Login

Draft for review: not yet in force.

Privacy Policy for Visokio Agents Shop

Effective Date: [PLACEHOLDER: effective date]

Visokio Limited ("Visokio", "we", "our" or "us") is dedicated to safeguarding your privacy when you or an AI agent acting for you uses the Visokio agents shop at https://agents.visokio.com (the "Shop") and the services it sells passes for (together, the "Service"). The first service is Insight Explorer: an agent sends a CSV file and a question, and receives the answer plus a report that its person can open to check how the answer was reached. Insight Explorer runs on https://omniscope.visokio.com. This Privacy Policy explains how we collect, use, store and protect personal information and the data sent to the Service, along with your rights and obligations.

An AI agent is software acting for a person or business. In this policy, "you" means that person or business: the agent's operator. You are responsible for what your agent sends to us.

By using the Service, you acknowledge that you have been informed of the practices described in this Privacy Policy. This notice does not replace consent where consent is required by law or limit your statutory rights.

1. Scope of This Privacy Policy

This Privacy Policy applies to all users of the Service, including agents and their operators, and anyone who opens a receipt page or report link created by the Service, and covers:

• Information we receive from your agent when it buys and uses a pass.
• Information collected automatically through use of the Service.
• Information shared with third-party services (for example, the blockchain network that carries the payment, and our AI model provider).

This Privacy Policy does not cover:

• The independent practices of third-party websites, applications or services linked to or integrated with the Service, including your agent, its provider and your wallet provider. Our own handling of information sent to those services remains covered.
• Information you share outside the Service and which we do not receive or process. Our legal duties still apply to information uploaded in breach of the Terms.
• Visokio's other services, including Omniscope Cloud SaaS accounts, which have their own privacy policy.

2. Data We Collect

a. Information Your Agent Provides

• No account: there is no account or sign-up. Your agent is identified only by the wallet address it pays from.
• Purchase records: for each purchase we keep the paying wallet address, the amount, currency and network, the blockchain transaction ID, our payment ID and pass ID, the service and offer bought, and timestamps. A wallet address may be personal data where it can be linked to an individual.
• Payments on the blockchain: payments are made with the x402 protocol in the USDC stablecoin. Every payment is also recorded on a public blockchain, where anyone can see it. Visokio does not control the blockchain and cannot change or delete those records. Payments are currently accepted only on Base Sepolia, a test network on which no real money changes hands; real networks will follow [PLACEHOLDER: when real (mainnet) payment networks go live, and which]. The x402 payment is checked and settled through MetaMask's x402 payment facilitator, which receives the signed payment: the paying and receiving wallet addresses, the amount and the time it is valid for.
• Support requests: if you contact us for assistance, any information provided (for example emails, screenshots or logs) may be retained to address your issue.

b. Automatically Collected Information

• Activity log: each request to the Shop is logged for operations and security, with the time, the page asked for, the program that asked (its User-Agent) and a visitor code. The visitor code is made from the IP address and the program with a key that changes every day and is never stored, so it groups one visitor's requests for that day only; the IP address itself is not kept in the log.
• Cookies and Tracking: the Shop's public pages, including receipt pages, set no cookies. The Shop's admin site, which only Visokio staff use, uses a sign-in cookie. The report your person opens is on omniscope.visokio.com [PLACEHOLDER: whether the report login on omniscope.visokio.com uses Auth0 and sets cookies].

c. Job Data Sent to the Service

• For each job, your agent sends a CSV file and a question. The Service produces an answer and a report, with a login so that your person can open the report. Together these are the "Job Data". Job Data remains yours. We process it only to provide the Service and carry out your agent's instructions, or where required by law. We limit access to authorised people and providers with a service, security, support or legal need.
• The question and data are processed by our AI model provider, OpenAI, to produce the answer (see sections 4 and 12).
• Job Data is deleted 24 hours after purchase (see section 6). After that, Visokio does not know what was asked.
• Do not send highly sensitive or regulated data, including HIPAA-regulated health information, special-category or criminal-offence data, payment-card details, government-classified information, or core proprietary datasets containing identifiable personal information. Any exception requires Visokio's prior written approval expressly covering that processing and the necessary safeguards; buying a pass does not provide that approval. Use synthetic, properly anonymised or other non-sensitive data suitable for the Service.

d. Receipt Page

When your agent buys a pass, it receives a private link for its person. The receipt page shows what was bought and paid, and the transaction on the blockchain. Anyone who has the link can open it, so share it only with the people who need it.

