Privacy Policy

01Who we are and our role

The Service is provided by VecturAI, Inc., a Delaware corporation. You can reach us at privacy@vecturai.com for privacy matters and at security@vecturai.com for security matters.

We act in two different capacities, and which one applies determines how to exercise your rights (Section 09):

• As a controller for the personal data we collect about visitors to our websites, people who contact us, and the account and usage data of the individuals who use the Service (name, work email, sign-in and activity records).
• As a processor for Customer Data — the documents, prompts, files, connected-system data and stored context that a customer organisation and its users submit to the Service. We process Customer Data only on the customer’s instructions under Section 8.3 of the Terms of Service. The customer organisation is the controller, and requests about Customer Data are handled with, or through, its Administrator.

If you received a Snap, the organisation that shared it decides who receives it and what it contains; we host the Snap and report engagement to that organisation on its behalf (Section 02).

02Information we collect

Information you provide

• Account and contact details — name, work email, organisation and role when you sign up, accept an invitation, request access or contact us.
• Customer Data — documents, prompts, files, comments and other material you or your organisation submit to the Service, including content you make available to Collaboration Users or partner-organisation users.
• Communications — messages and attachments you send to our support, privacy, security or sales addresses.

Information we receive from others

• From your organisation — your name, email, role, seat and permissions when an Administrator invites you or assigns you a seat. Collaboration Users and partner-organisation users are invited by a customer, which provides their details to us.
• From your identity provider — when you sign in through single sign-on (SAML or OIDC) or Webex, we receive your name, email address and account identifiers from that provider.
• From systems you connect — when you or an Administrator connects a third-party system (for example Salesforce or Microsoft 365) or an MCP server, we access the records, files and metadata that you authorise, in order to provide the integration. That data is Customer Data. Section 8.5 of the Terms of Service describes the customer’s responsibilities for connected systems.

Information collected automatically

• Usage data — features used, actions taken, Reasoning Unit consumption and timestamps.
• Device and log data — IP address, browser type, operating system, referring pages and security logs.
• Stored context and memory — the Service retains context from a user’s interactions to inform later responses for that user. This is Customer Data belonging to the customer organisation; it stays with the user account and does not transfer when a seat is reassigned (Section 3 of the Terms of Service).
• Push notifications — if you enable them, the browser subscription endpoint needed to deliver them. You can disable push notifications in your browser at any time.
• Cookies and similar technologies — see Section 10 and our Cookie Policy.

Snap recipients

If an organisation using VecturAI shares a Snap with you, we process: your email address, which the sender provides and which we use to send you a one-time access code; the times you access the Snap and how often; how long you spend viewing it; and whether you are currently viewing it. This information is reported to the organisation that shared the Snap so it can understand engagement with the material it sent you. We use it for no other purpose, and we email you only to deliver the access code. Snap links stop working when the sender’s agreement with us ends. To object to this processing or ask for your information to be removed, contact the organisation that shared the Snap; you may also email privacy@vecturai.com and we will pass the request to them.

Demo video recipients

If we share a link to a demo video on demo.vecturai.com with you personally, the link may include an identifier we assign to you. If you accept analytics cookies on that site, Google Analytics and Mux Data record the identifier with your visit, so we can see whether you opened the video and how much of it you watched. We use this only to follow up with you about the demo. If you decline, the identifier is not sent to them. To object to this processing or ask for your information to be removed, email privacy@vecturai.com.

03How we use information

• Provide, operate, secure and support the Service, including enforcing seats and permissions configured by your organisation’s Administrators;
• Authenticate you, including through your organisation’s identity provider;
• Generate Outputs — which involves transmitting prompts and relevant content to the AI model providers described in Section 05;
• Meter consumption and bill the customer organisation under its Order Form;
• Deliver Snaps and report recipient engagement to the organisation that shared them;
• Measure how our websites and demo videos are used and, for demo links we share with you, whether you opened and watched them — only if you accept analytics cookies (Section 10);
• Respond to support requests and security reports;
• Send administrative messages: security alerts, changes to the Service or these documents, invitations, access codes, and push notifications you have enabled;
• Improve the Service using aggregated, de-identified data that does not identify any customer or individual. We do not use Customer Data to train our own or third parties’ foundation models (Section 8.3 of the Terms of Service);
• Comply with legal obligations and enforce our Terms of Service.

If we send you marketing communications about VecturAI, you can opt out at any time using the link in the message or by emailing us. Administrative messages about the Service are not marketing and cannot be opted out of while you hold an account.

04Legal bases for processing

Where the EU or UK GDPR or similar law applies, we rely on the following legal bases:

• Performance of a contract — providing the Service to you or the organisation you work for, and responding to your requests;
• Legitimate interests — securing the Service, preventing misuse, understanding how it is used in aggregate, communicating with business contacts, and hosting Snaps and reporting engagement on behalf of the organisation that shared them;
• Consent — analytics cookies on our websites, including demo-link tracking (Section 10), push notifications, and marketing where consent is required; you can withdraw consent at any time;
• Legal obligation — where we must retain or disclose information under applicable law, including keeping a record of your cookie choices so we can demonstrate your consent.

