Privacy Policy

01Who we are and our role

The Service is provided by VecturAI, Inc., a Delaware corporation. You can reach us at privacy@vecturai.com for privacy matters and at security@vecturai.com for security matters.

We act in two different capacities, and which one applies determines how to exercise your rights (Section 09):

• As a controller for the personal data we collect about visitors to our website, people who contact us, and the account and usage data of the individuals who use the Service (name, work email, sign-in and activity records).
• As a processor for Customer Data — the documents, prompts, files, connected-system data and stored context that a customer organisation and its users submit to the Service. We process Customer Data only on the customer’s instructions under Section 8.3 of the Terms of Service. The customer organisation is the controller, and requests about Customer Data are handled with, or through, its Administrator.

If you received a Snap, the organisation that shared it decides who receives it and what it contains; we host the Snap and report engagement to that organisation on its behalf (Section 02).

02Information we collect

Information you provide

• Account and contact details — name, work email, organisation and role when you sign up, accept an invitation, request access or contact us.
• Customer Data — documents, prompts, files, comments and other material you or your organisation submit to the Service, including content you make available to Collaboration Users or partner-organisation users.
• Communications — messages and attachments you send to our support, privacy, security or sales addresses.

Information we receive from others

• From your organisation — your name, email, role, seat and permissions when an Administrator invites you or assigns you a seat. Collaboration Users and partner-organisation users are invited by a customer, which provides their details to us.
• From your identity provider — when you sign in through single sign-on (SAML or OIDC) or Webex, we receive your name, email address and account identifiers from that provider.
• From systems you connect — when you or an Administrator connects a third-party system (for example Salesforce or Microsoft 365) or an MCP server, we access the records, files and metadata that you authorise, in order to provide the integration. That data is Customer Data. Section 8.5 of the Terms of Service describes the customer’s responsibilities for connected systems.

Information collected automatically

• Usage data — features used, actions taken, Reasoning Unit consumption and timestamps.
• Device and log data — IP address, browser type, operating system, referring pages and security logs.
• Stored context and memory — the Service retains context from a user’s interactions to inform later responses for that user. This is Customer Data belonging to the customer organisation; it stays with the user account and does not transfer when a seat is reassigned (Section 3 of the Terms of Service).
• Push notifications — if you enable them, the browser subscription endpoint needed to deliver them. You can disable push notifications in your browser at any time.
• Cookies and similar technologies — see Section 10.

Snap recipients

If an organisation using VecturAI shares a Snap with you, we process: your email address, which the sender provides and which we use to send you a one-time access code; the times you access the Snap and how often; how long you spend viewing it; and whether you are currently viewing it. This information is reported to the organisation that shared the Snap so it can understand engagement with the material it sent you. We use it for no other purpose, and we email you only to deliver the access code. Snap links stop working when the sender’s agreement with us ends. To object to this processing or ask for your information to be removed, contact the organisation that shared the Snap; you may also email privacy@vecturai.com and we will pass the request to them.

03How we use information

• Provide, operate, secure and support the Service, including enforcing seats and permissions configured by your organisation’s Administrators;
• Authenticate you, including through your organisation’s identity provider;
• Generate Outputs — which involves transmitting prompts and relevant content to the AI model providers described in Section 05;
• Meter consumption and bill the customer organisation under its Order Form;
• Deliver Snaps and report recipient engagement to the organisation that shared them;
• Respond to support requests and security reports;
• Send administrative messages: security alerts, changes to the Service or these documents, invitations, access codes, and push notifications you have enabled;
• Improve the Service using aggregated, de-identified data that does not identify any customer or individual. We do not use Customer Data to train our own or third parties’ foundation models (Section 8.3 of the Terms of Service);
• Comply with legal obligations and enforce our Terms of Service.

If we send you marketing communications about VecturAI, you can opt out at any time using the link in the message or by emailing us. Administrative messages about the Service are not marketing and cannot be opted out of while you hold an account.

04Legal bases for processing

Where the EU or UK GDPR or similar law applies, we rely on the following legal bases:

• Performance of a contract — providing the Service to you or the organisation you work for, and responding to your requests;
• Legitimate interests — securing the Service, preventing misuse, understanding how it is used in aggregate, communicating with business contacts, and hosting Snaps and reporting engagement on behalf of the organisation that shared them;
• Consent — push notifications, and marketing where consent is required; you can withdraw consent at any time;
• Legal obligation — where we must retain or disclose information under applicable law.

