01
Who we are and what this policy covers
VISINVOKE PTY LTD (ABN 15 696 974 124; ACN 696 974 124) is an Australian proprietary limited company trading as VISINVOKE. Its main business location recorded on the Australian Business Register is Queensland 4509, Australia. Contact us about privacy at support@visinvoke.com.
This policy covers information handled through VISINVOKE websites, accounts, the Desktop Command Centre (DCC), software, cloud features, purchases and support. The ecosystem serves customers internationally, subject to each service's requirements and availability. Australian incorporation does not remove privacy rights that apply where you live.
VISINVOKE is responsible for account, service and business information it determines how to use. When you process other people's information for your own purposes, you remain responsible for your authority to do so. Connected providers may also act independently under their own privacy notices. Product-specific notices supplement this policy where additional information is handled.
02
Account information and authentication
Registration and account management involve your name, email, password credentials and account settings. Account records can include company, telephone and country information where provided, verification and recovery records, account status, product entitlements, credit balances and purchase identifiers.
Passwords are stored as hashes rather than readable account passwords. Authentication uses tokens, session records and an authentication cookie. Security and session information can include IP addresses, browser or user-agent information and expiry timestamps, supporting sign-in, recovery and access controls.
The DCC connects your account to selected products and access. DCC access, download or connection records and product eligibility may be handled to provide that experience. A free account does not require a credit card. A function may be unavailable if information necessary to register, verify or provide it is not supplied.
03
Product inputs, outputs and user-provided information
The information a product handles depends on the features used. It can include prompts, reference images, uploaded files, generated images or text, projects, saved work, configuration, usage and related metadata. Professional and technical tools can handle client, business, device, diagnostic or work records you choose to enter or submit.
Local processing is distinct from sending information to a cloud feature, account service or integration. One local feature does not mean all device files are uploaded; a cloud feature does not mean information remains only on your device. Check the product's description and controls before submitting material.
Support includes correspondence and attachments you send. Supply only what is needed. Do not send passwords, private keys, recovery codes or unnecessary sensitive information. You must have authority to submit information about clients, colleagues or other people, including legally required notice or consent.
04
Where information comes from
Information comes directly from you when you register, use products, purchase, contact support or submit content; from technical information generated by visits and service use; and from payment, email and connected providers.
Stripe can provide customer, checkout, payment, invoice, subscription, refund and billing-location information associated with a transaction. Connected services provide information relevant to the feature chosen. Campaign links can provide referral, campaign and advertising-click identifiers.
You can choose not to use an optional integration or cloud feature. Account and technical information necessary for a service you do request is still handled.
05
Purposes and applicable legal bases
Information is used to create and verify accounts, authenticate users, supply requested software and cloud functions, manage entitlements and credits, deliver files or results, administer purchases and subscriptions, send service messages and respond to support or privacy requests.
Relevant technical and transaction information supports service operation and security, prevention of misuse or fraud, fault investigation, payment reconciliation, disputes and legal obligations. Analytics and attribution measure visits and campaigns. These purposes do not make unrelated use of confidential product content necessary.
Where EU or UK data protection law applies, processing necessary for a requested account, product or purchase can rely on performing a contract or taking steps you request before a contract. Required compliance records can rely on legal obligations. Necessary security, fraud prevention, administration and dispute handling can rely on legitimate interests, subject to the law's balancing and objection requirements. Consent is required where another valid basis is unavailable, including non-essential tracking where applicable law requires consent.
A contractual purpose is not a blanket basis for advertising. You may ask which purpose and basis apply, object where entitled, or withdraw consent. Withdrawal does not invalidate processing already lawfully undertaken or remove another independently applicable legal obligation.
06
Payments, subscriptions and billing records
Stripe processes checkout and payment information for paid products under its privacy notice. VISINVOKE receives transaction and customer information needed to associate payments, subscriptions, credits, invoices, refunds and entitlements with an account. Card entry at Stripe checkout is separate from free-account registration.
Commerce records can include amounts, currency, purchase identifiers, subscription periods, cancellation status, refunds and transaction-specific consent. An immediate-supply request is separate from general registration or acknowledgement of this policy.
Payment providers may independently handle information for processing, fraud prevention and regulatory duties. Deleting a VISINVOKE account does not automatically delete records Stripe must retain by law.
