Information we collect
The information depends on how you use Vicin.
- Account and contact information, such as your name, email address, organization, role, and account preferences.
- Authentication and security information, such as session identifiers, sign-in events, IP addresses, device and browser details, and records used to prevent abuse.
- Business and workspace information, such as locations, websites, team membership, client relationships, saved settings, and reports.
- Information from accounts you choose to connect, including Google Analytics 4, Google Search Console, Google Ads, and Google Business Profile data.
- Billing and subscription information when you purchase a paid subscription, including subscription status, payment amounts, transaction identifiers, invoices, billing records, and information needed to administer the subscription. Stripe processes payment-card information through its hosted checkout. Vicin does not receive or store complete payment-card numbers.
- Messages, support requests, and other information you submit to Vicin.
- Questions submitted through Vicin bot. Before storage, an automated scrubber removes email addresses, phone numbers, and payment-card numbers it recognizes. A name, street address, or other personal detail typed into a question may remain, so do not include personal information. Vicin does not attach a Vicin account or the visitor's IP address to the stored question. Vicin records counts of how often the question is asked and whether an answer was helpful.
- Publicly available business and area-level information used for business research, including business listings, public reviews and associated public reviewer and profile information, maps, economic data, and demographic statistics.
- Website activity needed to operate, secure, and understand use of Vicin.
How we use information
Vicin uses information to:
- Create and secure accounts.
- Connect authorized data sources and show the requested measurements, reports, comparisons, and recommendations.
- Measure and improve the performance of the public Vicin website when a visitor allows analytics.
- Maintain the service, diagnose errors, support users, and improve reliability.
- Improve Vicin bot answers and customer support.
- Prevent fraud, misuse, and unauthorized access.
- Communicate about an account, a request, a service change, or a security matter.
- Meet legal, tax, accounting, and regulatory duties.
Vicin does not use personal information to make eligibility decisions about housing, credit, employment, insurance, or other regulated benefits.
Google user data
Vicin accesses Google user data only after an authorized user chooses a Google account and grants permission. Access tokens are used to request the selected data. Stored Google refresh tokens are encrypted. A user can disconnect a Google connection in Vicin or revoke access from the Google Account permissions page.
Data and permissions Vicin requests
- Basic Google account identity: name, email address, and profile information used to identify the connecting user.
- Google Analytics 4: read-only property, traffic, acquisition, engagement, event, conversion, and related reporting data.
- Google Search Console: read-only property, query, page, country, device, impression, click, click-through rate, and position data.
- Google Ads: authorized customer, campaign, keyword, device, geography, spend, click, conversion, and related reporting data.
- Google Business Profile: account, location, review, performance, and related business profile data for locations the user is authorized to manage.
- Gmail: the "Send email on your behalf" permission (gmail.send) sends a monthly client report email with its PDF attached from your connected Gmail or Google Workspace address. Vicin asks for this separate permission only when an account owner or Full member selects Connect Gmail in Generate Report. It requests basic account identity and Gmail send access, with no other Gmail permission. You set the recipients, subject and message. Vicin sends when you select Send report, or on the day you choose for a business when you turn on Send automatically every month. Vicin does not read, list, search, change or delete messages in your mailbox. Gmail connection information and report email settings are not shared with AI providers or used for advertising. Google receives the email and attached PDF to deliver them to the recipients you choose.
Google Business Profile provides the business.manage permission and does not provide a separate read-only permission. Vicin uses this permission to read connected Business Profile information and to make listing changes only when an authorized account user confirms them in Vicin.
Google API Services User Data Policy
Vicin's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Vicin uses Google user data only to provide or improve the user-facing features the user requested. Vicin does not sell Google user data, does not use Google user data for advertising, and does not transfer it for advertising, retargeting, credit, or lending. Human access is limited to:
- Support after the user affirmatively authorizes Vicin personnel to access the specific Google data needed for the support request.
- Security purposes, such as investigating a bug or abuse.
- Compliance with applicable law.
- Aggregated internal operations where the data cannot identify a person.
Sharing, transfer, and disclosure of Google user data
Vicin shares, transfers, or discloses Google user data only in the limited circumstances below and as permitted by the Google API Services User Data Policy.
- Service providers and subprocessors. Vicin may provide Google user data to providers that host, secure, back up, monitor, or support Vicin only as needed to provide or improve the user-facing features you authorize and with your consent. Their use of the information is contractually limited to those services and must comply with applicable Google API data-use requirements.
- Anthropic. When you request an AI-assisted feature that requires Google-derived information, Vicin may send the information needed for that feature to Anthropic, Vicin's current AI service provider. Vicin does not share Gmail connection information, Gmail report-email settings, or mailbox contents with Anthropic.
