Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Vaktex, Inc. (“Vaktex”, “we”, “us”) handles personal data. It covers vaktex.com and the signed-in account dashboard, our job and waitlist forms, and our products: vScan Studio, the vScan CLI, the Vaktex AI Gateway, sandboxes, Angrep, whoami, vScan cooked and the VAKT extension for VS Code and compatible editors (together, the “Services”).

Vaktex, Inc. is a US company. We have no establishment in the European Economic Area (EEA) or the United Kingdom. Our contact details are in section 15.

When we are the controller

We decide why and how personal data is used, and so act as controller, for:

• account data and billing;
• website visitors and marketing;
• security logs;
• job applicants;
• waitlist and demo requests;
• support requests;
• vScan cooked, when you use it as an individual or anonymously;
• turns sent to a Preview model through the AI Gateway, which we keep to train AI models (section 5);
• code and code graphs sent by the VAKT extension’s cloud review, which we keep to train AI models (section 3.12).

This policy describes that processing.

When we process data for your organization

Organizations that use the Services are our customers. When they and their users submit content to the Services, we process it on the customer’s behalf. We call this “Customer Content”. It includes code, repositories, scan inputs and results, prompts and completions sent through the AI Gateway, sandbox files, Angrep targets and evidence, and data about the organization’s members.

For Customer Content, the customer is the controller and we are its processor (a “service provider” under US state privacy laws). Our Data Processing Addendum (“DPA”) and the customer’s agreement with us govern that processing. If you use the Services through your employer or another organization, contact that organization about your data. If you contact us instead, we will pass your request to the organization or help it respond.

We still describe what happens to Customer Content in sections 3 and 5, so customers and their users can see it. The one exception to our processor role is a turn sent to a Preview model: we keep it for our own use in training, as the controller (section 5).

Self-hosted vScan Studio

vScan Studio runs on the customer’s own server. Your code stays on your infrastructure, and Vaktex does not receive it. Studio sends us only:

• License activation: the license key, an instance ID, a coarse machine fingerprint that does not identify a person, and the Studio version.
• Heartbeats: the key ID, instance ID and version, sent periodically.
• Usage counts: monthly token and request counts.
• Notification emails: only if you turn them on. We relay them through notifications.vaktex.com.

Air-gapped mode turns off activation and heartbeats. If you configure Studio to use the Vaktex AI Gateway or Vaktex sandboxes, the data you send to those Services reaches us as described in sections 3.8 and 3.10.

2. Summary

• We never train AI models on your code or content, with two exceptions. The first you choose per request: turns you send to a model marked Preview. Preview models cost less because we keep those turns for training. The second is the VAKT extension’s cloud review, which is on by default: it sends anonymised functions and a code graph that we keep for training. Its “Fully local” setting sends nothing. No plan, setting or opt-in changes this for any other Service.
• We don’t sell personal data.
• When your organization uses the Services, it controls Customer Content. We process that content for it under the DPA.
• Self-hosted vScan Studio keeps your code on your servers. We receive license checks and usage counts only, plus notification emails if you turn them on.
• Optional analytics and advertising measurement load only if you click “OK” on our cookie banner. We treat a Global Privacy Control signal as “No”.
• The AI Gateway erases a session’s event log about 5 minutes after your app disconnects (up to about 10 minutes if a request was still running). Each model provider’s retention period is shown per model in the Gateway API. Turns sent to a Preview model are kept for up to 24 months.
• vScan cooked results are public to anyone with the link. Don’t run cooked on transcripts you consider sensitive.
• You can access, correct, delete or export your data by emailing support@vaktex.com. There is no fee.

3. Personal data we collect

We do not want special category data, such as health or biometric data. Do not submit it, except where it appears incidentally in code or repositories that you process under the DPA.

