Privacy Policy

Last updated: 22 October 2026

This policy explains how OmniPATH AI Ltd (“OmniPATH”, “we”, “us”) collects and uses personal data when you visit anvero.ai, run the free AI Visibility Audit, use the Anvero platform, or ask a question in an Anvero Answer widget on one of our customers’ websites. Anvero is an OmniPATH product.

The short version

  • We sell to businesses. If you use Anvero for your organisation, we hold the account details we need to run it.
  • On our customers’ websites, the Answer widget sets no cookies, stores nothing on your device, doesn’t log IP addresses and doesn’t fingerprint visitors. Questions are stored with personal details redacted.
  • When you run the free audit, we scan the public website you enter. If you ask for the full report, we keep your email address to send it.
  • Answers, drafts and AI visibility measurements are generated through AI providers’ business APIs. Our service and database run on Google Cloud in London.
  • We never sell personal data.
  • You can ask to see, correct or delete your data at any time: support@omnipath.ai.

1. Who we are

OmniPATH AI Ltd is a company registered in England and Wales (company number 14126969), with its registered office at The Henley Building, Newtown Road, Henley on Thames, RG9 1HG.

For anything about this policy or your data, email support@omnipath.ai or write to us at the address above.

2. Our two roles

How we use personal data depends on whose data it is.

  • We are the controller for people who visit anvero.ai, run the free audit, contact us or book a call, and for the people at our customers who use the Anvero platform (account admins and billing contacts). Sections 3 and 9 to 14 cover this.
  • We are a processor for the content our customers ask us to index and for the questions visitors ask in an Answer widget on a customer’s website. The customer decides how that data is used and their own privacy notice applies; we act only on their instructions under our data processing terms. Section 4 covers this.

If you asked a question on another company’s website and want to know what happened to it, contact that company first. We will help them answer you.

3. What we collect and why

Visiting anvero.ai

  • Questions you ask our own Answer widget. Handled exactly as on our customers’ sites (section 4): personal details redacted, nothing stored on your device.
  • Server logs. Our website host keeps standard server logs, which include IP addresses, for security and troubleshooting, for up to 30 days. Lawful basis: legitimate interests in keeping the site secure.

The free AI Visibility Audit

  • The website address you enter. We scan that site’s public pages, robots.txt, sitemap, page meta and structured data, and test how its firewall or CDN responds to AI crawlers. We scan public websites only.
  • Your email address and consent record, if you unlock the full report. We use them to send the report you asked for and, only if you agreed, to follow up about it. Every email has a one-click unsubscribe. Lawful basis: taking steps at your request before a contract, and consent for follow-up.
  • Abuse prevention. To stop the audit being misused we limit scans per visitor and per website. We store a one-way hash of your IP address with the scan and with any report request, and use it only for these limits and to investigate misuse. Lawful basis: legitimate interests.

Using the Anvero platform

  • Account details: name, work email address, organisation and role. Sign-in is by a one-time link sent to your email; we don’t hold passwords. Lawful basis: contract.
  • What you do in the platform: settings, approvals, to-do lists, notes and the sites you manage, so the service works and your team can share the work. Lawful basis: contract.
  • Service emails and notifications: digests, alerts and, if you turn them on, browser push notifications (we store the push subscription your browser gives us). You can change frequency or unsubscribe in one click. Lawful basis: contract and legitimate interests.
  • Connected accounts: if you connect Google Search Console, Google Analytics 4 or Bing Webmaster Tools, we use read-only access to show search and traffic figures for your site. Connection tokens are encrypted at rest. Lawful basis: contract.

Billing

Payments are handled by Stripe. We hold the billing contact, company details, VAT number and invoice history; Stripe holds your card details and we never see full card numbers. Lawful basis: contract and legal obligation (tax and accounting records).

Talking to us

If you email us, book a call or ask for a demo, we keep your name, email address, organisation and what you told us so we can reply and, if you become a customer, set you up. Lawful basis: legitimate interests and taking steps at your request before a contract.

We may occasionally email people at businesses about Anvero where we have a legitimate interest in doing so. You can opt out at any time and we will stop.

4. The Answer widget on our customers’ websites

When a customer adds the Anvero Answer widget to their website, we process the following on their behalf.