07
Cookies, GA4 and advertising attribution
Optional Google Analytics and advertising tracking is disabled by default worldwide. Our basic Google Consent Mode v2 implementation sets analytics_storage, ad_storage, ad_user_data and ad_personalization to denied until your choices allow the corresponding use. Google measurement tags are not loaded before permission. Analytics and advertising permissions are separate; browsing, scrolling and continued use do not give consent.
Paid-traffic links and the Google Ads landing page use campaign parameters and advertising-click identifiers, including supported UTM, gclid and gbraid values, to retain attribution when an account link is followed. They can connect a visit or action with a campaign; attribution does not itself send every product file or prompt to an advertiser.
Authentication cookies support account access. Browser or application storage can remember settings, selected work or access state. Essential authentication storage differs from optional measurement and advertising storage. Duration depends on the cookie and configuration; clearing storage can remove settings and sign-in state.
Use Accept all, Reject all or Manage preferences to choose optional uses. Cookie preferences in the footer lets you change or withdraw permission later. Your versioned privacy-choice cookie records preferences and the choice time for up to 180 days. It can share choices across VISINVOKE websites on visinvoke.com where your browser permits; clearing or blocking cookies, different browsers and domain restrictions can prevent persistence or sharing. A more restrictive choice may reload the current page to stop a previously loaded tag, preserving the page URL and campaign parameters.
The system checks a browser Global Privacy Control signal where exposed by the browser and keeps advertising storage, advertising user data and personalised advertising denied when that signal is active. Analytics remains a separate choice. Essential account, security and privacy-choice functions are not disabled by rejecting optional tracking. External providers still handle information under their applicable privacy information.
08
Service communications and marketing choices
Verification, password recovery, purchase and subscription information, security notices and replies to enquiries are service communications. Resend provides email delivery, with delivery and suppression records.
Optional marketing is subject to applicable consent and unsubscribe requirements. Use an unsubscribe facility where provided or contact support@visinvoke.com to object to direct marketing. This does not prevent necessary security or transaction messages.
A support request does not permit unrelated marketing use of its confidential attachments. Do not include sensitive material unless necessary for your enquiry.
09
Providers and disclosures
Providers include Amazon Web Services for hosting and delivery, Stripe for payments, Resend for email and Google for measurement and campaign-related processing. Relevant information is handled for the described functions; providers may also have their own obligations and independent uses described in their notices.
Cloud generation and connected features can send information necessary for a request to the selected AI or integration provider. For example, the platform's image-generation integration supports fal.ai. Actual availability and provider selection depend on the feature and configuration. A supported connector does not mean it is connected to your account. Review provider terms before submitting personal or confidential content.
Information may be disclosed where required by valid legal process or otherwise permitted by applicable law to address incidents, fraud, disputes or legal rights. Requests for another person's information remain subject to privacy and verification requirements.
Measurement or advertising disclosures can constitute 'sale', 'sharing' or targeted advertising under some US state laws without a cash payment. This policy does not claim every third-party tracker is exempt. Applicable choices are described below.
10
International processing and transfers
Our main website uses AWS hosting in Australia and a content-delivery network. This does not mean all account, payment, email, analytics, generation or support information is processed only in Australia. International providers and features can handle information in other countries, including the United States, depending on their infrastructure.
Processing countries can have different laws and access rights. Where law requires a transfer safeguard, that requirement remains applicable: EU GDPR can require adequacy or appropriate safeguards, UK law has its own transfer rules, and Australian cross-border requirements apply where the Privacy Act covers the handling.
Accepting this policy does not waive transfer protections. Ask support@visinvoke.com about recipients, locations and arrangements relevant to your use. No international certification, adequacy status or contractual transfer mechanism is represented as covering every VISINVOKE service.
11
Storage, retention and deletion
Information is stored according to function: account and commerce records in platform services, work and settings in the selected local or cloud product, correspondence in support and email systems, and provider information in those providers' systems. These records can have different retention requirements.
Retention depends on the purpose, whether an account or service remains active, outstanding transactions or disputes, accounting and legal requirements, security needs and the location of copies. There is no single period for every category. You can request the criteria applicable to a specific record.
Request deletion at support@visinvoke.com. Applicable law may require deletion or de-identification when information is no longer needed, subject to lawful exceptions, including necessary transaction evidence or legal claims. A limitation on your request must be explained where required.
