1. Who we are
Nevisible, Inc. (“Nevisible,” “we,” “us”) provides an AI search and procurement-agent pipeline platform for B2B manufacturers and distributors. We are headquartered in Toronto, Ontario, and handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable laws. This Privacy Policy explains how we handle personal information when you visit nevisible.co, use our free AI readiness check, book a demo, or use the Nevisible platform.
It also explains how we handle information we process on behalf of our customers through the platform — for example, visits to a customer’s Nevisible-served subdomain. In that role we act as a service provider / processor, and the customer’s own privacy notice governs.
2. Information we collect
Information you give us
- Contact and account details — name, work email, job title, company, phone number, and password or SSO identity.
- Readiness check inputs — the company domain you submit and any details you add. We keep check results for research and analysis, anonymized unless you ask us otherwise.
- Billing details — billing contact and address; card data is collected and stored by our payment processor, not by us.
- Communications — messages, support requests, call recordings (with notice) and survey responses.
Information collected automatically on our website
- Device and log data — IP address, browser, operating system, pages viewed, referring URL, timestamps.
- Cookies and similar technologies — see section 6.
- Company-level identification — we may infer the organization a visitor belongs to from IP address and public business data.
Information from other sources
- Business contact and firmographic data from data providers, public sources and event partners.
- Information from integrations you connect, such as your CRM or email provider.
3. Customer data processed through the platform
When a customer deploys Nevisible, we process data on the customer’s behalf, under the customer’s instructions and our Data Processing Addendum. This may include:
- Content the customer provides — catalog, specifications, certifications and website content.
- Traffic data from the customer’s Nevisible-served subdomain — requests from AI crawlers and procurement agents, and visits from people, including IP address, user agent, pages requested and timestamps.
- Company-level insights — the organization likely behind a visit, its research activity, fit against the customer’s criteria, and whether AI played a Confirmed or Likely role.
- Ask Product Hub questions submitted by buyers or AI agents.
- Rep and routing data — names and emails of the customer’s team members who receive alerts.
Nevisible identifies organizations, not individual private consumers. We do not use customer data to train AI models offered to other customers, and we do not sell it. If you visited a site powered by Nevisible and have a question about your data, please contact that company first; we will assist them in responding.
The Nevisible script on customer websites sets no cookies and writes nothing to your device, collects no device fingerprint, and IP addresses are kept only as a salted hash once the company has been named. A person is named only when they identify themselves, for example by sending an RFQ. See GDPR and data protection for the legal basis our customers rely on.
4. How we use information
| Purpose | Details |
|---|---|
| Provide the service | Run the platform, readiness checks, alerts and reports; authenticate users; provide support. |
| Improve and secure | Debug, measure performance, prevent fraud and abuse, and keep the platform secure. |
| Communicate | Send service notices and respond to requests. We send commercial electronic messages only with your express or implied consent as required by Canada’s Anti-Spam Legislation (CASL); every message identifies Nevisible, includes our mailing address and has a working unsubscribe link, and we honor unsubscribe requests within 10 business days. |
| Sales and marketing | Understand which companies are interested in Nevisible and follow up with relevant business contacts. |
| Legal and compliance | Meet legal obligations, enforce our terms and protect our rights. |
Where GDPR or similar laws apply, our legal bases are performance of a contract, legitimate interests (operating, securing and marketing a B2B service), consent where required (e.g. certain cookies and marketing), and legal obligation. In Canada, we rely on your express or implied consent, as appropriate to the sensitivity of the information, and on exceptions permitted by law.
5. How we share information
We do not sell personal information and do not share it for cross-context behavioral advertising. We share it only with:
- Subprocessors and service providers — hosting, CDN, data enrichment, email delivery, analytics, payments and support tools, bound by contract to use it only for our services. A current list is available on request at privacy@nevisible.co.
- Our customers — company-level insights generated for them under their agreement.
- Integrations you enable — such as your CRM or SSO provider.
- Legal and safety — when required by law or to protect rights, safety or security.
- Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.
6. Cookies and tracking
nevisible.co uses only what it needs to run, one preference you set yourself, and analytics that set no cookies. We don’t use advertising or retargeting cookies today. If we add analytics or marketing cookies, they will be set only with your consent in the EEA, UK and other regions that require it, and you can change that choice at any time. The full list is on our Cookies and Tracking page.
We honor Global Privacy Control (GPC) signals as an opt-out of sharing where required by law.
7. Data retention
- Account and contract data — for the life of the account and up to 7 years afterward for legal, tax and audit needs.
- Customer platform data — as set in the customer’s agreement; deleted or returned within 30 days of termination unless the law requires otherwise.
- Raw traffic logs — typically up to 13 months, then aggregated or deleted.
- Marketing data — until you opt out or it is no longer needed.
8. Security
Nevisible maintains a SOC 2 Type II report and a security program that includes encryption in transit and at rest, SAML and OAuth single sign-on, role-based access, logging and monitoring, vendor review, and regular testing. A copy of our SOC 2 report is available to customers and prospects under NDA. More detail is on our Security page.
No system is perfectly secure. If we become aware of a security incident affecting your personal information that creates a real risk of significant harm, we will notify you and the relevant authorities (including the Office of the Privacy Commissioner of Canada) and keep records of breaches as required by law.
9. International transfers
Nevisible is based in Canada. Platform data for customers in the EU and UK is stored in the EU, and platform data for customers in North America is stored in Canada and the United States. We and our service providers may store and process information in Canada, the United States and other countries, where it may be accessible to local courts and authorities under their laws. We use contracts and other measures to give it a comparable level of protection.
When we transfer personal data from the EEA, UK or Switzerland, we rely on adequacy decisions (including the EU decision recognizing Canada for commercial organizations) or safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal information; to object to or restrict certain processing; to withdraw consent; and to opt out of marketing, “sale,” “sharing” or targeted advertising. In Canada, you have these rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec’s Law 25. California, Colorado, Virginia and other US state residents have similar rights. We will not discriminate against you for using them.
You may also withdraw consent at any time, subject to legal or contractual restrictions; we will explain the consequences, such as being unable to provide certain services. To make a request, email privacy@nevisible.co. We will verify your request and respond within the time required by law (generally 30–45 days). You may use an authorized agent, and you may appeal a decision by replying to our response. You can also complain to your local data protection authority — in Canada, the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner.
11. Children
Nevisible is a business service and is not directed to children under 16. We do not knowingly collect their personal information; if you believe we have, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new “Last updated” date and, for material changes, notify customers by email or in the platform before they take effect.
13. Contact us
Questions or requests: privacy@nevisible.co
Postal address: Nevisible, Inc., 101 College St, Toronto, Ontario M5G 0A3, Canada
Privacy Officer: our Privacy Officer is accountable for our compliance with this policy and with PIPEDA and can be reached at privacy@nevisible.co.