privacy

last updated 17 october 2026

This policy covers our website at invisibleproductinc.com and our app at app.invisibleproductinc.com. The website sets no cookies and asks you for nothing. Our host counts page views for us, without cookies and without following anyone from one site to the next, and that is the only measurement on it. The app is different, because you sign in to it with Google or Microsoft, you give us your details there and we keep them, and once you start a build we keep a record of the work our service does for it. The rest of this page is mostly about those things.

what the website collects

Nothing you do not send us. There is no form, no account and no newsletter on the website itself. The font is served from our own server rather than a font network, so reading a page tells nobody but our hosts that you were here.

The one exception is the page view itself, which our host counts. That is described below.

what the app collects

If you ask us for a blueprint at app.invisibleproductinc.com, we keep what you type: your name, your email address, your company name and website, any social or LinkedIn pages you choose to add, the apps you tell us you use, and your answers to the few questions we ask. We read your public website to write the blueprint, and we search the open web for your company the way anyone could. We count what writing each blueprint costs us, without noting whose it was.

If you type a web address for a score, our own code reads that site's public pages, its home page and up to six pages it links to for contact, booking, sign-up, pricing, quotes, services, help, questions, payment or ordering, the www address and the address a redirect leads to, and a product feed those pages link, the way any visitor or any search engine could, with no key and no sign-in. It reads the public mail records of its domain, and notes which tools those pages and records name. An email address those pages publish is kept only as a hash, never as the address, so that a person who signs in can be matched to their own site. It keeps the address, what it found and the page's own words it quotes as evidence for our team for ninety days, under a link that anyone who holds it can open. The number it gives is set beside the numbers of the other businesses graded only when every one of its lines could be read, and that comparison holds the domain and the number alone. It is about a business, never a person. It submits no form, writes to no address and sends nothing to that business, and a site whose robots file asks not to be read is not read.

the account that creates

Signing in opens an account with us, so that the blueprint has somewhere to live and you can come back to it. We do not ask for a password. Signing in with Google or Microsoft is how we know the address is yours.

signing in with Google or Microsoft

Signing in is how a blueprint starts: without it there is no account and no blueprint. Google or Microsoft tells us your name and your email address, and vouches for that address. We never see your password. If your company is on neither, write to us and a person starts the blueprint with you.

The same screen asks your permission to read your mail and your calendar, Gmail and Google Calendar or Outlook, both read only. We ask for it because a blueprint written from what your work actually looks like is a better blueprint than one written from your website. We cannot change anything in either account, send anything from them, or delete anything.

When you start a blueprint, from the moment you sign in, our own code reads the headers of your last thirty days of mail, who wrote and when and whether an app sent it, and your calendar's entries, and draws a picture of your business: how many people wrote to you and how many of them from a business address, which apps mail you and which of those bring you enquiries, how many threads are waiting on your reply, and how many meetings you hold with people outside your company. The picture holds counts, the names of apps and the domain of your own address, never anyone else's address, name or subject. It is kept for thirty days with the blueprint it was drawn for, finished or not, and it is shown on that blueprint's page, which opens for anyone you give the link to. If you sign in with a business address we read the public website at its domain, and offer it as your website and the name it gives itself as your company, for you to confirm or change.

Granting it stores a key that lets us ask Google or Microsoft for that data later. We keep that key encrypted, and you can tell us to delete it at any time by writing to the address below. Deleting your account deletes it too, and if you do not come back we forget that key ourselves after thirty days.

From the day you enter your card for a build, the system runs on that permission. It reads the mail of the last thirty days to find the threads that have waited on your reply for three days or more, and shows them on your dashboard: who wrote, the subject, and how long it has waited. The list is refreshed every fifteen minutes, and when you open your dashboard; the list each read makes is kept for an hour and replaced by the next, and it is shown to you alone. Nothing is sent to anyone, and none of it reaches OpenAI. Once you have entered your card for a build we keep the key that lets us read until you delete your account, and deleting the account deletes the list with it. This reads Gmail and Outlook.

While your system is built, a chat sits beside it on your dashboard. You can write to us there, share files, and answer what the build needs from you: a question, a file, or a credential such as a database connection. People on our team read the chat to answer you, and read your answers and your files to build your system and to check that each part does what you asked. What you write, your answers and your files are kept with the build until you delete your account. Once you start a build, what we learned about your business for its blueprint (what you do, who your clients are, how you win work, your website and your answers to our questions) is kept with the build too, until you delete your account, and you can see it there and correct it. A credential is encrypted with the same key as your sign-in permission, is read only by our team while building your system, and every time it is read we record who read it.

From the day your build starts, we also keep a record of the work our service does for it: how often each part of your system ran, whether it worked and how long it took, how often you opened what it shows you, and how much of OpenAI's service each reply in the chat and each plan used. The record holds counts and times only, never a message, a subject, a name or an address, and nothing counted from your mail or your calendar. Our team reads it to keep your system working, to keep its cost down and to set our prices. It is kept in the same database as your account and sent to no one. It is deleted with your account.

