that writes the question set | claude-sonnet-5-5 | Brand marketing copy; location name, city, state, country; public listing enrichment | United States |
| OpenAI | One of the five analysis models, and the extraction model that turns every provider's answer into structured data | gpt-6-luna gpt-5-mini-2025-08-07 | The same prompt data, and every other provider's full raw response (see below) | United States |
| One of the five analysis models; and the Places API for location enrichment and photos | gemini-3.5-flash-lite | The prompt data; for Places, the location's name and address only | United States / Google-managed | |
| xAI | One of the five analysis models | grok-4.5 | Brand marketing copy; location name, city, state, country; public listing enrichment | United States |
| Perplexity | One of the five analysis models | Agent API fast preset | The prompt data; for research, the brand name and website | United States |
| Langfuse Cloud | Tracing of model calls. Only active when tracing keys are configured; with them unset nothing is sent | Not a model provider | Prompt text and response text, as trace payloads | United States (us.cloud.langfuse.com) |
| Supabase | Managed Postgres: every record the product stores | Not a model provider | All stored data: brands, locations, snapshots, prompts, responses, user accounts, audit log | United States |
| Railway | Application hosting for the API, the worker and this website | Not a model provider | Request metadata and application logs. Log lines carry identifiers, not prompt or response text | United States |
The table scrolls sideways on a narrow screen.
Retention on each provider’s own side is governed by that provider’s API terms rather than by ours. If you need our current written position on provider-side retention or training, ask — do not infer it from this table.
How long we keep raw model responses
90 days by default. A nightly job deletes the verbatim text of every model response older than your window.
The reports built from those responses are kept indefinitely.The purge deletes the response text and nothing else: the extracted findings, the scores, the mention flags, the ranks and the citations all survive, because they are what every tab of every report renders. A report we delivered in March still opens in December, with the same numbers, after the March response text is gone. The only thing lost is the ability to re-read the model’s original wording.
The window is set per brand and can be anywhere between 7 and 730 days, because it is a contractual number rather than a technical one. A records regime asks for 30; a litigation hold asks for two years. Both are one request.
Verifying it rather than trusting it
The window endpoint reports how many stored responses still hold text, the date of the oldest one, and when the last purge ran — so you can check the statement above instead of taking our word for it.
Having your data deleted
You can have every stored model response for your brand deleted immediately, whatever the retention window says. It is one call, it runs the same day, it is irreversible, and it is written to our audit trail.
It deletes the same response text the nightly job deletes, so your reports survive this too. Deleting the account itself — every location, snapshot and report — is a separate request: contact us and we confirm in writing when it is done.
Share links
A report can be shared by link, and those links are unauthenticated: anyone holding the URL can open that one report, which is the point — a board member should not need an account to read one page. Every link has an expiry, can carry a passcode, can be revoked at any time, and can be rotated so a leaked URL dies while the link keeps its history. Treat a share URL the way you would treat an emailed PDF of the same report.
When this list changes
We notify customers 30 days before adding a new sub-processor, or before materially changing what data an existing one receives, so there is time to object.
Changing the model version within a provider already on the list — one Anthropic model to its successor, say — is not a new sub-processor and is not notified. The recipient of the data has not changed, and a notice for every model release would train you to ignore the notices that matter.
What we have not done yet
We have no SOC 2 report yet; Type I is scoped and in progress. There is no MFA, no SSO and no penetration test on file. We would rather you heard that here than found it in week three of a procurement review.
Our full security questionnaire is filled in, including every gap, with a target date against each one. Ask and we will send it.
Questions, or a questionnaire of your own to send us: trust@zenvisibility.com. Including the questions this page would rather you did not ask — an honest gap is easier to work with than a discovered one.