VETT
Dashboard

Privacy Policy

Last Updated: May 2, 2026
Effective Date: May 2, 2026

VETT ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard information when you use our platform at vettit.ai (the "Service").

By using VETT, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information You Provide

When you create an account or use VETT, we collect:

  • Account information: Name, email address, password (hashed), company name (optional)
  • Payment information: Billing address, payment method details (processed securely via Stripe; we do not store credit card numbers)
  • Mission data: Research questions, screener criteria, target audience parameters, creative assets (images/videos) you upload
  • Communications: Messages you send to our support team or via contact forms

1.2 Information Collected Automatically

  • Usage data: Pages visited, features used, mission types run, frequency of use
  • Device information: IP address, browser type, operating system, device identifiers
  • Cookies and similar technologies: Session cookies, authentication tokens, analytics cookies (see Section 7)
  • Log data: Server logs including timestamps, requests, error reports

1.3 Information from Third Parties

  • OAuth providers: If you sign in via Google or other providers, we receive your email and basic profile information
  • Payment processors: Stripe shares limited transaction details for billing purposes

2. How We Use Your Information

We use your information to:

  • Provide and maintain the VETT Service
  • Process payments and send transactional emails (receipts, confirmations)
  • Generate AI-powered synthetic personas based on your screener inputs
  • Communicate with you about your account, missions, and product updates
  • Improve our platform, develop new features, and conduct research
  • Comply with legal obligations and prevent fraud or abuse
  • Send marketing communications (only with your consent; you can unsubscribe anytime)

3. AI Processing and Synthetic Data

VETT uses AI models (including third-party providers like Anthropic) to generate synthetic personas and analyze responses. Your mission inputs may be processed by these AI providers to generate results.

  • We do not use your mission data to train AI models
  • AI providers are bound by their own privacy and data handling policies
  • Synthetic personas generated for your missions are not based on real individuals' personal data

4. How We Share Your Information

We do not sell your personal information. We share data only in these limited circumstances:

  • Service providers: Stripe (payments), Supabase (database), Vercel (hosting), Resend (email), Anthropic (AI processing). These providers process data on our behalf under strict confidentiality agreements.
  • Legal requirements: When required by law, court order, or to protect our rights, users, or the public
  • Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred (you'll be notified)
  • With your consent: When you explicitly authorize sharing

5. Data Retention

  • Account data: Retained as long as your account is active, plus 90 days after deletion
  • Mission data: Retained for 12 months by default; you can delete missions at any time from your dashboard
  • Payment records: Retained for 7 years to comply with tax and accounting laws
  • Marketing data: Retained until you unsubscribe

You can request deletion of your data at any time by contacting us at privacy@vettit.ai.

6. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Update inaccurate or incomplete information
  • Deletion: Request deletion of your data (subject to legal retention requirements)
  • Portability: Receive your data in a machine-readable format
  • Objection: Object to certain types of processing (e.g., marketing)
  • Withdrawal of consent: Withdraw consent for processing at any time

To exercise these rights, email privacy@vettit.ai. We will respond within 30 days.

GDPR (EU/EEA Users)

If you are in the EU/EEA, our legal basis for processing includes: contractual necessity (providing the Service), legitimate interests (improving the Service, fraud prevention), legal obligation, and consent (marketing).

CCPA (California Users)

California residents have additional rights under the California Consumer Privacy Act, including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

UAE Personal Data Protection Law

We comply with the UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data. UAE residents may exercise rights under this law.

7. Cookies

We use cookies and similar technologies to:

  • Authenticate users and maintain sessions
  • Remember preferences (language, theme)
  • Analyze usage to improve the Service
  • Prevent fraud and abuse

You can control cookies through your browser settings. Disabling certain cookies may limit functionality.

8. Data Security

We implement industry-standard security measures to protect your information:

  • Encryption in transit (TLS) and at rest
  • Secure authentication via Supabase
  • Regular security audits and vulnerability assessments
  • Access controls limiting employee access to personal data
  • Payment processing via PCI-compliant providers (Stripe)

However, no system is 100% secure. We cannot guarantee absolute security and recommend using strong passwords and enabling two-factor authentication.

9. Mobile App (vett-mobile, when shipped)

When you use the VETT mobile app on iOS or Android:

  • Push notifications: with your explicit opt-in, we send a push when your mission completes. The Expo push token associated with your device is stored in our push_tokens table keyed to your account. You can revoke push permission at any time via your device's notification settings; on revocation we delete the token.
  • Session persistence: your Supabase auth session is stored in the device's secure-store enclave (Keychain on iOS, Keystore on Android). It never leaves the device unencrypted.
  • In-app payments: payments process via Stripe Checkout in a secure web view. We do not handle card numbers; Stripe does. Apple Pay support is available where Apple Pay is configured for your device.
  • No location, contacts, photos, or microphone access: the app doesn't request these permissions. The app's privacy nutrition labels in the App Store reflect this exactly.

The mobile app is intended for users aged 18+. The same data collection scope applies as the web app.

10. International Data Transfers

VETT operates from the UAE and uses service providers globally. Your data may be transferred to, stored, and processed in countries outside your jurisdiction (including the United States and the European Union). We ensure appropriate safeguards are in place, including standard contractual clauses where applicable.

11. Children's Privacy

VETT is not intended for users under 18. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly. The mobile app's age rating is 4+ (no objectionable content) but the app is intended for adult users.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent notice on our website. The "Last Updated" date reflects the most recent version. Continued use of the Service after changes constitutes acceptance.

13. Contact Us

For questions, concerns, or to exercise your rights:

VETT (Vettit.ai)
Email: privacy@vettit.ai
Website: https://vettit.ai
Data Protection Officer: Jamil Kabbara

This Privacy Policy is governed by the laws of the United Arab Emirates. Disputes will be resolved in the courts of Dubai, UAE, unless otherwise required by applicable law.