Privacy notice

This policy explains how Valiss AI processes personal data. We try to keep it short and clear. Questions: hello@valiss.co.

1. Who is the data controller

Valiss AI is operated by Trustbox ApS, a Danish private limited company (CVR no. 37588822) with registered address at Lyngbyvej 83 A, 2100 Copenhagen, Denmark. Trustbox ApS is the data controller for the personal data collected through this website and in connection with Valiss engagements. References to "Valiss AI", "we", or "us" in this policy mean Trustbox ApS trading as Valiss AI.

2. Our two roles: controller and processor

For the personal data we collect ourselves about visitors, leads, and our own customers, for example via forms and in connection with sales, invoicing, and delivery of Valiss engagements, we act as data controller. This policy describes that processing.

When, as part of building or operating a solution for a business customer (for example AI agents, customer-service or booking systems, marketing, or custom-built software), we process personal data about the customer's own end users, the customer is the data controller and we are the data processor. That processing is governed by a separate data processing agreement between us and the customer, not by this policy.

The third-party services listed in our terms of service relate primarily to such customer solutions. They may, but will not necessarily, be used in a specific project, and by default they do not process the data we hold about you as a visitor or lead.

3. What information we collect

When you complete a form on this site, the audit inquiry form or the contact form, we collect the information you provide: typically your name, email address, phone number, company name, website, category, and any comments. That is the information we use to reply to you, run your audit, and follow up with the walkthrough meeting.

When you become a customer, we also collect and process the information necessary to enter into and perform the agreement and to invoice, including contact and company details and invoice information. Payment is handled via QuickPay or by invoice (bank transfer); we do not store full payment-card details.

If you subscribe to our newsletter, we record your email address together with documentation of the consent: the time, the page you subscribed from, the language, and the exact wording of the consent text you were shown. If you tick the newsletter box in one of our other forms, we record the same.

When you visit this site, we use the following tools:

• Ahrefs Web Analytics and Vercel Analytics: aggregate visitor statistics. Both are cookieless and require no consent.
• Google Analytics 4 and Google Ads: visitor analysis and measurement of which ads lead to enquiries. Both set cookies and are activated only once you have pressed "Accept" in the cookie banner. We use Google Consent Mode v2, and our default setting is that analytics and advertising cookies are off until you say yes.
• Leadsy: attempts to recognise, from the IP address, which company a visit comes from. It is used solely for B2B sales work and is not intended to identify you as a private individual.

When you become a Signal audit customer, we collect the URL and category you provide, and generate audit data by running queries against public AI assistants (ChatGPT, Gemini, Claude, Perplexity), reading publicly available information about your business (your website, your Google reviews, your competitors' websites), and pulling third-party citations. We do not access private systems unless you expressly give us separate access.

4. Why we process the information (legal basis)

We process the information you provide in a form in order to answer your enquiry and prepare a possible agreement. The legal basis is our legitimate interest in responding to enquiries from prospective customers, and steps taken at your request prior to entering into a contract, under GDPR art. 6(1)(f) and (b). When we deliver audits and engagements you have ordered, and invoice them, the basis is performance of the contract. We process invoicing and accounting material to comply with our legal obligations, including the Danish Bookkeeping Act.

Cookieless, aggregated analytics we process on the basis of our legitimate interest in understanding how the site is used. Cookie-based analytics and ad measurement we process solely on the basis of your consent in the cookie banner, and company recognition via Leadsy on the basis of our legitimate interest in finding relevant business customers. Newsletters and other direct marketing take place solely on the basis of your consent, see section 5. You may object to any processing that rests on legitimate interest by writing to hello@valiss.co.

5. Newsletter and direct marketing

You can subscribe to our newsletter at the bottom of any page, or by ticking the newsletter box when you complete one of our forms. The box is never pre-ticked, and you can always send us an enquiry without subscribing. If you have previously given us consent by telephone to receive information, it applies on the same terms as described here.

The newsletter contains field notes, articles and updates about AI visibility and about our services, and is typically sent a couple of times a month. In that connection we process your email address and the name, contact and company details you have provided yourself.

The legal basis is your consent under GDPR art. 6(1)(a) and section 10 of the Danish Marketing Practices Act. For every consent we record when it was given, from which page, in which language and with which wording, so that we can document at any time what you agreed to.

You may withdraw your consent at any time. Every single email contains an unsubscribe link that works in one click, without a login and without writing to us. You can also unsubscribe by replying to one of our emails or writing to hello@valiss.co. Withdrawal does not affect the lawfulness of processing carried out before then. Once you have unsubscribed we stop sending, and we keep only the minimal record needed to avoid contacting you again by mistake.

Sending is handled by SendGrid, part of Twilio, acting as our data processor.