3.1 Data you give us

Category	Examples	Source
Account	Name, email address, optional profile image, password (stored only as a hash), email verification codes (stored hashed, expire after 10 minutes)	You
Additional account details	On some account flows: first, last and display name; country or region; date of birth, to confirm you meet the minimum age; phone number, for phone verification when it is enabled; organization, team and invitation details	You
Billing	Billing name and email, plan	You, through Stripe. Stripe holds your card details; we do not.
Licenses and keys	License keys; inference API keys with the owner’s email and created and last-used times; instance location setting; access grants and seats, keyed by email	You or your organization
Support and communications	Whatever you send us by email or through the Services	You
Customer Content	Code, repositories, scan inputs, prompts, files and the other content listed in section 1	You or your organization

3.2 Data we collect automatically

Category	Examples	Source
Sessions	Session token, IP address, user agent, last sign-in method	Your browser
Security and logs	IP address, user agent, request metadata, rate-limit counters, ban status, audit logs of admin actions, error diagnostics	Our systems
Product events	Sign-up, sign-in, email verified, license minted, key created or revoked, settings changed, subscription events, account deleted. Linked to a pseudonymous user ID. Only if you turn on the usage-metrics setting.	Our servers, which send them to PostHog
Usage metadata	Tokens, requests, spend, model, timestamps, license ID	The AI Gateway and vScan Studio
Analytics (only with your consent)	Page views, interactions, referrer and campaign, device and browser, approximate location derived from your IP address, session replays (including Sentry Session Replay). If you are signed in, your user ID, email and name are linked to the analytics profile.	Cookies and scripts in your browser

3.3 Data from third parties

Category	Examples	Source
Sign-in providers	If you sign in with GitHub or Google (where offered), the account identity that provider shares with us, such as your name and email address	GitHub, Google
Payments	Stripe customer and subscription IDs, payment and subscription status	Stripe
Your organization	Invitations, team membership, seats and access grants keyed by your email	Your organization’s administrators
Git history	Commit author names and email addresses, used by whoami	Repositories a user points whoami at

3.4 Job applicants

When you apply for a job, we collect your name, email, location, phone number (optional), LinkedIn, GitHub, X or website links, your answers, your CV and your language setting. While you fill in the form, a draft is saved in your browser’s local storage, on your device only, until you submit or clear it.

We keep applications for 24 months after you apply. We delete them sooner if you ask. We keep them longer only if you agree.

3.5 Waitlist and demo requests

When you join the waitlist or request a demo, we collect your name, email address, where you signed up, and the time. The demo saves your progress, including the name and email you typed, in your browser’s local storage on your device only. We receive it when you submit.

We keep waitlist data for 24 months after you join. We delete it sooner if you ask us to remove you.

3.6 vScan cooked

vScan cooked is an optional feature that turns your AI-assistant chat history into a shareable result. It is the only Service whose output is public. When you use cooked as an individual or anonymously, we are the controller. When you use it under an organization account, the organization’s DPA with us applies, except that the public but unlisted result link is created at your own instruction.

What cooked does:

• It uploads AI-assistant chat transcripts from your device (Claude, Codex and Cursor session files) to Google Cloud Storage.
• It analyzes only the last 30 days of those transcripts.
• It sends a compact digest, up to 8 truncated sample messages and snippets with secrets redacted to Google Gemini to produce the result.
• It looks for pasted secrets using pattern matching, so it can warn you.

Transcripts can contain code, secrets and information about other people. Check what is in them before you run cooked.

You can use cooked without an account. If you do, we record your IP address for rate limiting and the operating-system username the client reports.

Raw transcripts are kept for at most 90 days. They are never used for training and never sold. Apart from our hosting infrastructure, only Google (Cloud Storage and Gemini) receives them, as our subprocessor.

Results are public but unlisted. We do not list them anywhere, but anyone with the link can view a result, and anyone you send it to can pass the link on. If your transcripts are sensitive, do not use cooked.

Results stay available until you delete them or ask us to. Deleting your account does not remove them automatically. To delete a result, email support@vaktex.com. We honor these requests wherever you live.

3.7 whoami capability profiles

whoami builds a skill profile from git history. Git history contains commit author names and email addresses, both of the user and of collaborators who committed to the same repositories. If the user’s account is linked to an organization, the organization can see the profile.

When whoami is used under an organization, the organization is the controller of this data. If you are a collaborator and want to ask about or object to this processing, contact support@vaktex.com.