If you decide to go ahead, you enter your card on Stripe's own page once we have learned your business and shown you the price, before we build your solutions, and Stripe saves it. Apart from any deposit you were shown, nothing is charged until what we build is live, and from that day Stripe charges your card once a month. We send Stripe your email address, the price and sometimes your company's name, and we never see your card number. Stripe tells us whether your card was accepted and whether a charge went through, and Stripe's own privacy policy governs what they keep.

You can also withdraw the permission yourself at any time from your Google account's permissions screen, at myaccount.google.com/permissions, or from your Microsoft account at account.live.com/consent/Manage. Please note that Bubbl, our own product, is registered with Google and with Microsoft as the same application, so withdrawing it there also ends any Bubbl access you have granted. Asking us to delete our copy does not touch Bubbl.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell it, we do not use it for advertising, we do not use it to train any general-purpose model, and no human at our company reads it except where you ask us to, where we must for a security or support reason you have raised, or where the law requires it.

where it is kept

In Google Cloud Firestore, in the United States, in a database that is ours alone. Anything that would let us reach another account of yours is encrypted before it is written there. A blueprint, for its thirty days, and the list of threads waiting on your reply, for its hour, are held instead on the server that runs our app, which also keeps short lived counts of requests by IP address so that nobody can flood the app. Your session is kept in your browser's own storage rather than a cookie, for thirty days or until you sign out, so you stay signed in between visits on that browser.

what our hosts record

The website and the app are hosted by Vercel and served through Cloudflare. Both keep ordinary server logs of requests, including IP address, the page requested, and the browser's user agent. That is standard for any website and we use it to keep the service up. We do not join it to anything else and we do not build a profile from it. Cloudflare also rewrites the email addresses printed on our pages and adds a small script of its own to turn them back into working links. It is served from our own address and it does not track you.

Cloudflare also counts page views for us, through a product of theirs called Web Analytics. It tells us which pages were read and roughly where in the world from, and that is all we use it for. It sets no cookie, it stores nothing in your browser, it does not fingerprint you, and it cannot follow you from this site to another one. It is the only measurement on the website, and if you block the request nothing on the page stops working.

if you email us

When you write to us we receive your address and whatever you put in the message. We use it to reply and to keep a record of the conversation. We do not add you to a mailing list from it.

if you become a client

Work we do for you involves information you give us on purpose, and this page covers it. Where we have also signed an agreement with you, including confidentiality, that agreement controls wherever it and this page differ.

the product is separate

Bubbl is our own product, with its own account, its own data and its own privacy policy. An account here is not a Bubbl account and never becomes one. The two hold their data in separate databases, and neither reads the other's.

One thing is shared, and you will see it: we are registered with Google and with Microsoft as a single application, so their sign-in screens carry Bubbl's name even when you are signing in to this app. It is the same company either way. What is not shared is you. Signing in here creates an account here, in this app's own database, and no profile of yours moves between the two.

if you book a call

The calendar is run by Calendly. When you book, they receive your name, your email address, the time you chose and anything you type in their box, and they hold the booking. We also pass them a link to the blueprint you were reading, so we know which one the call is about. Booking is the only thing on our pages that sends anything to them, and reading a blueprint does not.

who we share with

We do not sell personal information and we do not share it for advertising. The companies that see anything are the ones named above, our hosts and our cloud provider, Calendly if you book a call, our email provider for mail you send us, and Resend, which emails our team its own notices, such as a new build or a chat that needs a person, and so carries your name, your email address and what you wrote. We also send your company's name, the text of your website and your answers to OpenAI, which is what writes the blueprint, and what you write in the chat beside your build, with the text of files you share there, which is what writes the chat's replies and the plan for your build. A credential you give us never goes to OpenAI, and the chat refuses one typed into it. We do not send it the contents of your mail or your calendar. Our own code counts a few things from message headers and calendar entries, such as how many threads are waiting on your reply, how many people wrote to you and how many of them from a business address, and how many meetings you hold with people outside your company, and notes which apps send you mail and which of those bring you enquiries. Those counts and app names are the only thing from your mail or calendar that reach OpenAI.

how long we keep things

A blueprint deletes itself thirty days after it is made. What you write in the chat, your answers, your files and the plan for your build we keep until you delete your account. The record of the work our service does for your build we keep until you delete your account. Server logs are kept by our hosts for their standard retention period. Email we keep for as long as the conversation is useful. Your account, and any permission you granted with it, we keep until you ask us to delete it, and we will delete it whenever you ask.

your choices

You can ask us what we hold about you, ask for a copy, or ask us to delete it, including your account, by writing to the address below. You do not need an account to ask, and we do not charge for it.

changes

We update this policy when what we do changes. The date at the top is the version you are reading.

contact

Privacy questions go to [email protected].