Where we act as a processor of Customer Data, the customer organisation determines the legal basis.

05How we share information

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share information only as follows:

• Subprocessors — vendors that process data on our behalf under contractual confidentiality and security obligations: cloud hosting in the United States; AI model providers, which receive prompts and relevant content in order to generate Outputs, under enterprise or API terms that do not permit them to use Customer Data to train their models; security and compliance monitoring; and email and communications delivery. A current list is available to customers on request to compliance@vecturai.com, and we notify customers of material changes as set out in Section 8.2 of the Terms of Service.
• Your organisation — Administrators of the customer organisation can see usage and consumption across their team and can access content in the organisation’s workspaces; the organisation that shares a Snap receives the recipient engagement information described in Section 02.
• Partner organisations — only the content your organisation chooses to share with users of partner organisations it has allow-listed, under Section 4 of the Terms of Service.
• Legal and safety — where required by law, regulation or legal process, or to protect the rights, property or safety of VecturAI, our customers, users or others. Where permitted, we will notify the affected customer before disclosing Customer Data.
• Business transfers — in connection with a merger, acquisition, financing or sale of assets, subject to this Policy.

06Data security

We maintain administrative, technical and physical safeguards designed to protect personal data against unauthorised access, loss, misuse or alteration, including encryption in transit and at rest, access controls, logging and monitoring. Our security posture, policies and compliance documentation are published on our Trust Center.

If we become aware of a breach of security affecting personal data we process on behalf of a customer, we will notify the affected customer without undue delay and provide the information the customer needs to meet its own obligations. To report a vulnerability or suspected compromise, email security@vecturai.com (see our Support page).

07Data retention

• Account and contact data — for as long as you hold an account or we have an ongoing relationship with you or your organisation, and for a limited period afterwards to meet legal obligations, resolve disputes and enforce our agreements.
• Customer Data — for the term of the customer’s agreement. On termination, and when a user is removed, Customer Data is exported on request and then deleted in accordance with Sections 3 and 8.4 of the Terms of Service.
• Snap recipient data — for the life of the Snap; Snap links are deactivated when the sender’s agreement ends (Section 9 of the Terms of Service).
• Logs and security records — for a limited period sufficient for security, diagnostics and audit purposes.

When personal data is no longer needed for these purposes, we delete or de-identify it.

08International data transfers

The Service and Customer Data are hosted on Amazon Web Services in the United States (US East region), as described in Section 8.1 of the Terms of Service. VecturAI personnel and contractors may access the Service from outside the United States, including from India, to provide support, maintenance and monitoring, subject to our confidentiality and security obligations.

If you access the Service from outside the United States, your personal data is transferred to and processed in the United States, where data protection law may differ from that of your country. Where applicable law requires a specific safeguard for such a transfer, we will put it in place before processing.

09Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to restrict or object to certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority. We will verify your identity before acting on a request, and we will not treat you differently for exercising your rights.

• Account, website and communications data — email privacy@vecturai.com. We respond within the time required by applicable law.
• Customer Data — contact your organisation’s Administrator, who is responsible for the data your organisation holds in the Service. We assist customers in responding to such requests and will refer requests we receive directly to the relevant Administrator.
• Snap recipients — contact the organisation that shared the Snap with you, or email privacy@vecturai.com and we will pass your request to them.

10Cookies and similar technologies

The Service uses only strictly necessary and functional cookies and browser storage: to keep you signed in, to secure your session, and to remember preferences such as theme and layout. We do not use third-party advertising cookies, cross-site tracking, or third-party analytics cookies on the Service. You can clear or block cookies through your browser settings; blocking strictly necessary cookies will prevent you from signing in.

11Children’s privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal data from children; if you believe we have, contact us and we will delete it.

12Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the effective date above and publish the current version at vecturai.com/privacy. We will notify customers of material changes through their Customer Contact, consistent with Section 17.3 of the Terms of Service.

13Contact us

Questions about this Policy, our privacy practices, or your personal data: privacy@vecturai.com. Product and account help: support@vecturai.com. Security reports: security@vecturai.com. How we handle requests, and our response targets, are published on our Support page.