3. How We Use Your Data

We use the data collected for the following purposes:

• Service Delivery: to check payments, issue and check passes, run jobs and return answers and reports.
• Receipts: to show your person what was bought and paid.
• Operations and Security: to keep the Service running, troubleshoot issues, detect abuse and protect the Service and its users.
• Service Improvement: to analyse usage trends and improve functionality, using purchase records and the activity log, not the content of Job Data.
• Communication: to respond to your inquiries.
• Legal Compliance: to comply with applicable laws, including accounting and tax record-keeping, enforce our Terms and Conditions, or resolve disputes.

We do not use your data for:

• Selling, renting or trading your information with third parties.
• Advertising or marketing purposes without explicit consent.

Our roles and legal bases: Visokio acts as controller for purchase records, receipts, the activity log, security and support. For purchase records and receipts, we rely on performance of the contract for the pass; where the operator is an organisation, handling its representatives' details is based on legitimate interests. Keeping payment records for the required accounting and tax periods relies on legal obligations. The activity log, security, troubleshooting and handling claims rely on legitimate interests. Optional processing requiring consent relies on that consent. We consider individuals' rights when relying on legitimate interests and collect only information reasonably necessary for these purposes. Without a valid payment, we are unable to provide the Service.

For personal information in Job Data, Visokio acts as processor on the operator's instructions given through its agent, or as subprocessor where the operator is itself a processor. The operator is responsible for its own lawful basis and instructions. The processing terms in section 7 of our Terms and Conditions apply. We do not use Job Data to train general-purpose AI models.

4. Sharing of Data

We do not sell or rent your personal information. We disclose it only in the circumstances described below. Visokio does not "sell" personal information or "share" personal information for "cross-context behavioral advertising", as defined by the CCPA/CPRA, collected through this Service.

• Service Providers: we may share minimal data with trusted third-party providers who assist in delivering or supporting the Service. The Shop and its database backups are hosted on Google Cloud (us-east1, South Carolina, United States). Insight Explorer runs on omniscope.visokio.com, whose backend computational virtual machines are hosted on Google Cloud Platform in the United States. Providers processing personal information for us are subject to confidentiality and required data-protection terms.
• AI Model Provider: the question and data in each job are sent to OpenAI to produce the answer [PLACEHOLDER: OpenAI's location, retention and training terms for Visokio's API account].
• Payment Processing: payments are made directly from your agent's wallet over a public blockchain, as described in section 2. The blockchain network, and anyone reading it, can see each payment. MetaMask, the x402 payment facilitator, receives each signed payment (the paying and receiving wallet addresses, the amount and the time it is valid for) and may process payment information for its own payment, fraud-prevention and legal purposes under its own privacy policy.
• Legal Requirements: we may disclose your information if required by law, subpoena or other legal processes, or if we believe disclosure is necessary to protect our rights, comply with legal obligations, or prevent fraud.
• Business Transfers: in the event of a merger, acquisition or sale of Visokio's assets, your data may be transferred to the successor organisation. You will be notified of such a transfer if required by law.
• With Your Consent: we may share information with third parties if you explicitly authorise us to do so.

5. Job Data Responsibility

• Ownership: you retain full ownership of all data your agent sends to the Service.
• Responsibility: you are solely responsible for your agent's actions, for having the right to send the data, and for the legality, reliability and accuracy of Job Data.
• Access by Visokio: we process Job Data only as described in sections 2 and 3, on your instructions or as required by law. Our applicable processor duties remain in force.
• Data Loss: Job Data is deleted 24 hours after purchase. Keep your own copy of anything you need, including the answer and report. Liability is governed by section 14 of this policy and section 11 of the Terms and Conditions, subject to rights and duties that cannot lawfully be excluded.

