Privacy Policy (updated July 2026) — Vizera AI

Responsible for data processing:

AI & Co GmbH
Lättichstrasse 6
6340 Baar
Switzerland

Email: info@vizera.ai
Website: www.vizera.ai

Vizera.ai is a brand and product of AI & Co GmbH.

Contact person for data protection enquiries:

Pascale Tschaler
c/o AI & Co GmbH
Lättichstrasse 6
6340 Baar, Switzerland
Email: privacy@vizera.ai

2.1 When visiting our website

We automatically process the following data (server logs):

• IP address (truncated/anonymized)
• Date and time of access
• Browser type, version, operating system
• Referrer URL
• Pages visited
• Error logs (for stability and security)

2.2 When creating an account or using the platform

• First name, last name
• Company name (optional)
• Email address and login data
• Usage data (generated images, projects, settings)
• Payment data (via our external payment provider Stripe)
• Support requests and communication

2.3 Uploaded files (sketches, 3D models, photos)

Special rules apply here:

• Files are used exclusively for providing our services.
• We don't train models with your images or projects.
• With our standard models (Google Imagen 4 and Nano Banana via the paid Google Gemini API), training use is excluded under the applicable API terms.
• If you manually select alternative models (e.g. Flux models from Black Forest Labs) that are not among our standard models, the respective provider may use inputs for training under its own terms; Black Forest Labs currently offers no opt-out. That is why we deliberately set the safest options as defaults.
• No disclosure to third parties, except where strictly necessary for processing (e.g. AI models via API, see Section 5).

4.1 No training use of your designs

Your uploaded sketches, CAD plans, 3D models and generated images are not:

• used to train publicly available AI models
• passed on to external datasets
• used for model improvements, unless you give your explicit written consent

4.2 How your images are processed

Your content is transmitted temporarily to the following systems (depending on the function you choose):

• Google Imagen 4 and Nano Banana (Google, via the Google Gemini API)
• Google Veo (video generation, via the Google Gemini API)
• Nano Banana Pro, Seedream 5 Pro and upscaling (Topaz) (via fal.ai)
• Flux Pro 2.0 (Black Forest Labs, EU endpoint)
• Object removal “Eraser” (Bria model via Replicate, USA; by default the provider deletes inputs after one hour)
• Prompt assistant (Anthropic)

Note: this model list reflects the position as of August 2026. It is updated when the models in use change.

These external model providers process the data in order to carry out your request.

Transparency notice: We don't train models with your images or projects. For our standard models via the paid Google Gemini API, training use is excluded under the applicable API terms; the same applies to Anthropic (commercial API access) and fal.ai (except for endpoints with “Pending Enterprise Ready” status). With Black Forest Labs (Flux models), training use is possible under the provider's terms and no opt-out currently exists. That is why the safest options are preset as defaults; models with possible training use must be selected actively.

4.3 EU AI Act — transparency and labelling

From 2 August 2026, the EU AI Act (Regulation (EU) 2024/1689) requires providers of generative AI systems to mark AI-generated content as artificially produced in a machine-readable format (Article 50).

What Vizera does:

• Labelling of AI-generated content is being implemented (EU AI Act Art. 50).
• We report on the state of implementation in this privacy policy.

What this means for you as a customer:

• Swiss customers (CH-only projects): the EU AI Act does not apply directly. No labelling obligation.
• German and Austrian customers: the EU AI Act applies. But the editorial exemption protects you: if you edit AI-generated images, curate them and integrate them into your professional work, the labelling obligation for the end product does not apply.
• Creative and artistic works: for content that is obviously creative or artistic (such as architectural visualizations), only a minimal, non-intrusive disclosure is required.

4.4 Copyright and AI-generated content

Swiss law (URG):
Under the Swiss Copyright Act, only natural persons can be authors (Art. 6 URG). If you contribute sketches, set the creative direction and edit the result, the output is attributable to your creative contribution. Purely autonomous AI outputs without human direction are not protected by copyright.

Our terms assign you all usage rights in the generated content. You may use Vizera images in presentations, competitions and marketing.

We only disclose data where it is necessary to provide our services:

5.1 Hosting and infrastructure

5.2 Payment provider

Payment processing via Stripe:

Payment processing for Vizera AI runs directly through the payment service provider Stripe. The contracting party and payee is exclusively AI & Co GmbH (Switzerland). All payment receipts and invoices are issued in the name of AI & Co GmbH.

GDPR role: As a payment service provider, Stripe is an independent controller within the meaning of Art. 4(7) GDPR for payment processing (fraud prevention, KYC, compliance with payment regulations). AI & Co GmbH remains the controller for all other processing within the Vizera AI platform.