3.8 AI Gateway

The Vaktex AI Gateway (gateway.vaktex.com) routes prompts and completions from your agents to the upstream model providers you choose. We process this traffic as the customer’s processor.

• Session log: we hold the live session’s event log only in memory and durable session storage. We keep it while your app is connected, and erase it about 5 minutes after it disconnects (up to about 10 minutes if a request was still running).
• Usage metadata: we keep tokens, requests, spend, model, timestamps and license ID, for billing and usage limits.
• Provider retention: each upstream provider has its own retention policy. Examples are zero retention, or up to 30 days for abuse monitoring, to a maximum of 90 days. We disclose the policy for each model in the Gateway API and model listing. Your choice of model decides which provider receives your data.
• Transcripts: we do not store Gateway transcripts for any model except Preview models. If we add transcript storage for other models, we will tell you before it starts.
• Preview models: a model marked Preview in the model listing and API costs less, because we keep every turn sent to it for training. The Gateway uses one only when you name it. We keep the request and the output, under a pseudonym in place of your account, for up to 24 months. For these turns we act as controller. Section 5 explains how this works.

3.9 Scans (vScan CLI)

When you scan code with the vScan CLI, we send the code snippets you submit to AI model providers and return the results. We cache scan inputs and outputs (code, fixed code and model output) so repeat scans return quickly. Your organization can turn this cache off. Cached scan data is kept for no longer than 90 days. We delete it sooner on request, or when the account or organization is deleted.

3.10 Sandboxes

Sandboxes run Vex assessments on Google Compute Engine virtual machines. Each machine lives for at most 12 hours. Its local disk is destroyed with it. Files the assessment writes are copied to Google Cloud Storage. We delete them within 30 days after the assessment ends. Evidence for a confirmed Angrep finding is kept with that finding. We also delete them when you delete your account.

3.11 Angrep

Angrep supports authorized penetration testing. We store assets, findings and evidence files in our database and in Google Cloud Storage for the life of the account or project. You can delete them at any time.

3.12 VAKT extension cloud review

The VAKT extension scores code on your machine with DOM-0.8B. Its cloud review sends code to Vaktex so that Vaktex cloud models can give a second opinion on findings. Cloud review is on by default. The only setting that sends nothing is “Fully local” (vakt.fullyLocal). The “Improved responses” setting (vakt.improvedResponses) turns cloud review off.

What it sends. While cloud review is on, the extension sends:

• individual functions, with their language and DOM-0.8B’s scores;
• a code graph of the repository: its functions, calls, imports, routes, data access and framework;
• per-language coverage: how many files, functions and calls were extracted and resolved;
• findings you ignore or rescan, with what they said.

How it is anonymised. Everything is anonymised on your machine before it is sent. Secrets (keys, tokens, URL credentials) and email addresses are removed, and comments are dropped. Names, words in strings and path segments specific to your project are replaced by numbered placeholders. Common programming words stay. Long numbers are replaced. The table that maps placeholders back to your names stays on your machine and is never sent. The repository is identified by a salted hash, not by its remote URL or folder. We anonymise the code again on our servers before we store it.

The structure of the code is not changed, because the review needs it. So a distinctive proprietary algorithm could still be recognised by someone who holds the original code. The result is close to anonymous, not perfectly anonymous. If that is not acceptable for a project, turn on Fully local.

How we use it. We use what cloud review sends to answer the review and to develop, train and evaluate Vaktex models. We do not sell it, publish it or make it available to other customers.

How long we keep it. We keep training records for up to 24 months, and then delete them. Training records carry no user identifier: no IP address, install ID or account. Because of that, we cannot find the records that came from a particular user, and we cannot delete them on request.

Limits and abuse prevention. To enforce monthly limits and prevent abuse, we keep separate, short-lived counters keyed by a hash of your IP address, a random install ID the extension creates, or your account if you sign in:

Counter	How long we keep it
Usage (rate limits)	7 days
Spend against the monthly limit	3 months
Votes from findings you ignore	90 days
Owner of an uploaded code graph	7 days after it is processed

These counters are never written into training records.