6. Data Retention

• Job Data: the uploaded CSV file, the question, the answer, the report and its login are deleted 24 hours after purchase. After that, Visokio does not know what was asked. Earlier deletion may follow your valid request or necessary removal of prohibited content.
• Payment Records: purchase records (section 2a) are kept for 6 years from the end of the financial year in which the payment was made, to meet UK HMRC record-keeping requirements [PLACEHOLDER: confirm 6 years for payment records], then deleted or the wallet address removed.
• Activity Log: kept for [PLACEHOLDER: activity log retention, proposed 90 days], then deleted.
• Blockchain Records: payments recorded on a public blockchain stay there permanently. Visokio cannot delete them.
• Backup Copies: the Shop's database backups are kept in Google Cloud for [PLACEHOLDER: retention period of the shop's database backups]. Backups may not guarantee full restoration of deleted data. Deleted information may remain in restricted backups until removed through the applicable backup cycle; it is not used for ordinary processing, and deletion instructions are reapplied if a backup is restored. Copies held independently by other recipients are governed by their own retention obligations.
• Support, Security and Legal Records: support and security records are retained only as needed for their stated purposes, incident investigation or lawful claims. A legal retention requirement does not justify indefinite retention of all Job Data.

Accidental personal-information upload: Job Data is deleted automatically 24 hours after purchase. To ask for earlier deletion, email agentsupport@visokio.com with the subject "URGENT: agents shop data deletion". Give the payment ID or pass ID from the receipt and the approximate time of the job; do not resend the sensitive dataset. After proportionate identity/authority checks, we prioritise containment and deletion from active systems without undue delay. We explain any lawful exception or backup limitation; immediate removal of every third-party or backup copy cannot be guaranteed.

7. Data Security

We implement industry-standard measures to safeguard your data. However:

• No Guarantee: while we strive to protect your data, no method of storage or transmission is completely secure. This does not exclude our applicable legal duties or liability that cannot lawfully be limited.
• Your Responsibility: you are responsible for securing your agent, its wallet and keys, its passes, and the receipt and report links it gives you.

8. Efforts to Comply with GDPR and Other Regulations

We comply with the data-protection obligations applicable to our role, including GDPR, UK GDPR and CCPA/CPRA where they apply. Operators remain responsible for the lawfulness of their own and their agents' use of the Service. We apply appropriate technical and organisational measures and, when acting as processor, notify the operator without undue delay after becoming aware of a personal-data breach and provide assistance required by law, so far as we can contact the operator (we hold no contact details unless you give them to us).

For concerns regarding data protection, contact us at agentsupport@visokio.com.

9. Cross-Border Data Transfers

The Shop is hosted on Google Cloud (us-east1, South Carolina, United States). Job Data processed on the omniscope.visokio.com backend is hosted in the United States, and the question and data are sent to OpenAI [PLACEHOLDER: OpenAI's location, retention and training terms for Visokio's API account]. Payments are recorded on a public blockchain, which is replicated worldwide. By using the Service, you acknowledge these processing locations and authorise the transmissions needed to perform your instructions. This is not blanket consent under GDPR or UK GDPR and is not consent on behalf of people in your data. Where a restricted transfer requires safeguards, we use an applicable lawful mechanism, such as a relevant adequacy decision or contractual safeguards (including EU standard contractual clauses and the UK Addendum or International Data Transfer Agreement), with required assessments and supplementary measures. Details and a copy of relevant safeguards are available from agentsupport@visokio.com, subject to lawful confidentiality protections. Do not send data to the Service if your requirements prohibit US processing.

10. Children's Privacy

The Service is not intended for use by children under the age of 18, or by agents acting for them. We do not knowingly collect data from minors. If you believe we have inadvertently collected data from a minor, contact us immediately at agentsupport@visokio.com, and we will take appropriate action.