  • Questions and answers. The questions visitors type and the answers generated. Personal details such as names, email addresses and phone numbers are redacted before a question is stored.
  • Nothing on the visitor’s device. The widget sets no cookies and stores nothing in the browser. It doesn’t log IP addresses or fingerprint devices. A conversation is held only for that visit.
  • Counts, not people. We count which answers were given and which next step was chosen (for example “Book a call”), without linking those counts to a person.
  • The customer’s published content. We index the pages a customer publishes so the widget can answer from them. Those pages can include staff names, roles and contact routes (for example on team pages), which the widget uses to suggest the right person.

How long widget questions are kept is set in the customer’s agreement with us; by default, 12 months.

5. AI visibility measurements

  • Listen puts buyer questions to AI engines and stores the full responses so we can report how often a customer is named and cited. The questions are about companies and products; if a response mentions an individual, we use it only for that customer’s report.
  • Reach and the free audit read public pages and test how a site responds to AI and search crawlers. They don’t collect personal data about the site’s visitors.

6. AI providers and model training

We generate answers and drafts, and sample AI engines for Listen, through the business APIs of AI providers (Anthropic, OpenAI, Google and Perplexity). Under those providers’ business terms, data sent through their APIs is not used to train their models.

We don’t use customer content or visitor questions to train AI models. Each customer’s content is kept separate at database level, and one customer’s content is never used to answer questions on another customer’s site.

7. Who we share data with

We share personal data only with service providers who process it for us under contract, and only as much as they need:

  • Google Cloud — hosting and database, London (europe-west2).
  • Pinecone — search index, Ireland.
  • AI providers — Anthropic, OpenAI, Google and Perplexity (United States), to generate answers and drafts and to sample AI engines.
  • Stripe — payments and invoicing.
  • Resend — service emails, reports and digests.
  • WP Engine — hosting for anvero.ai.
  • Cloudflare (via WP Engine) — website delivery and bot protection for anvero.ai.

We may also share data with professional advisers, with authorities where the law requires it, or with a buyer if our business is sold (they would be bound by this policy). We never sell personal data. Our current list of sub-processors is available on request at support@omnipath.ai.

8. International transfers

Our service and database run in the UK, and our search index runs in Ireland. Some providers — in particular AI providers — may process data outside the UK, including in the United States. When that happens we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified), or on the ICO’s International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard used for any provider.

9. How long we keep data

  • Audit reports and the email you gave us: until you unsubscribe or ask us to delete them.
  • Account data: while the subscription runs, then deleted within 90 days of it ending, except what we must keep by law.
  • Invoices and billing records: six years, as UK tax law requires.
  • Widget questions (redacted): as set in the customer’s agreement; by default 12 months.
  • Listen responses and measurements: 13 months, or until the subscription ends if sooner.
  • Server logs: 30 days.
  • Backups: overwritten on a rolling 7-day cycle.

10. Keeping data secure

We keep each customer’s data isolated at database level, encrypt data in transit and connection tokens at rest, keep keys out of logs, limit access to the people who need it, and apply spend caps and usage limits to our AI services. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

11. Your rights

You have the right to:

  • ask for a copy of your personal data;
  • ask us to correct it;
  • ask us to delete it;
  • ask us to restrict or stop using it, or object to how we use it;
  • ask for it in a portable format;
  • withdraw consent at any time, where we rely on consent.

Email support@omnipath.ai. We will reply within one month, and there is no charge. If your request is about a widget question on a customer’s website, we will pass it to that customer and help them respond.

If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

12. Cookies

  • The Answer widget sets no cookies and stores nothing on your device, on our site or on our customers’ sites.
  • anvero.ai uses one session-storage entry to remember which product module you clicked through to from another page. It is cleared when you close the tab and is not used for tracking. Cloudflare, which delivers the site, sets one strictly necessary cookie (__cf_bm) for up to 30 minutes to tell people from bots.
  • The Anvero app stores a sign-in token and your display preference in your browser’s local storage. Both are strictly necessary.

13. Children

Anvero is a service for businesses and is not directed at anyone under 18.

14. Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell customers by email before it takes effect.

15. Contact

OmniPATH AI Ltd, The Henley Building, Newtown Road, Henley on Thames, RG9 1HG · support@omnipath.ai