Effective: October 22, 2026 · Last updated: October 28, 2026
This policy explains what personal information AI Visibility Journal (“AVJ”, “we”, “us”) collects, why, who processes it, how long we keep it and what rights you have. We have kept it short and specific.
1. Who we are
The controller responsible for your personal information is Nhi Phan, founder, trading as AI Visibility Journal, Delaware, United States. AI Visibility Journal is an independent publication owned by its co-founder. Contact: [email protected].
2. The short version
- If you subscribe to our newsletter, we collect your email address (and your name, if you choose to give it).
- In the EU/EEA, UK and Switzerland, optional analytics and embedded media load only if you accept them. Elsewhere, Google Analytics runs by default and you can turn it off with Reject all; embedded media always wait for your consent. We do not use advertising trackers or social media pixels. Details are in Cookies.
- We do not sell your personal information or share it for targeted advertising.
- You can unsubscribe at any time and ask us to access, correct or delete your data.
3. What we collect and why
| Data | When | Purpose | Legal basis (EU/UK) |
|---|---|---|---|
| Email address; name (optional) | You subscribe | To send the newsletter you asked for, after you confirm by email | Consent (withdraw at any time by unsubscribing) |
| Newsletter engagement (opens, clicks), sign-up page | When you receive our emails | To see which content is useful and to keep our emails out of spam folders | Legitimate interests (you can object; see §8) |
| Messages you send us | You email us | To reply, investigate corrections or follow up tips | Legitimate interests |
| Interview correspondence, answers and photos you provide | If you agree to be interviewed | To prepare and publish the interview you agreed to | Consent and our agreement with you |
| Aggregated website statistics (pages viewed, referring site, browser and device type, approximate location) | In the EU/EEA, UK and Switzerland, only if you accept analytics; elsewhere on by default (off if you choose Reject all or send a Global Privacy Control signal) | To understand and improve the site | Consent (EU/EEA, UK, CH); legitimate interests elsewhere |
| Technical request data (IP address, browser, time) | When you visit | Security, preventing abuse and keeping the site running | Legitimate interests |
We do not ask for sensitive personal information, and we ask you not to send it.
Sources and tips. If you send us information as a source, we protect your identity in line with our Editorial standards and use the information only for journalism. Data protection laws contain specific exemptions for journalism; we rely on them only where appropriate. We do not put confidential source material or readers’ personal data into AI tools (see our AI Use Policy).
4. Cookies and similar technologies
We keep this list short and specific. It reflects what our website actually sets, checked on 22 October 2026.
Your choice. When you first visit, a notice lets you Accept all, Reject all or choose Preferences. In the EU/EEA, UK and Switzerland, optional features stay off until you accept them. Elsewhere, Google Analytics is on by default unless you choose Reject all or send a Global Privacy Control signal; embedded media still wait for your consent. You can change your choice at any time with Cookie settings at the bottom of every page. We remember your choice for six months, then ask again; we also ask again if this list changes in a way that needs your consent. If your browser sends a Global Privacy Control or Do Not Track signal, optional features stay off unless you turn them on.
| Name | Category | Provider | Purpose | Duration |
|---|---|---|---|---|
avj_consent | Strictly necessary | AI Visibility Journal | Remembers your cookie choice | 6 months |
__cf_bm, cf_clearance | Strictly necessary | Cloudflare | Set only when Cloudflare needs to check for malicious bots; not tied to your identity | 30 minutes; cf_clearance up to 30 days |
wordpress_logged_in_*, wordpress_sec_*, wp-settings-* | Strictly necessary | AI Visibility Journal (WordPress) | Sign-in for our staff only; readers never receive them | Session to 1 year |
_ga | Analytics | Google LLC | Distinguish visitors for statistics. Only with your consent in the EU/EEA, UK and Switzerland; elsewhere on by default, off if you choose Reject all or send a Global Privacy Control signal | up to 2 years |
_ga_<ID> | Analytics | Google LLC | Distinguish visitors for statistics. Only with your consent in the EU/EEA, UK and Switzerland; elsewhere on by default, off if you choose Reject all or send a Global Privacy Control signal | up to 2 years |
| Embedded media from third parties (for example video players) | Embedded media, only with your consent | The embed’s provider | Shows content hosted elsewhere; the provider may set its own cookies, described in its privacy policy | Set by the provider |
We do not use advertising, marketing or cross-site tracking cookies, and we do not use social media pixels.
Newsletter form. Our sign-up form sends your email address to Resend only when you press Subscribe.
