Privacy Policy
Last updated: September 2026
1. Overview
VisiPassIQ ("we", "us", "the platform") provides AI-powered visitor management software to organizations ("customers"). This policy explains what data we collect, how it's used, and how it's protected — both for the organizations that use VisiPassIQ and for the visitors those organizations check in.
2. Data We Collect
For organization accounts: organization name, admin contact details, and billing/plan information. For visitors checked in through the platform: name, phone number, photo, and — where enabled — a face recognition embedding used to match repeat visits. For staff (security/admin users): name, username, and role. Voice recordings used for AI check-in extraction are processed transiently and not retained beyond generating the visit record.
3. How We Use Data
Visitor and staff data is used solely to operate the visitor management system for the organization that collected it: check-in/check-out, host routing, audit logging, and repeat-visit recognition. We do not sell visitor data, and organizations cannot access another organization's data — each organization's data is isolated (tenant-scoped) at the database level.
4. Face Recognition & Biometric Data
Face embeddings (a numeric representation used for matching, not a photo) are stored separately from visitor profile data and are never exposed through standard visitor APIs. Organizations may disable face recognition; visitors can still be checked in and out manually.
5. Data Retention & Deletion
Visitor and visit records are retained for as long as the organization's account is active, for audit and compliance purposes. Organizations may request deletion of specific visitor records by contacting support. Upon an organization's account closure, its data is retained for a limited period for legal/audit purposes before deletion, unless a longer retention period is legally required.
6. Security
Passwords are hashed (never stored in plaintext) for all staff and organization admin accounts. Session tokens are signed and stored in httpOnly cookies. All tenant data is scoped by organization at the database and API layer to prevent cross-organization access.
7. Super Admin Access
VisiPassIQ platform administrators can view organization account status (for approval, billing, and support purposes) but do not access visitor-level data as part of routine operations, except where necessary to resolve a support request raised by the organization.
8. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated to organization admins via their registered contact details.
9. Contact
Questions about this policy or your data can be directed to your organization admin, or to VisiPassIQ support — see the Support page.