- Google and connected Google services. Vicin sends information to Google to perform actions you authorize. When you send a report through Gmail, Google receives the email and attached PDF for delivery.
- Recipients you select. The report email, message, and attached PDF are delivered to the recipients you select, at your direction.
- Authorized Vicin workspace members. Google-derived information may be accessible to members of the same customer workspace according to their assigned access and the features available to them.
- Security and legal requirements. Vicin may disclose Google user data when necessary to investigate security incidents, fraud, or abuse, or to comply with applicable law or valid legal process.
- Business transfers. Vicin may transfer Google user data as part of a merger, acquisition, or sale of its assets only as permitted by the Google API Services User Data Policy and after obtaining your explicit prior consent.
Vicin does not sell Google user data or transfer or disclose it for advertising, retargeting, credit or lending decisions, surveillance, data brokerage, information resale, or training a general-purpose AI model.
AI-assisted features
Vicin may use third-party artificial intelligence providers to support AI-assisted features. When a user requests an AI-assisted feature, Vicin may send the provider information supplied by the user, information from connected accounts, information Vicin calculates or derives from connected-account data, and related business or website data needed to provide the feature. Vicin limits these transfers to information reasonably needed for the requested feature. Connecting a Google account does not by itself send connected-account data to an AI provider.
Vicin currently uses Anthropic as an AI service provider and subprocessor. Anthropic states that commercial API inputs and outputs are not used to train its generative models by default. Anthropic normally deletes API inputs and outputs within 30 days, except when another period has been agreed or longer retention is needed for policy enforcement or compliance with law.
Vicin transfers Google user data, including information Vicin calculates or derives from it, to AI providers only to provide or improve user-facing features requested by the user. Vicin does not use or transfer Google user data for advertising, retargeting, credit or lending decisions, surveillance, or training a general-purpose AI model. Vicin's use and transfer of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.
AI-generated content may be incomplete or inaccurate. It does not establish cause, confirm that an action was completed, or guarantee a business result. Vicin will provide notice or seek consent when required before materially changing how personal information or Google user data is used or shared.
Customer-controlled data
A customer may connect or provide information it controls on behalf of a client. Vicin processes that information to provide the service requested by the customer and according to the customer's instructions and the applicable agreement. The customer is responsible for having the authority and permissions needed to provide or connect that information.
Retention and deletion
Vicin keeps account, business, and connected-source information while an account is active and as reasonably needed to provide the service, resolve disputes, protect accounts, and meet legal, tax, and accounting duties. Security and audit records are kept as needed for fraud prevention, account protection, and legal obligations. Vicin keeps bot question text and its question and feedback counts in a rolling 30-day log. The log is available only through Vicin's restricted operator control panel. Separate spam-prevention records may contain a visitor's IP address and are deleted within 48 hours. Vicin reads Google Business Profile reviews when the Reputation page opens and does not retain their text or reviewer details for Reputation reports. Disconnecting a source stops future collection but does not by itself delete previously stored reporting history, except where this policy states otherwise. Vicin attempts to revoke the Google authorization. Gmail refresh tokens are encrypted at rest and used only by Vicin's servers. Disconnecting Gmail stops future report sends from that address. Vicin requests revocation at Google when you disconnect. Connecting a different address stops use of the old address for report sending and queues its grant for revocation. A token awaiting confirmed revocation remains encrypted and is used only to retry revocation. Recipient addresses, subject, message and monthly schedule are stored with the business's report email settings. Vicin keeps report email records for 24 months, including the send date, report month, number of recipients, who sent it and result. An account holder may request deletion through the Vicin contact page. Some information may remain where retention is required by law, needed to protect legal rights, or held temporarily in encrypted backups until those backups expire or are replaced.
Your choices and privacy requests
Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of personal information, and to appeal a denied request. You can update some account information in Vicin, disconnect a connected source, or revoke Google access from your Google Account. To make another privacy request, use the Vicin contact page. Vicin may need to verify your identity and authority before completing a request. Authorized agents may submit a request where applicable law allows it.
How information is protected
Vicin uses access controls, encryption for stored Google refresh tokens, encrypted off-site backups, monitoring, and other administrative and technical safeguards suited to the information handled. No storage or transmission method can be guaranteed completely secure. If you believe an account or connection is at risk, use the Vicin contact page.
Children
Vicin is intended for business and professional users who are at least 18 years old. Vicin is not directed to children and does not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact info@vicin.io.
Changes to this policy
Vicin may update this policy when the service, data practices, or legal duties change. The effective date at the top will be updated. If a change materially affects how previously collected information is used, Vicin will provide additional notice or seek consent when required.
Contact Vicin
Privacy questions, requests, complaints, and legal notices may be sent to info@vicin.io or through the Vicin contact page. Include enough information for Vicin to identify the relevant account and request. Do not send passwords, access tokens, or other secrets.