5. Who processes data for us
We use service providers (“processors”) that act on our instructions:
| Provider | Purpose | Where data is processed |
|---|---|---|
| Contabo GmbH | Server hosting for our website, including its database, server logs and backups, under a GDPR data processing agreement | Germany (EU) for the personal data of EU, EEA and UK readers that we store |
| Cloudflare, Inc. | Content delivery, DNS and security; processes visitor IP addresses and request data | Global network (United States company) |
| Google LLC (Google Analytics 4) | Website statistics: pages viewed, approximate location, device and browser, via cookies; advertising features and Google signals off | United States |
| Resend, Inc. | Email delivery for the newsletter: email address, signup/confirm timestamps, open/click events | United States |
| Bot-traffic analytics provider (third party) | Server-side analytics of requests from automated bots and crawlers only: requested URL, referrer, IP address and country of the requesting bot; no cookies or scripts in readers’ browsers | United States |
| Google LLC (Google Workspace) | Our business email, including interview correspondence, under Google’s Cloud Data Processing Addendum | United States and other countries where Google operates |
We do not sell personal information. We may disclose information if the law requires it, to protect our rights or safety, or as part of a transfer of the publication, in which case this policy continues to apply.
6. International transfers
AI Visibility Journal is based in the United States, and our small team works from the United States, Singapore and Vietnam. Our servers are currently located in the United States and Germany. The personal data of readers in the European Union, the EEA and the UK that we store, such as our website database and server logs, is held on servers in Germany operated by Contabo GmbH. Our website content is delivered through Cloudflare’s global network. We may add servers in Japan or Singapore in the future; if we do, we will update this policy before any personal data is stored there. Some of the service providers listed in section 5 process personal information in the United States and, in Cloudflare’s case, on a global network close to where you are.
When you give us your information (for example, by subscribing), you give it directly to us, and this policy and the GDPR protections described here apply wherever it is processed. When personal information from the European Economic Area, the United Kingdom or Switzerland is handled by our providers outside those regions, it is protected as follows:
| Provider | Country | Safeguard |
|---|---|---|
| Contabo GmbH | Germany (EU) | No transfer: EU, EEA and UK readers’ data we store is held in Germany, under a GDPR data processing agreement |
| Cloudflare, Inc. | United States (global network) | Certified under the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework; Standard Contractual Clauses as a fallback |
| Google LLC (Google Workspace) | United States | Bound by Google’s Cloud Data Processing Addendum. Certified under the EU–U.S. Data Privacy Framework, its UK Extension and the Swiss–U.S. Data Privacy Framework; Standard Contractual Clauses as a fallback |
| Resend, Inc. | United States | Data processing agreement; Standard Contractual Clauses as applicable for EU/UK transfers |
You can check a provider’s certification at dataprivacyframework.gov. Each of these providers is bound by a data processing agreement that limits it to acting on our instructions. If a framework ceases to apply, the Standard Contractual Clauses (with the UK Addendum for UK data) take its place. We do not ask you to consent to transfers as a substitute for these safeguards.
Our team may access the information described in this policy from the countries where we work, using the same providers, encrypted connections and two-factor authentication. Laws in other countries may differ from those where you live, and information held there may be accessible to local courts and authorities under their laws.
Australia. Personal information about Australian readers may be stored or accessed in the United States and in Germany (European Union), where our servers are located, and accessed by our team from Singapore and Vietnam. We use only providers bound by contracts that require them to protect it.
To request a copy of the relevant safeguards, or to ask anything about transfers, email [email protected].
7. How long we keep data
- Subscribers: while you are subscribed. If you ask us to delete your data, we do so within 30 days. If you only unsubscribe, we keep your email address on a suppression list so we do not email you again.
- Correspondence: up to three years, unless we need it longer for a correction, a legal claim or our journalistic record.
- Interview material: for as long as the interview is published, plus our editorial archive.
- Server and security logs: up to 7 days.
- Your cookie choice: six months.
8. Your rights
Depending on where you live, you may have the right to access, correct or delete your personal information; restrict or object to how we use it (including uses based on legitimate interests); receive it in a portable format; and withdraw consent at any time. You can unsubscribe from the newsletter with the link in every email. For anything else, email [email protected]. We will respond within one month, or sooner if your local law requires, and we may need to confirm your identity.
European Union and United Kingdom. You can complain to the data protection authority where you live; in the UK, the Information Commissioner’s Office (ico.org.uk).
United States. Residents of California and other states with comprehensive privacy laws may have rights to know, delete and correct personal information, to opt out of its sale or sharing, and not to be discriminated against for using these rights. We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use it for targeted advertising. You may use an authorized agent to make a request.
Australia. We handle personal information in line with the Australian Privacy Principles. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
9. Security
We use encrypted connections (HTTPS), access controls, and two-factor authentication on administrative accounts. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and regulators of a breach where the law requires.
10. Children
AVJ is written for professional readers and is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this policy
If we make material changes, we will update the date above and, where appropriate, tell subscribers by email before the changes take effect. Earlier versions are available on request.
October 28, 2026: Newsletter provider changed to Resend; added server-side bot-traffic analytics; removed Google sign-in script.
October 28, 2026: Added Google Analytics and region-based consent.
12. Contact
AI Visibility Journal · Delaware, United States · [email protected]