Deleting a local file or uninstalling the DCC does not automatically close an account, cancel a subscription, delete cloud work or erase provider records. Deletion and cancellation are separate requests. Backups and provider copies can need separate handling; instantaneous erasure of every copy is not promised.
12
Privacy and security protections
The platform uses password hashing, authentication cookies, sessions and account and entitlement checks to protect access. Additional controls depend on the product, configuration and device; no connected system guarantees absolute security.
Protect passwords and recovery information, keep devices and software updated, and report suspected compromise promptly. Do not put tokens or credentials in prompts or support attachments.
Security-incident notification obligations under applicable privacy law remain applicable. Whether an event requires notification depends on the facts and legal threshold.
13
Access, correction and other requests
Email support@visinvoke.com with the subject 'Privacy request', identify the account or information and describe the action requested: access, correction, deletion, restriction, objection, portability or another applicable right. Include your country to help identify relevant law. You can also ask about a purpose, recipient or retention criterion.
Proportionate verification may be needed for you or an authorised representative. Do not send passwords or an unrestricted identity-document copy with the initial request. Verification must be limited to what is reasonably needed.
Applicable law determines deadlines, exceptions and permitted charges. EU and UK requests generally require a response within one month, with a notified extension where permitted. California access, correction and deletion requests generally have a 45-day period, with a permitted notified extension. Reasons for a refusal and complaint or appeal avenues must be provided where required. Statutory rights do not depend on purchasing a paid product.
14
Australia, EEA and United Kingdom
Australia: where the Privacy Act 1988 and Australian Privacy Principles apply, rights include access, correction, transparent handling and complaint avenues. Contact us or the Office of the Australian Information Commissioner (OAIC). Coverage and exceptions depend on the entity and processing; incorporation alone does not determine all privacy obligations.
EEA and UK: where GDPR or UK GDPR applies, rights can include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and protections for certain solely automated decisions with legal or similarly significant effects. Conditions and exceptions apply. You can complain to your competent data protection authority, including the Information Commissioner's Office (ICO) in the UK.
Account and entitlement checks use status, purchases and balances to determine feature access. Contact support if a result is wrong. Where the law gives rights to human intervention, an explanation or to contest a significant automated decision, those rights remain available.
15
United States privacy rights
Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, rights include knowing and accessing information, deletion, correction, opting out of sale or sharing, limiting certain uses of sensitive information and protection from unlawful discrimination.
The categories above include account identifiers, commercial records, online activity, product content and correspondence. Sources, purposes and provider disclosures are described above. Content sensitivity depends on what you submit; do not upload sensitive information unnecessarily.
Other applicable state laws can provide access, correction, deletion, portability, opt-outs from targeted advertising, sale or specified profiling, and appeals. You or an authorised agent may contact support@visinvoke.com. To appeal, use the subject 'Privacy appeal' and identify the decision.
Where recognition of a universal opt-out signal such as Global Privacy Control is legally required, that right is not waived by visiting a website. Our website consent controls check the browser's Global Privacy Control signal and deny optional advertising when it is active. Do Not Track is a different mechanism and is not treated as permission. Contact us about sale, sharing, advertising or signal-related requests. Applicable federal consumer and children's protections also remain available.
16
Other international privacy protections
Customers elsewhere retain rights applicable to the handling, including local access, correction, consent, complaint and transfer requirements. Canada's PIPEDA and applicable provincial laws, and New Zealand's Privacy Act 2020, provide protections in the circumstances they cover.
These examples do not exclude rights in other countries or assert every named law applies to every user. Contact us with your location and request, or your local regulator. Mandatory local protections prevail over an inconsistent statement in this policy.
17
Children's information
Children's information may have additional protection. COPPA imposes parental-consent requirements on covered US collection from children under 13. EU and UK rules impose conditions on children's consent to online services, with age thresholds and requirements depending on the country and processing.
Do not register, purchase or submit a child's information where parental or guardian authority is legally necessary without that authority. An adult's account does not itself provide consent for every child whose information is entered.
Parents or guardians can contact support@visinvoke.com to request investigation, access or deletion under applicable law; authority may need verification. This policy does not represent that registration includes an age-verification or verifiable-parental-consent service.