Monthly limits. Cloud review is free up to a monthly amount of cloud model use: US$5 a month without signing in, and US$30 a month if you sign in with a verified email address (“VAKT: Sign In to Vaktex”). When the limit is reached, cloud review stops until the 1st of the next month (UTC), and the extension continues to show local results. Payment for more use is not available.

Processor. Cloudflare processes this data for us: Workers AI runs the models, R2 and D1 store records and counters, and Queues schedules the review of code graphs (section 7).

4. How we use personal data and our legal bases

The EU and UK GDPR require a legal basis for each use of personal data. The table lists ours. “Legitimate interests” means Art. 6(1)(f): we use the data where we have a real need, and that need is not overridden by your rights. You can object to any use based on legitimate interests (section 11).

Purpose	Data	Legal basis
Create and run your account, sign you in, send sign-in codes and service emails	Account, sessions, sign-in provider data	Contract, Art. 6(1)(b)
Provide the Services you use, including licenses, keys, Gateway routing, scans, sandboxes and usage limits	Licenses and keys, usage metadata, Studio license checks	Contract, Art. 6(1)(b). For Customer Content we act on the customer’s instructions under the DPA.
Take payment, invoice and handle tax	Billing, payment data from Stripe, usage metadata	Contract, Art. 6(1)(b). Legal obligation, Art. 6(1)(c), for tax and accounting records.
Confirm you meet the minimum age; verify phone numbers	Date of birth, phone number	Contract, Art. 6(1)(b). Legitimate interests: enforcing the age requirement in our Terms and preventing fake accounts.
Keep the Services secure; prevent fraud and abuse; rate limiting; suspending accounts	Security logs, sessions, IP address, account	Legitimate interests: protecting the Services, our users and our systems from attack and misuse
Find and fix errors	Error diagnostics, with user identity, request bodies and IP headers removed	Legitimate interests: keeping the Services working
Record server-side product events, if you turn on the usage-metrics setting	Product events with a pseudonymous user ID	Consent, Art. 6(1)(a). The usage-metrics setting is off by default, and you can turn it off at any time.
Website analytics, session replay and advertising measurement	Analytics data	Consent, Art. 6(1)(a)
Product-improvement and usage-metrics settings in your account	Aggregated diagnostic and usage data	Consent, Art. 6(1)(a). Both settings are off by default.
Train and evaluate AI models on turns sent to Preview models	Preview model turns: messages, tools, settings and outputs, under a pseudonymous account ID	Contract, Art. 6(1)(b), with the customer that chose a Preview model at its reduced price. For anyone else whose data appears in a turn, legitimate interests: developing and improving AI models, limited to turns a customer chose to send to a Preview model. You can object (section 11).
Review code and train and evaluate AI models with the VAKT extension’s cloud review (section 3.12)	Anonymised functions, code graphs and coverage, with no user identifier	Pending legal review before release. Default-on cloud review and training must not be released on an assumed legal basis. “Fully local” turns cloud review off.
Enforce cloud review limits and prevent abuse	Hashed IP address, install ID, account	Legitimate interests: keeping the free cloud review within its limits and protecting it from misuse
Answer support requests	Communications, account	Contract, Art. 6(1)(b), for questions about the Services. Otherwise legitimate interests: replying to people who contact us.
Send waitlist updates	Waitlist data	Consent, Art. 6(1)(a)
Respond to demo requests	Demo request data	Steps you ask for before a contract, Art. 6(1)(b). Legitimate interests: following up on your request.
Recruit	Applicant data	Steps you ask for before a contract, Art. 6(1)(b). Legitimate interests: assessing candidates for a role. Consent, Art. 6(1)(a), if you agree to longer retention.
Run vScan cooked for individuals and anonymous users	Transcripts, results, IP address, OS username	Contract, Art. 6(1)(b), to produce the result you ask for. Legitimate interests: rate limiting and preventing abuse.
Build whoami profiles	Git author names and emails	Contract, Art. 6(1)(b), for the user who asks for the profile. Legitimate interests, for collaborators: producing the profile the user requested from history the user already has.
Meet legal obligations and respond to lawful requests	Any data needed	Legal obligation, Art. 6(1)(c)
Establish, exercise or defend legal claims; enforce our Terms	Any data needed	Legitimate interests: protecting our rights and those of our users
Corporate transactions, such as a financing, merger, acquisition or sale of assets	Any data needed, kept to the minimum	Legitimate interests: allowing the transaction to be assessed and completed, and the business to continue afterward

If we want to use personal data for a new purpose that is not compatible with the original one, we will ask for your consent first.

5. AI and model training

• No training on your content, except Preview models and VAKT cloud review. We never train or evaluate AI models on Customer Content. That includes code, scans, findings, prompts, completions, sandbox files and cooked transcripts. This applies on every plan, and no setting or opt-in program changes it. There are two exceptions: a turn you send to a Preview model, and code the VAKT extension sends while its cloud review is on.
• VAKT extension cloud review. Cloud review is on by default and sends anonymised functions and a code graph, which we keep for up to 24 months to train Vaktex models. Records carry no user identifier, so we cannot delete them on request. Turn on “Fully local” to send nothing. Section 3.12 explains what is sent and how it is anonymised. For this data we are the controller.
• Preview models. Some Gateway models are marked Preview in the model listing and API. They cost less because every turn sent to one is kept to train AI models. This is how it works:
  • Only when you name it. The Gateway sends a turn to a Preview model only when you name that model. Automatic model choice and other models’ fallbacks never pick one, so turns to any other model are never kept.
  • What we keep. For each turn we keep the request (messages, tool definitions and generation settings) and the output. If a turn to a Preview model falls back to another model, that model’s output is kept too. We replace your account ID with a pseudonym, a one-way hash of your account email, before storing the turn.
  • Where and how long. We store turns in Cloudflare R2 in the United States, for up to 24 months, and then delete them. Only Vaktex personnel who work on model training can access them.
  • How we use them. Vaktex and its affiliates use them to develop, train, fine-tune and evaluate AI models and to improve the Services. We do not sell them, publish them or make them available to other customers. The provider that runs a Preview model may also train on the turns sent to it, where the model listing says so.
  • Deletion. We delete the turns kept under your account when you delete it, or sooner if you ask at support@vaktex.com. Deleting a turn does not remove what a model already trained on it has learned.
  • What not to send. Do not send a Preview model anything you would not want used for training. That includes secrets and credentials, personal data you are not permitted to share for this purpose, special categories of personal data, and content you do not have the rights to.
  • Our role. For these turns we are the controller, not your organization’s processor. Section 4 sets out our legal basis.
• Product-improvement setting. Your account has product-improvement and usage-metrics settings. Both are off by default. Turning on product improvement lets us use only aggregated diagnostic and usage data. Turning on usage metrics lets our servers send product events (section 3.2) to PostHog; while it is off, they send none. Neither setting ever allows training on your content.
• Model providers. We use providers’ business/API terms, under which API inputs and outputs are not used to train their models by default. Our DPA also commits that neither we nor our subprocessors train on Customer Personal Data, except turns sent to a Preview model as described above.
• Provider retention. Model providers may keep inputs and outputs for a limited time, for example for abuse monitoring. We disclose each provider’s retention per model in the Gateway API and model listing (section 3.8). You choose the model, and so the provider.
• No automated decisions with legal effects. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Decisions to suspend accounts are reviewed by a person.

6. Cookies and similar technologies

We use cookies and browser storage that are strictly necessary to sign you in, protect forms from bots and remember your cookie choice. We also store preferences on your device, such as your language and which audience you picked on the home page (vaktex:audience).

Analytics and advertising measurement tools in your browser (Google Analytics 4, PostHog, Amplitude and Mixpanel) and Sentry Session Replay are optional. They load only after you click “OK” on the banner shown on your first visit. “OK” and “No, thanks” are offered equally. If your browser sends a Global Privacy Control signal, we treat it as “No, thanks” and do not show the banner unless you open it from “Cookie settings” in the site footer. Declining has no effect on the Services. Sentry error and performance monitoring, which does not identify you, runs on every visit to keep the Site working (section 4).

To change your choice, click “Cookie settings” in the site footer and the banner will ask again. You can also email support@vaktex.com.

Our Cookie Policy lists every cookie and storage item, its purpose and how long it lasts.

7. Who we share personal data with

We don’t sell personal data. We share it only as described here.

Service providers (subprocessors)

We use service providers to run the Services. They process personal data on our instructions. The main ones are:

• Infrastructure and hosting: Cloudflare (hosting, CDN, DNS, DDoS protection, bot checks, aggregate web analytics, and Workers AI, R2, D1 and Queues for VAKT cloud review), Google Cloud (API services, storage, sandbox machines, key management, cooked analysis) and Neon (database).
• AI model providers, only when used: Fireworks AI, Google (Gemini API and Vertex AI), Amazon Web Services (Amazon Bedrock), Microsoft (Azure OpenAI and Azure AI Foundry), OpenAI, Anthropic, xAI, Mistral AI, Hugging Face and Cloudflare Workers AI. Your choice of model decides which provider receives your data.
• Business operations: Stripe (payments, invoicing and tax), Resend (transactional email), Twilio (phone verification, when enabled), Sentry (error and performance monitoring; session replay only with your consent) and PostHog (product analytics and server-side product events).
• Website analytics, only with your consent: Google Analytics 4, Amplitude and Mixpanel.

Our Subprocessors page gives the full list, with each provider’s purpose, the data it receives and its location. We give 30 days’ notice before adding a new subprocessor.

Your organization

If your account is linked to an organization, its administrators can see your membership, seats and access grants. They can also see your whoami profile.

Professional advisers

We share data with lawyers, accountants, auditors and insurers when they need it to advise or serve us.

Authorities

We disclose personal data to law enforcement or other authorities only when the law requires it. When we receive a government request, we:

• check that it is valid and legally binding;
• challenge requests that are unlawful or overbroad;
• notify the affected customer or user, unless the law prohibits it;
• disclose no more than the law requires.

Corporate transactions

If we are involved in a financing, merger, acquisition, reorganization or sale of assets, we may share personal data with the other parties and their advisers. We share only what is needed.

Public vScan cooked results

Anyone with the link to a vScan cooked result can view it (section 3.6).

At your direction

We share data with others when you ask us to.

8. International transfers

Vaktex is in the United States, and most of our subprocessors process data there. Some process it elsewhere: Mistral AI in France, Sentry in Germany, Stripe in the United States and Ireland, and Cloudflare on its global edge network. The Subprocessors page lists each location.

When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use these safeguards:

• EU-US Data Privacy Framework. The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. It covers US companies that certify under the Framework. The UK Extension and the Swiss-US Data Privacy Framework do the same for UK and Swiss data. Where a US provider is certified, we rely on its certification.
• Standard Contractual Clauses. Where a provider is not certified, we use the European Commission’s 2021 Standard Contractual Clauses, with the UK International Data Transfer Addendum and Swiss adaptations.
• Data from our customers. When customers in the EEA, the UK or Switzerland send Customer Content to Vaktex, the Standard Contractual Clauses in our DPA apply.

You can ask for a copy of the safeguards we use by emailing support@vaktex.com. We may remove commercial terms from the copy.

9. Retention

We keep personal data only as long as we need it. These are our retention periods:

Data	How long we keep it
Account data	While your account is active. Deleted within 30 days after you delete your account, except billing records and security logs (below).
Billing and tax records	As long as the law requires, typically 7 years under US law and up to 10 years under some EU tax laws
Sessions	30 days. The cookie that remembers your last sign-in method also lasts 30 days.
Email verification codes	10 minutes
Security and audit logs	Up to 12 months. License-key admin audit records may be kept for the life of the license plus 12 months.
Scan cache	Up to 90 days
AI Gateway session log	About 5 minutes after your app disconnects; up to about 10 minutes if a request was still running
AI Gateway usage metadata	For the life of the account, and afterward as long as needed for billing
AI Gateway Preview model turns	Up to 24 months. Deleted sooner when you delete your account or ask us to
VAKT cloud review training records	Up to 24 months. They carry no user identifier, so they cannot be deleted on request (section 3.12)
VAKT cloud review counters	Usage 7 days; spend 3 months; ignore votes 90 days; code graph owner 7 days after processing
Sandbox files	30 days after the assessment ends; evidence for confirmed Angrep findings is kept with the finding
Angrep assets, findings and evidence	For the life of the account or project, or until you delete them
vScan cooked raw transcripts	Up to 90 days
vScan cooked results	Until you delete them or ask us to
Analytics data	Up to 25 months
Waitlist	24 months after you join, or sooner if you ask us to remove you
Job applications	24 months after you apply
Support emails	3 years
Backups	Overwritten in their normal cycle, within 35 days. Deleted files may stay in our storage provider’s recovery store for up to 7 more days

When a period ends, we delete the data or make it anonymous.

10. Security

We protect personal data with these measures:

• Encryption. All traffic uses TLS, with HSTS. Cloudflare, Google Cloud and Neon encrypt stored data by default. We encrypt model provider API secrets with AES-256-GCM, using a unique IV for each value.
• Accounts. Passwords must be 12 to 128 characters. We check them against known breached passwords using a k-anonymity lookup, so only the first 5 characters of a hash leave our systems. Passwords are stored with a modern password hash. Email verification is required. One-time codes are stored hashed, expire after 10 minutes and allow 3 attempts. We rate limit requests, and banned accounts are blocked. Inference API keys are stored only as a one-way hash and are shown to you once, when created.
• Sessions and the web. Session cookies are Secure, HttpOnly and SameSite=Lax. We check trusted origins against cross-site request forgery, apply a strict Content Security Policy, mark signed-in pages private and not cacheable, and use Cloudflare Turnstile against bots.
• Infrastructure. Services authenticate to each other with Google identity tokens and IAM. Licenses are signed. Cloud permissions follow least privilege.
• Isolation. Sandbox machines are single-tenant and ephemeral. They last at most 12 hours and are destroyed after use. Accounts and organizations are logically separated in our database, and organizations have role-based permissions.
• Monitoring. Error monitoring removes user identity, request bodies and IP headers. We keep audit logs for license administration and sandbox control.
• Operations. Only authorized personnel can access production. Staff are bound by confidentiality obligations. We keep dependencies up to date. You can report vulnerabilities to support@vaktex.com.

No system is perfectly secure. If a breach affects Customer Personal Data, we notify the customer as the DPA requires.

11. Your rights

Your rights under the EU and UK GDPR

If you are in the EEA, the UK or Switzerland, you have the right to:

• Access the personal data we hold about you and get a copy.
• Correct inaccurate or incomplete data.
• Delete your data, where we have no lawful reason to keep it.
• Restrict our processing, for example while we check the accuracy of your data.
• Port your data: receive it in a machine-readable format, or have it sent to another company.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, where we rely on consent. This does not affect processing that took place before.
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions (section 5).

How to exercise your rights

Email support@vaktex.com with the subject “Privacy request”. Tell us which right you want to use.

• Verification. We confirm your identity before we act, usually by checking that you control the email address on your account. If we need more information, we will ask, and we use it only to verify you.
• Timing. We respond within 1 month. If a request is complex or you send many, we may extend this by up to 2 more months. We will tell you within the first month if we do.
• Cost. There is no fee. We may charge a reasonable fee or refuse only if a request is clearly unfounded or excessive, as the law allows.
• Refusals. If we cannot do what you ask, we will explain why.

If your request concerns Customer Content, we will pass it to the organization that controls it, as described in section 1.

Complaints

If you have a concern, please contact us first at support@vaktex.com. We will try to resolve it.

You also have the right to complain to a data protection supervisory authority, in particular where you live, work or think the problem happened:

• EEA: find your authority in the list of EDPB members.
• UK: the Information Commissioner’s Office.

Our representatives in the EU and UK

We have no establishment in the EU or UK and have not yet appointed representatives under Article 27 GDPR or Article 27 UK GDPR. We will name them here once appointed. Until then, contact us directly at support@vaktex.com about your data, wherever you live.

Data protection officer

We have not appointed a data protection officer because the law does not require one for our processing. For any privacy question, contact support@vaktex.com.

12. US state privacy rights

This section applies to residents of California and of other US states with comprehensive privacy laws, where those laws apply to us. It adds to the rest of this policy.

Personal information we collect and disclose

In the past 12 months we have collected the categories below. We collect them for the purposes in section 4 and keep them for the periods in section 9. We disclose them for business purposes to the service providers in section 7, and to the other recipients listed there.

Category (CCPA)	What we collect	Source	Purpose	Disclosed to
Identifiers	Name, email address, IP address, user ID, session and license identifiers, OS username (cooked)	You, your browser, your organization, sign-in providers	Accounts, Services, security, support, billing	Hosting, database and email providers; your organization
Customer records	Billing name and email, phone number	You, Stripe	Billing, phone verification	Stripe, Twilio
Protected classification characteristics	Date of birth, where an account flow asks for it	You	Confirming minimum age	Hosting and database providers
Commercial information	Plan, subscription, transaction history, usage and spend	You, Stripe, our systems	Billing, usage limits	Stripe, hosting and database providers
Internet or network activity	Request logs, product events, error diagnostics; with consent, page views, interactions and session replays	Your browser, our systems	Security, operations, error fixing; analytics with consent	Cloudflare, Sentry, PostHog; with consent, Google Analytics 4, Amplitude, Mixpanel
Geolocation	Approximate location derived from your IP address. We do not collect precise geolocation.	Your browser	Security; analytics with consent	Cloudflare; with consent, analytics providers
Audio, electronic or visual information	Optional profile image	You	Your account profile	Hosting providers
Professional or employment information	Job applications and CVs; organization and team details; git author data (whoami)	You, your organization, git history	Recruiting, organization features, whoami	Hosting providers; your organization
Inferences	whoami skill profiles	Git history	Producing the profile the user asks for	Your organization, if linked
Sensitive personal information	Account login: email and password	You	Signing you in and securing your account	Hosting and database providers
Content of communications	Support emails; cooked transcripts	You	Support; producing cooked results	Email and hosting providers; Google (cooked)

Sale and sharing

We do not sell personal information. We do not “share” it for cross-context behavioral advertising, with one exception: if you click “OK” on our cookie banner, Google Analytics 4 uses advertising signals for advertising measurement. Some state laws may treat this as “sharing” or targeted advertising. It happens only after you opt in. You can opt out by declining cookies or by sending a Global Privacy Control signal, which we honor as an opt-out. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

We do not disclose personal information to third parties for their own direct marketing.

When an organization sends a turn to a Preview model, we receive it as a business that uses it for training (section 5), not as the organization’s service provider. We do not sell those turns. The organization decides whether to send personal information to a Preview model and is responsible for doing so lawfully.

Sensitive personal information

The only sensitive personal information we collect is your account login (email address and password). We use it only to sign you in and secure your account, which are uses the law permits. We do not use it to infer characteristics about you. So the right to limit its use does not apply.

Your rights

Depending on your state, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy;
• delete it;
• correct it;
• get it in a portable format;
• opt out of sale, sharing and targeted advertising;
• appeal our decision on your request.

Making a request

Email support@vaktex.com with the subject “Privacy request”. We verify your identity by matching the information you give us to what we hold, usually by checking that you control the email on your account. We respond within 45 days, and may extend this once by another 45 days if we tell you why.

Authorized agents. You can use an authorized agent to make a request. We will ask the agent for your signed permission, and we may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Non-discrimination. We will not deny you service, charge you a different price or give you a different quality of service because you exercised your rights. We do not offer financial incentives for personal information.

Appeals. If we decline your request, you can appeal by replying to our decision or by emailing support@vaktex.com with the subject “Privacy appeal”. We will respond within the period your state’s law sets. If you disagree with the outcome, you can contact your state attorney general.

13. Children

The Services are business tools for professionals. They are not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email support@vaktex.com and we will delete it.

14. Changes to this policy

We will update this policy when our practices change. The date at the top shows the latest version. For material changes, we will email account holders at least 30 days before the change takes effect.

15. Contact

• Company: Vaktex, Inc.
• Address: 131 Continental Dr, Suite 305, Newark, DE 19713, USA
• Email: support@vaktex.com

For privacy requests, use the subject “Privacy request”.