A Visibility Mesh scan reads only the public pages of your website, the same pages any visitor or search crawler can see, and the scan data is processed to provide your assessment, and in de-identified form for aggregate research, in the United States by the providers named in our Data Processing Agreement. The AI analysis runs on Anthropic's API, and Anthropic's Commercial Terms of Service say Anthropic may not train models on customer content from its services.
Anyone who hands a company their website deserves to know what that company touches and what it does with it. This page answers both in ordinary words. The binding versions are our Data Processing Agreement and our Privacy Policy, and where this page and those documents differ, those documents decide.
What does a scan read?
A standard scan fetches the public pages of the site you give us, such as the homepage, product pages and collections, plus the public files every crawler reads, such as robots.txt and the sitemap. It does not need a password and does not log into your store. We keep your account details (name, email and plan) and the history of your scans, because comparing one scan with the next is part of the service.
Two services go further, and only with your permission. If you install our Shopify app, it reads the store data listed on the permission screen you approve during installation. If you buy a setup service such as Foundation, you give our team staff access to your store so we can make the agreed changes. Our DPA covers both as connected store data.
What do you do with my scan data?
Our DPA says we process the URLs you submit, the page content, uploaded files and connected store data solely to provide the assessment, reporting, progress tracking and remediation services. The DPA also allows us to create de-identified, aggregated data for benchmarking and research. That is how our published studies work: a figure such as "the median Shopify store scored 46 out of 100" describes a group of stores and does not identify any one of them.
Payments run through Shopify's checkout, so we never see or store full card numbers.
Where is my data stored, and who processes it?
Data is processed in the United States. Our DPA names every sub-processor, and the current list has six.
| Provider | What it does for us | Location |
|---|---|---|
| Anthropic | AI analysis of scanned pages | US |
| Supabase | Database and file storage | US |
| Railway | Hosting | US |
| Make.com | Workflow automation | US |
| Shopify | Commerce and billing | Canada and US |
| Resend | Transactional email | US |
We give 30 days' notice by email before that list changes, and a customer may object on reasonable data protection grounds. Fewer vendors, each one named, is a deliberate choice. Auditors cannot check a vendor nobody has named, so we name all of them.
How is my data protected?
The controls are the ordinary, correct ones, and the DPA lists them. Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest. Row level security is set to deny by default, so one account cannot read another account's data, and access is limited to what each person needs. Every administrative account uses multi-factor authentication, with a hardware key on the most sensitive accounts.
No security measure is perfect, and our Privacy Policy says so. If a personal data breach affecting your data were confirmed, the DPA commits us to notify you without undue delay and within 72 hours.
Does your AI provider train on my data?
Our scan analysis sends page content to Anthropic's API so the model can produce your assessment. Anthropic's Commercial Terms of Service, effective June 17, 2025, state that Anthropic may not train models on customer content from its services. We name the provider because you should know which AI reads your pages.
How do I delete my data or remove your access?
Each of these requests takes a few minutes to make.
- To ask for deletion, email support@visibilitymesh.com from the address on your account and write "Delete my data" in the subject. After an account ends, the DPA gives you 30 days to export your reports, and we then delete or de-identify your personal data within 90 days, except where the law requires us to keep it.
- To remove staff access after a setup service, go to Settings > Users and permissions in your Shopify admin, open the staff account we used, and click Remove staff account.
- To remove the Shopify app, go to Settings > Apps, click the three dot menu next to Visibility Mesh and choose Uninstall.
- To opt out of advertising based on your visits to our website, use the form on our Your Privacy Choices page. A browser that sends the Global Privacy Control signal is treated as an opt out too.
What about cookies on your website?
Our website is a Shopify store, and like most Shopify stores it uses cookies. Our Privacy Policy explains that information from visits to the website may be used for marketing and shared with advertising partners, and our Your Privacy Choices page lets you opt out. That covers how you browse our website. The content of your scans is governed by the DPA described above.
What does this look like for a real customer?
Take a wine shop on Shopify that runs a free scan, then buys the Foundation setup. The free scan fetches five public pages and the robots.txt file, and the results go to the owner's email. For the setup, the owner adds a staff account for our team with the permissions the work needs. When the work and the second scan are finished, she removes the staff account in Settings > Users and permissions. Her scan history stays in her account until she asks us to delete it.
Questions store owners ask
Do you log into my Shopify store?
A standard scan does not. It reads only your public pages. Our Shopify app reads the store data you approve when you install it, and a setup service uses a staff account you create and can remove at any time.
Does Anthropic train AI models on my scan data?
Anthropic's Commercial Terms of Service say Anthropic may not train models on customer content from its services. Our scans use Anthropic's API under those terms.
Do you sell my scan data?
We do not sell your scan data. Our DPA limits the processing of scan data to providing your assessment, reporting, progress tracking and remediation. We may use de-identified, aggregated data that identifies no one for benchmarks and research.
Where is my data stored?
Data is processed in the United States by six named sub-processors: Anthropic, Supabase, Railway, Make.com, Shopify and Resend. We give 30 days' notice before that list changes.
How do I delete my data?
Email support@visibilitymesh.com from the address on your account and ask for deletion. After an account ends, we delete or de-identify personal data within 90 days, except where the law requires us to keep it.
Sources
- Data Processing Agreement, Visibility Mesh, including Annex A (sub-processors) and Annex B (security measures).
- Privacy Policy, Visibility Mesh, last updated September 25, 2026.
- Commercial Terms of Service, Anthropic, effective June 17, 2025, opened November 9, 2026.
Our trust and security page collects the rest of our security documents. You can see exactly what a scan reads by running the free scan on your own site.