6. Who we share information with

We use a small number of processors that handle information on our behalf, under written data processing agreements where required by the GDPR. For the processing where we are the data controller, the main ones are:

• Formspree (USA): receives and forwards form submissions.
• Ahrefs (Singapore / global): provides anonymised web analytics.
• Vercel (EU): hosts this website (EU region) and provides privacy-friendly, cookieless visitor analytics.
• QuickPay (EU): handles payment and invoice payment.
• Public AI assistants (ChatGPT/OpenAI, Gemini/Google, Claude/Anthropic, Perplexity): used to generate audit data from publicly available information.
• SendGrid (Twilio, USA): sends our newsletter and service messages.
• Google (Ireland/USA): provides Google Analytics 4 and Google Ads. Activated only once you have accepted analytics and advertising cookies.
• Leadsy (USA): recognises companies from IP addresses, for B2B sales work.

When we build or operate a solution for a business customer (for example AI agents, voice agents, customer service, booking, or marketing systems), we use third-party services as sub-processors depending on the specific project, and only to the extent necessary for that solution. The main ones are:

• AI models: OpenAI, Anthropic, Google (Gemini), xAI, Mistral, Qwen, Kimi, Meta, and GLM, for language understanding, conversations, and content generation.
• Voice and telephony: Cartesia and ElevenLabs (speech synthesis), Telnyx and Twilio (phone numbers, calls, and SMS).
• Communication and operations: SendGrid (email delivery), Railway and Hostinger (hosting), Microsoft, GitHub, Telegram, Vercel, Sanity, and Formspree.
• Payments: QuickPay and Stripe.
• Business data: Google Places, for looking up publicly available business information. No guest or customer data is sent there.

Hosting and backup of our own systems are located in the EU, and we choose EU regions and EU data processing where the provider offers it. These services relate to those customer projects, do not necessarily process your own information as a visitor or lead, and are set out in the relevant data processing agreement. The full, current list of sub-processors is available on request to hello@valiss.co.

We do not sell your personal data, and we do not share it with advertisers.

7. International transfers

Some of our processors and sub-processors are located outside the European Economic Area (EEA), including in the United States (for example Formspree, OpenAI, Anthropic, xAI, Cartesia, Perplexity, Stripe, Twilio, SendGrid, and Telnyx) and Singapore (Ahrefs). Where personal data is transferred outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework, as relevant. You can obtain a copy of, or further information about, the transfer basis by writing to hello@valiss.co.

8. How long we retain information

• Form submissions: retained for as long as we are in active contact with you, and up to 24 months after our most recent interaction, after which they are deleted.
• Newsletter and consent: your email address and the consent documentation are retained until you unsubscribe. Documentation of a withdrawn consent is retained for up to 2 years after withdrawal, so that we can evidence that the mailings already sent were lawful.
• Customer audit data: retained for the duration of the engagement and up to 24 months thereafter, for reference in follow-up work and re-audits.
• Invoices and accounting material: retained for 5 years after the end of the financial year to which the material relates, in accordance with the Danish Bookkeeping Act.
• Analytics: aggregated and anonymised; retained indefinitely.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or misuse. Access to data is restricted to what is necessary, and we use processors that provide appropriate security guarantees.

10. Automated decisions and AI

As data controller, we do not make automated decisions with legal effect or similarly significant impact on you based solely on automated processing. Where AI is used in solutions we deliver to business customers, it is done on the customer's behalf and is governed by the data processing agreement and by the customer as data controller.

11. Your rights

Under the GDPR you have the right to: access the personal data we hold about you; have it rectified if inaccurate; have it erased; restrict or object to the processing; receive a copy of it in a portable format (data portability); and withdraw your consent at any time (without affecting prior processing).

To exercise any of these rights, write to hello@valiss.co. We respond within 30 days.

If we process your data as a processor on behalf of one of our business customers, your request should be directed to that customer, who is the data controller. We assist the customer in responding to it.

12. Right to complain

If you believe we are processing your data in breach of the rules, you have the right to lodge a complaint with the Danish Data Protection Agency, datatilsynet.dk.

13. Cookies

We set no analytics or advertising cookies before you have actively accepted them. On your first visit a cookie banner appears with two choices. If you choose "Only necessary", no Google cookies are set.

• Necessary: your answer to the cookie banner is stored locally in your browser under the name valiss_consent, so you are not asked again. Your browser may also set strictly technical cookies as part of serving the site, for example from our hosting provider. Neither is used for profiling.
• Analytics and advertising, requires your yes: Google Analytics 4 and Google Ads set cookies that measure how the site is used and which ads lead to enquiries. They are activated only after your consent, governed by Google Consent Mode v2, where our default setting is "denied".
• Cookieless: Ahrefs Web Analytics and Vercel Analytics measure visits without setting cookies.

To change your choice, clear the site's data in your browser. The banner then reappears and you can answer again.

14. Changes to this policy

We update this policy when our practices change. We publish the updated version on this page and update the "Last updated" date.

15. Contact

Privacy questions or requests: hello@valiss.co.