Privacy Policy

For the account and workspace data described here, the controller is Vendeflect. You can reach our privacy contact at privacy@vendeflect.com.

Where you upload personal data about your own end users or contacts into a workspace, you are the controller of that data and we act as your processor. That relationship is governed by our Data Processing Addendum.

Account data

Your name, email address, and a hashed password. We never store your plaintext password.

Workspace data

The documents you upload and the text extracted from them, the questionnaire questions and answers you create, your reusable answer library, and your Trust Center configuration. There is no object storage today, so an uploaded document is stored as its extracted text in our database rather than as a downloadable file.

Usage and AI run data

Counters for how much of each plan limit you have used, and a record of each AI run including token counts and whether it was a real model or the deterministic offline mode. These records let us enforce limits accurately and show you honest usage.

Billing data

Billing contact and transaction records, held by Paddle as merchant of record. We do not receive or store your card details.

Operational data

Request logs and IP addresses generated by hosting the service, used to run and secure it.

• To provide the service you asked for, including drafting answers from your documents and publishing your Trust Center. Legal basis: performance of our contract with you.
• To operate, secure and troubleshoot the service, and to enforce plan limits. Legal basis: our legitimate interests in running a reliable, secure product.
• To take payment and meet tax and accounting duties, through Paddle. Legal basis: performance of the contract and compliance with a legal obligation.
• To send service related messages about your account. Legal basis: our legitimate interests and performance of the contract.

We use the following third parties to process data on our behalf. The AI inference entry only receives data when AI drafting is enabled; with the deterministic offline mode set, no document content leaves the application.

The current list is maintained on our Subprocessors page, where you can also subscribe to change notices.

Our subprocessors may process data in more than one country, as noted in the table above. Where data moves across borders, we rely on the transfer mechanisms our subprocessors make available, such as standard contractual clauses, to protect it. The region of your database is the region of your Neon project.

You can delete documents and workspace content at any time. After your subscription ends and your account is closed, we delete workspace data within 30 days from active systems. Operational logs are kept on a rolling 30 day window.

To be honest about it: encrypted backups are the real floor on deletion. Data may persist in backups until they rotate out, which happens within 35 days, after which it is gone from backups too.

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where we relied on it.

To exercise a right, email privacy@vendeflect.com. If the request concerns personal data you uploaded about your own end users, we will direct it to you as the controller and assist you as your processor. You also have the right to complain to your local data protection authority.

Vendeflect uses only the cookies it needs to work. There is no advertising and no analytics tracking, and we do not set third party marketing cookies.

• A session cookie that keeps you signed in.
• A cookie that remembers whether the app sidebar is collapsed.

Vendeflect is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us data, contact our privacy address and we will delete it.

We may update this policy. When we make a material change we will update the effective date above and, where appropriate, notify you in the app or by email.