Privacy notice

This policy explains how Valiss AI processes personal data. We try to keep it short and clear. Questions: hello@valiss.co.

1. Who is the data controller

Valiss AI is operated by Trustbox ApS, a Danish private limited company (CVR no. 37588822) with registered address at Lyngbyvej 83 A, 2100 Copenhagen, Denmark. Trustbox ApS is the data controller for the personal data collected through this website and in connection with Valiss engagements. References to "Valiss AI", "we", or "us" in this policy mean Trustbox ApS trading as Valiss AI.

2. Our two roles: controller and processor

For the personal data we collect ourselves about visitors, leads, and our own customers, for example via forms and in connection with sales, invoicing, and delivery of Valiss engagements, we act as data controller. This policy describes that processing.

When, as part of building or operating a solution for a business customer (for example AI agents, customer-service or booking systems, marketing, or custom-built software), we process personal data about the customer's own end users, the customer is the data controller and we are the data processor. That processing is governed by a separate data processing agreement between us and the customer, not by this policy.

The third-party services listed in our terms of service relate primarily to such customer solutions. They may, but will not necessarily, be used in a specific project, and by default they do not process the data we hold about you as a visitor or lead.

3. What information we collect

When you complete a form on this site, the audit inquiry form or the contact form, we collect the information you provide: typically your name, email address, phone number, company name, website, category, and any comments. That is the information we use to reply to you, run your audit, and follow up with the walkthrough meeting.

When you become a customer, we also collect and process the information necessary to enter into and perform the agreement and to invoice, including contact and company details and invoice information. Payment is handled via QuickPay or by invoice (bank transfer); we do not store full payment-card details.

When you visit this site, we use Ahrefs Web Analytics to understand how the site is used in aggregate. Ahrefs is a privacy-friendly, cookieless analytics tool. We use no other tracking.

When you become a Signal audit customer, we collect the URL and category you provide, and generate audit data by running queries against public AI assistants (ChatGPT, Gemini, Claude, Perplexity), reading publicly available information about your business (your website, your Google reviews, your competitors' websites), and pulling third-party citations. We do not access private systems unless you expressly give us separate access.

4. Why we process the information (legal basis)

We process the information you provide on the basis of your consent (when you complete a form) and performance of a contract (when we deliver audits and engagements you have ordered, and when we invoice). We process invoicing and accounting material to comply with our legal obligations, including the Danish Bookkeeping Act. We process aggregated analytics data on the basis of our legitimate interest in understanding how the site is used.

5. Direct marketing and information emails

If you have given telephone consent to receive information from us, we send you relevant information, offers, and information emails from hello@valiss.co. In that connection we process your name, your email address, and your contact and company details.

The legal basis is your consent under the GDPR and the Danish Marketing Practices Act. We record when and how you gave consent. You may withdraw your consent and unsubscribe at any time by replying to one of our emails or writing to hello@valiss.co, without affecting the lawfulness of processing carried out before then.

6. Who we share information with

We use a small number of processors that handle information on our behalf, under written data processing agreements where required by the GDPR. For the processing where we are the data controller, the main ones are:

• Formspree (USA): receives and forwards form submissions.
• Ahrefs (Singapore / global): provides anonymised web analytics.
• Vercel (EU): hosts this website (EU region) and provides privacy-friendly, cookieless visitor analytics.
• QuickPay (EU): handles payment and invoice payment.
• Public AI assistants (ChatGPT/OpenAI, Gemini/Google, Claude/Anthropic, Perplexity): used to generate audit data from publicly available information.

When we build or operate a solution for a business customer (for example AI agents, voice agents, customer service, booking, or marketing systems), we use third-party services as sub-processors depending on the specific project, and only to the extent necessary for that solution. The main ones are:

• AI models: OpenAI, Anthropic, Google (Gemini), xAI, Mistral, Qwen, Kimi, Meta, and GLM, for language understanding, conversations, and content generation.
• Voice and telephony: Cartesia and ElevenLabs (speech synthesis), Telnyx and Twilio (phone numbers, calls, and SMS).
• Communication and operations: SendGrid (email delivery), Railway and Hostinger (hosting), Microsoft, GitHub, Telegram, Vercel, Sanity, and Formspree.
• Payments: QuickPay and Stripe.
• Business data: Google Places, for looking up publicly available business information. No guest or customer data is sent there.

Hosting and backup of our own systems are located in the EU, and we choose EU regions and EU data processing where the provider offers it. These services relate to those customer projects, do not necessarily process your own information as a visitor or lead, and are set out in the relevant data processing agreement. The full, current list of sub-processors is available on request to hello@valiss.co.

We do not sell your personal data, and we do not share it with advertisers.

7. International transfers

Some of our processors and sub-processors are located outside the European Economic Area (EEA), including in the United States (for example Formspree, OpenAI, Anthropic, xAI, Cartesia, Perplexity, Stripe, Twilio, SendGrid, and Telnyx) and Singapore (Ahrefs). Where personal data is transferred outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework, as relevant. You can obtain a copy of, or further information about, the transfer basis by writing to hello@valiss.co.

8. How long we retain information

• Form submissions: retained for as long as we are in active contact with you, and up to 24 months after our most recent interaction, after which they are deleted.
• Customer audit data: retained for the duration of the engagement and up to 24 months thereafter, for reference in follow-up work and re-audits.
• Invoices and accounting material: retained for 5 years after the end of the financial year to which the material relates, in accordance with the Danish Bookkeeping Act.
• Analytics: aggregated and anonymised; retained indefinitely.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or misuse. Access to data is restricted to what is necessary, and we use processors that provide appropriate security guarantees.

10. Automated decisions and AI

As data controller, we do not make automated decisions with legal effect or similarly significant impact on you based solely on automated processing. Where AI is used in solutions we deliver to business customers, it is done on the customer's behalf and is governed by the data processing agreement and by the customer as data controller.

11. Your rights

Under the GDPR you have the right to: access the personal data we hold about you; have it rectified if inaccurate; have it erased; restrict or object to the processing; receive a copy of it in a portable format (data portability); and withdraw your consent at any time (without affecting prior processing).

To exercise any of these rights, write to hello@valiss.co. We respond within 30 days.

If we process your data as a processor on behalf of one of our business customers, your request should be directed to that customer, who is the data controller. We assist the customer in responding to it.

12. Right to complain

If you believe we are processing your data in breach of the rules, you have the right to lodge a complaint with the Danish Data Protection Agency, datatilsynet.dk.

13. Cookies

We do not use cookies for tracking or advertising. Ahrefs Web Analytics is cookieless. Your browser may set strictly technical cookies as part of serving the site (for example from our hosting provider), but these are not used for profiling.

14. Changes to this policy

We update this policy when our practices change. We publish the updated version on this page and update the "Last updated" date.

15. Contact

Privacy questions or requests: hello@valiss.co.