Where we act as a processor of Customer Data, the customer organisation determines the legal basis.

05How we share information

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share information only as follows:

• Subprocessors — vendors that process data on our behalf under contractual confidentiality and security obligations: cloud hosting in the United States; AI model providers, which receive prompts and relevant content in order to generate Outputs, under enterprise or API terms that do not permit them to use Customer Data to train their models; security and compliance monitoring; and email and communications delivery. A current list is available to customers on request to compliance@vecturai.com, and we notify customers of material changes as set out in Section 8.2 of the Terms of Service.
• Analytics providers — Google (Google Analytics) and Mux (Mux Data) process website usage and video-viewing data on our behalf, only if you accept analytics cookies (Section 10).
• Your organisation — Administrators of the customer organisation can see usage and consumption across their team and can access content in the organisation’s workspaces; the organisation that shares a Snap receives the recipient engagement information described in Section 02.
• Partner organisations — only the content your organisation chooses to share with users of partner organisations it has allow-listed, under Section 4 of the Terms of Service.
• Legal and safety — where required by law, regulation or legal process, or to protect the rights, property or safety of VecturAI, our customers, users or others. Where permitted, we will notify the affected customer before disclosing Customer Data.
• Business transfers — in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

06Data security

We maintain administrative, technical and physical safeguards designed to protect personal data against unauthorised access, loss, misuse or alteration, including encryption in transit and at rest, access controls, logging and monitoring. Our security posture, policies and compliance documentation are published on our Trust Center.

If we become aware of a breach of security affecting personal data we process on behalf of a customer, we will notify the affected customer without undue delay and provide the information the customer needs to meet its own obligations. To report a vulnerability or suspected compromise, email security@vecturai.com (see our Support page).

07Data retention

• Account and contact data — for as long as you hold an account or we have an ongoing relationship with you or your organisation, and for a limited period afterwards to meet legal obligations, resolve disputes and enforce our agreements.
• Customer Data — for the term of the customer’s agreement. On termination, and when a user is removed, Customer Data is exported on request and then deleted in accordance with Sections 3 and 8.4 of the Terms of Service.
• Snap recipient data — for the life of the Snap; Snap links are deactivated when the sender’s agreement ends (Section 9 of the Terms of Service).
• Logs and security records — for a limited period sufficient for security, diagnostics and audit purposes.
• Website analytics data — Google Analytics deletes user- and event-level data after 2 months, keeping only aggregated reports; Mux Data deletes video view data after 100 days.
• Cookie consent records — each time you answer the cookie banner or change your choice, we record your choice, the version of our Cookie Policy it applies to, the page, the random ID stored in your browser and the time. We keep these records for about 3 years so we can demonstrate your consent, then delete them.

When personal data is no longer needed for these purposes, we delete or de-identify it.

08International data transfers

The Service and Customer Data are hosted on Amazon Web Services in the United States (US East region), as described in Section 8.1 of the Terms of Service. VecturAI personnel and contractors may access the Service from outside the United States, including from India, to provide support, maintenance and monitoring, subject to our confidentiality and security obligations.

If you access the Service from outside the United States, your personal data is transferred to and processed in the United States, where data protection law may differ from that of your country. Where applicable law requires a specific safeguard for such a transfer, we will put it in place before processing.

If you accept analytics cookies on our websites, Google and Mux may process the resulting analytics data in the United States and other countries where they operate.

09Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority. We will verify your identity before acting on a request, and we will not treat you differently for exercising your rights.

• Account, website and communications data — email privacy@vecturai.com. We respond within the time required by applicable law.
• Customer Data — contact your organisation’s Administrator, who is responsible for the data your organisation holds in the Service. We assist customers in responding to such requests and will refer requests we receive directly to the relevant Administrator.
• Snap recipients — contact the organisation that shared the Snap with you, or email privacy@vecturai.com and we will pass your request to them.
• Analytics cookies — change or withdraw your choice at any time in our Cookie Policy.

10Cookies and similar technologies

The Service uses only strictly necessary and functional cookies and browser storage: to keep you signed in, to secure your session, and to remember preferences such as theme and layout. We do not use third-party advertising cookies, cross-site tracking, or third-party analytics cookies on the Service. You can clear or block cookies and browser storage through your browser settings; doing so will sign you out of the Service.

Our websites, vecturai.com and demo.vecturai.com, also use analytics cookies from Google Analytics and, on demo.vecturai.com, Mux Data, but only if you accept them in the cookie banner. You can change your choice at any time in our Cookie Policy, which also describes the cookies and browser storage we use.

11Children’s privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children; if you believe we have, contact us and we will delete it.

12Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and publish the current version at vecturai.com/privacy. We will notify customers of material changes through their Customer Contact, consistent with Section 17.3 of the Terms of Service.

13Contact us

Questions about this Policy, our privacy practices, or your personal data: privacy@vecturai.com. Product and account help: support@vecturai.com. Security reports: security@vecturai.com. How we handle requests, and our response targets, are published on our Support page.