11. Your Rights

Depending on your location, you may have rights regarding your data, including:

• Accessing your personal data.
• Requesting corrections or updates.
• Deleting your data, subject to applicable statutory exceptions. Visokio cannot delete records on a public blockchain.
• Objecting to processing or requesting data portability.
• Requesting restriction of processing and withdrawing consent where we rely on it, without affecting earlier lawful processing.

To exercise your rights, contact agentsupport@visokio.com. Because we hold no account, we may proportionately verify your identity or authority, for example by asking for the payment ID or pass ID shown on the receipt, or other evidence that you control the paying wallet address. GDPR/UK GDPR requests are normally answered within one month, subject to lawful extensions, and are normally free. Where we act for another controller, we refer the request to it and assist its response. You may complain to the UK Information Commissioner's Office (https://ico.org.uk/make-a-complaint/) or the competent EEA supervisory authority; you need not contact us first.

California rights, where CCPA/CPRA applies: you may request to know/access, obtain a portable copy, correct or delete personal information, and exercise applicable sale/sharing opt-out and sensitive-information limitation rights without discrimination. An authorised agent may submit a request with appropriate evidence of authority. Email agentsupport@visokio.com marked "California privacy request". We acknowledge qualifying requests to know, delete or correct within 10 business days and normally respond within 45 calendar days, explaining any permitted extension. We honour applicable opt-out preference signals. Our no-sale/no-sharing practice is described in section 4.

The categories collected in the preceding 12 months, where the relevant features were used, are identifiers (wallet addresses, payment and pass IDs, daily visitor codes made from IP addresses), commercial information (purchases and payments), and internet/network activity (requests to the Shop). Additional Job Data categories are determined by operators, subject to our upload restrictions. Sources are your agent, your use of the Service and the public blockchain; purposes, recipients and retention criteria appear in sections 2 to 6. We have not sold or shared this Service's personal information for cross-context behavioural advertising during that period. We use sensitive personal information only for requested services, security and other legally permitted purposes, not to infer characteristics about consumers.

12. Third-Party Services

The Service may include integrations or links to third-party tools. We are not responsible for the practices, content or privacy policies of these third-party services, including your agent, its provider and your wallet provider. You are encouraged to review their policies before engaging with them. This does not remove responsibility for our own processing or for providers we engage as subprocessors.

AI model provider: to produce each answer, the Service sends the question and the data in the CSV file to OpenAI under Visokio's own account. Requests may include the question, field names, selected data values/rows, summaries and report context. Do not send data that must not be processed by an AI model provider. Deletion of Job Data by Visokio may not delete provider-held copies [PLACEHOLDER: OpenAI's location, retention and training terms for Visokio's API account].

Blockchain: payments are made over a public blockchain network that Visokio does not operate. Its records are public and permanent, and are governed by the rules of that network rather than by Visokio.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Because there are no accounts, we will announce significant changes on agents.visokio.com and update the effective date. Where new consent is legally required, we will request it; continued use is not a substitute.

14. Limitation of Liability

To the fullest extent permitted by law:

• Visokio disclaims all liability for indirect, incidental or consequential damages related to data breaches, unauthorised access or loss of data.
• You may stop using the Service if dissatisfied, but retain all applicable rights to complain, seek a remedy or compensation, and exercise data-protection rights. Nothing in this policy excludes duties or liability that cannot lawfully be excluded. The permitted contractual limits in section 11 of the Terms and Conditions apply between the contracting parties only.

15. Contact Us

If you have questions, concerns or wish to exercise your rights, please contact us:

• Email: agentsupport@visokio.com
• Postal address: Visokio Limited, P.O. Box 3152, Road Town, Tortola, British Virgin Islands. Company number 1042953.

For corporate security, compliance or residency requirements that this shared service cannot meet, contact us about an installed instance or a private AWS, Azure or GCP deployment of Omniscope using Docker, under your organisation's network and firewall control. Choosing a private deployment alone is not a compliance certification.