Privacy Policy

Last updated: 10 February 2026

This privacy policy explains how BSolve IT Limited (trading as 365i) collects, uses, and protects your personal data when you use the AI Visibility Definition website (www.ai-visibility.org.uk) and the AI Discovery Files Directory.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller is:

2. What Data We Collect

2.1 Website Visitors (No Account)

When you browse this website without creating an account, we collect:

• Server logs: IP address, browser type, pages visited, and timestamps. These are collected automatically by our hosting provider (20i) for security and performance monitoring.
• No cookies are set for general browsing. We do not use analytics tracking, advertising cookies, or third-party trackers on the main website.

2.2 Directory Account Holders

When you create an account on the AI Discovery Files Directory, we collect:

• Account information: Name, email address, and a hashed password (if registering with email/password).
• Google account data (if signing in with Google): Your Google account name and email address. We do not access any other Google account data.
• Session cookies: A session cookie is set when you log in to maintain your authenticated state. This cookie is essential for the service to function and is not used for tracking.

2.3 Directory Submissions

When you submit a website to the directory, we collect:

• Website URL: The domain you submit for validation.
• Publicly available data: We fetch and analyse publicly accessible files from your website (such as llms.txt, ai.txt, identity.json) to determine your AI Visibility score.
• IP address: Used for rate limiting to prevent abuse.

3. How We Use Your Data

We use your data for the following purposes:

• Providing the service: To create and maintain your directory account, process submissions, and display listings.
• Authentication: To verify your identity when you log in.
• Security: To protect against abuse, fraud, and unauthorised access (e.g., rate limiting, audit logging).
• Service communications: To send essential service-related emails (e.g., account verification, password resets). We will not send marketing emails without your explicit consent.

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contract: Processing necessary to provide the directory service you have signed up for (Article 6(1)(b) UK GDPR).
• Legitimate interest: Security measures, abuse prevention, and server logging (Article 6(1)(f) UK GDPR).
• Consent: Where applicable, such as optional marketing communications (Article 6(1)(a) UK GDPR).

5. Data Storage and Security

• Account data is stored securely on our hosting infrastructure provided by 20i, a UK-based hosting provider.
• Passwords are hashed using bcrypt and are never stored in plain text.
• Directory submission processing is handled by Cloudflare Workers, with listing data stored in Cloudflare KV (data centres worldwide).
• Session data is stored server-side. Session cookies use HttpOnly and SameSite flags for security.
• All data is transmitted over HTTPS (TLS encryption).

6. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with:

• 20i (hosting provider): Server infrastructure and logging.
• Cloudflare: CDN, security, and Workers (submission processing).
• Google: Only if you choose to sign in with Google OAuth. Google receives a standard OAuth authentication request; we receive your name and email in return.

All third-party providers are bound by their own privacy policies and data protection obligations.

7. Public Directory Data

If your website is listed in the directory:

• Your business name, domain, description, category, and AI Visibility score are displayed publicly.
• Only data that is already publicly available on your website (from your AI Discovery Files) is displayed.
• Your personal account details (email, password) are never displayed publicly.

8. Data Retention

• Account data: Retained for as long as your account is active. If you cancel your account, your personal data is removed within 30 days.
• Directory listings: Remain in the directory unless you request removal or your site consistently fails re-verification checks.
• Server logs: Retained by our hosting provider in accordance with their retention policy (typically 30 days).
• Rate limiting data: Automatically deleted after the lockout period expires.

9. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate personal data.
• Erasure: Ask us to delete your personal data ("right to be forgotten").
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Portability: Request your data in a machine-readable format.
• Object: Object to processing based on legitimate interest.

To exercise any of these rights, contact us at support@365i.co.uk. We will respond within 30 days.

10. Cookies

This website uses only essential cookies:

We do not use analytics, advertising, or third-party tracking cookies.

11. Children's Privacy

This service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via the website. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact

If you have questions about this privacy policy or how we handle your data, contact us at:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority.