Company-level by design.
Built for the GDPR.
Nevisible shows manufacturers and distributors which companies are researching them through AI search and AI procurement agents. It works at the company level, stores nothing on a visitor's device, and names a person only when they identify themselves. Here is how that fits the GDPR and the UK GDPR.
Data Processing Addendum for every customer · SOC 2 Type II
- Company-level only
- No cookies from our script
- No raw IP at rest
- SOC 2 Type II
Our approach
Privacy is part of the architecture
These rules are written into the product specification and apply to every part of Nevisible. They are not settings a customer has to switch on.
What Nevisible is built to do
- Tell a supplier which companies researched them, with a confidence score on every match
- Show what those companies looked at, so the rep can follow up on the right product
- Process visit data for customers only on their instructions, under our DPA
- Delete a visit and everything linked to it when asked
What Nevisible will never do
- Name a person from an anonymous visit
- Fingerprint a device, through canvas, fonts, audio or hardware signals
- Write cookies or other storage to a visitor's device from the Nevisible script
- Sell personal information
Privacy in the product
Six controls that ship with every plan
Each one limits what Nevisible collects or keeps, before anyone has to ask.
Company-level matching
IP-to-company resolution names the organization, and human/agent behavioral matching ties its research to what AI read on your catalog. The result is a company and its interests, not a profile of a person.
Nothing stored on the device
The Nevisible script sets no cookies and uses no localStorage, no sessionStorage and no fingerprinting. Repeat visits are matched on our servers.
No raw IP addresses at rest
An IP address is used briefly to name the company, then kept only as a salted hash with the network and country it came from.
Consumer networks filtered first
Consumer broadband, VPN, residential proxy and cloud networks are removed before any company match is attempted.
People named only by choice
A person's details appear only when they give them, for example by downloading a certificate pack, asking a question in Ask Product Hub or sending an RFQ.
Deletion that cascades
Deleting a visit removes every event, page view, captured lead and outcome linked to it, across the platform.
For your legal team
Documents your counsel will ask for
Request any of these and we'll send them, usually within one business day.
Data Processing Addendum
Our role as processor, security measures, subprocessors and transfer safeguards, including Standard Contractual Clauses. Available on request.
Request the DPA →Legitimate interests
The facts your counsel needs to complete your own legitimate interest assessment for company-level matching.
Ask our privacy team →Subprocessors
The service providers that run parts of Nevisible, from Cloudflare to Supabase, and what each one does.
See the providers →SOC 2 Type II report
Our independent audit report, shared with customers and prospects under NDA.
See security →GDPR questions about Nevisible
Yes. The GDPR (EU Regulation 2016/679) and the UK GDPR cover personal data about people in the EU and UK, including when a company outside Europe processes it. Nevisible is based in Canada, but its customers sell into Europe and their websites get visits from European businesses, so we apply the GDPR to that data and build the product to meet it.
The result usually is not: Nevisible reports a company, such as an industrial buyer in Lyon, not a person. The inputs can be. An IP address and the pages viewed from it can count as personal data, especially for very small firms and sole traders. So we treat the inputs as personal data, keep raw IP addresses only for as long as it takes to name the company, and store a salted hash after that.
For visits to a customer's website and ai. subdomain, the customer is the controller and Nevisible is the processor: we process that data on the customer's instructions, under our Data Processing Addendum. For our own website, marketing and customer accounts, Nevisible is the controller.
Most B2B customers rely on legitimate interests (Article 6(1)(f) GDPR): knowing which businesses are researching their products so the right rep can follow up. That basis needs a three-part test: a real purpose, processing that is necessary for it, and a balance that does not override the interests of the people involved. Company-level results, no device storage, hashed IP addresses and filtering out consumer networks are what tip that balance. Each customer should record its own legitimate interest assessment, and we give your counsel the facts about how Nevisible works to complete it.
The Nevisible script sets no cookies and stores nothing on the visitor's device: no localStorage, no sessionStorage and no device fingerprinting. Repeat visits are matched on our servers instead. That keeps it out of the storage rules that trigger most cookie banners. How your consent tool lists it still depends on your own setup and your regulator's guidance, so check with your counsel; we'll share our analysis.
Platform data for customers in the EU and UK is stored in the EU. Platform data for customers in North America is stored in Canada and the United States. Nevisible is hosted on Vercel and Cloudflare, with its database on Supabase. Cloudflare's edge answers each request at the location nearest to it, and a few service providers, such as AI processing, may handle data in other countries. For any transfer out of the EEA, UK or Switzerland we rely on adequacy decisions, including the EU decision recognizing Canada, or the European Commission's Standard Contractual Clauses and the UK Addendum.
Raw traffic logs are kept for up to 13 months, then aggregated or deleted. Customer platform data is deleted or returned within 30 days after a contract ends, unless the law requires us to keep it longer. A deletion request removes the visit and every event, lead and outcome linked to it.
If you visited a website that uses Nevisible, contact that company first: it controls the data, and we help it respond. You can also email privacy@nevisible.co. We answer within one month, as the GDPR requires, and tell you if a complex request needs longer. You can also complain to your local data protection authority.
Yes. Our Data Processing Addendum is available on request from privacy@nevisible.co. It covers our role as processor, security measures, subprocessors, international transfers and help with data subject requests, and it applies under our Terms of Service wherever we process personal data on a customer's behalf.
Our Privacy Officer is responsible for how we handle personal data and can be reached at privacy@nevisible.co.
Send us your privacy questionnaire. We'll answer it.
Privacy and procurement reviews are part of selling to manufacturers. Email the questionnaire, or book a walkthrough and bring your counsel.
Company-level only · No device storage · SOC 2 Type II
Last updated