• Scope of data: Stripe has access to the data necessary for payment processing (name, email, billing address, transaction data and, where applicable, payment method information). Card details are processed exclusively by Stripe in a PCI-DSS-certified environment and are not visible in plain text to AI & Co GmbH.
• Legal basis for the disclosure: performance of a contract (Art. 6(1)(b) GDPR) — processing the payment is necessary to fulfil the subscription contract.
• International data transfer: Stripe may transfer data to the USA. The transfer is safeguarded by:
  • the Swiss-US Data Privacy Framework (for data from Switzerland)
  • the EU-US Data Privacy Framework (for data from the EU/EEA)
  • standard contractual clauses (SCCs) as an additional safeguard
  • technical protective measures: TLS encryption, PCI-DSS compliance, role-based access restrictions

5.3 AI API services

5.4 Analytics and performance (only with consent)

5.5 Communication

Our support assistant “Arizo” is operated by us and identifies itself as an AI assistant in its first message. Conversations are stored in Switzerland (Supabase, Zurich region) to answer your enquiry and improve our support, and are retained for 12 months.

5.6 No disclosure for advertising purposes

No data is passed on or sold to third parties for advertising purposes.

See also our separate retention policy for details.

7.1 Rights under GDPR (EU/EEA)

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

7.2 Rights under nDSG (Switzerland)

• Access (Art. 25 nDSG)
• Release or transfer of your data (Art. 28 nDSG)
• Erasure
• Withdrawal of consent

Please direct enquiries to: privacy@vizera.ai

We respond to enquiries within 30 days.

We implement the following technical and organizational measures:

• Transport encryption (HTTPS/TLS 1.2+)
• Encryption of data at rest (AES-256)
• Access restrictions and roles
• Data isolation between projects and organizations
• Audit logs and monitoring
• Hosting on Google Cloud Platform — Google Cloud is certified to ISO 27001 and SOC 2 (certifications held by Google, not by Vizera)
• Regular security reviews

See also our separate data security policy (TOMs) for details.

We only use cookies that are technically necessary, as well as (with consent):

• Google Analytics 4
• Platform performance tracking
• Conversion tracking for advertisements

All optional cookies can be disabled via the cookie banner. Details can be found in our Cookie Policy.

You can at any time:

• Delete your account
• Delete your projects
• Withdraw consent
• Unsubscribe from newsletters
• Request deletion of all personal data

Contact: privacy@vizera.ai

Where data is processed outside Switzerland/EU, we ensure:

• Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR
• Adequacy decisions, where available (e.g. Swiss-US Data Privacy Framework)
• Additional safeguards pursuant to Schrems II case law
• Data minimization: only technically necessary data is transmitted

Current third-country transfers:

Switzerland:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

EU (for complaints from EU citizens):
You may contact the data protection supervisory authority in your country of residence.

We update this Privacy Policy as needed, particularly in the event of legal changes or new processing activities. The current version is always available at www.vizera.ai/en/privacy-policy.

AI & Co GmbH
Email: privacy@vizera.ai

As of: 31 August 2026. This Privacy Policy was prepared on the basis of the Swiss nFADP (in force since 1 September 2023), the EU GDPR and the EU AI Act (Regulation (EU) 2024/1689).

We use Vercel Web Analytics (Vercel Inc.) for privacy-conscious audience measurement. According to the provider, the service does not use cookies, stores only anonymized and aggregated usage data, and identifies visitors using a hash that changes daily. Processing is based on our legitimate interest in reliably and securely measuring website usage.

The following optional services are activated only after your explicit selection in the cookie banner:

• Vercel Speed Insights (Vercel Inc.) for performance measurement — Analytics category.
• Microsoft Clarity (Microsoft Corporation) for heatmaps and session analysis — Analytics category.
• Arizo (AI assistant by AI & Co GmbH) for the optional chat support function — Functional category. Operated by the same company as Vizera.

Without the corresponding consent, these optional scripts are not loaded. You can withdraw your selection at any time through the cookie settings; after withdrawal, the page reloads so that previously initialized optional third parties are fully stopped.

With your explicit consent, we collect pseudonymous usage events to understand how visitors use our website and which content leads to enquiries. This may include pages viewed, language, market domain, coarse region, device type, campaign source, video and CTA interactions, and anonymous session and visitor identifiers.

We do not collect IP addresses, names, email addresses, form contents, or full referrer URLs for this purpose. You can withdraw consent at any time in the cookie settings; local analytics identifiers are deleted when you do so. Data is retained only for as long as needed for audience measurement, conversion analysis, and improving our service.