Privacy Policy

This Privacy Policy explains how Verttx Solutions LLC ("Verttx," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our website, web application, mobile applications, and related services (collectively, the "Services"). It also explains the choices and rights you have.

Verttx Solutions LLC, a Washington limited liability company based in the United States, is the data controller for the personal information described in this Policy, except where Section 3.4 (customer data you upload) applies.

---

Summary

• What we collect: your account details, the business context and files you give your assistants, your conversations and attachments, your feedback on responses, billing details (handled by Stripe), and standard technical and usage data.
• Why: to run your assistants, remember your business, enforce plan limits, process payments, keep the Services secure, support you, and improve the product.
• AI processing: your messages, business context, and attachments are sent to Anthropic, the company behind the Claude AI model, to generate responses. Neither we nor Anthropic use your content to train AI models. We ask for your agreement in the app before anything is sent.
• Sharing: only with the service providers that run VERTTX (listed in Section 4), when the law requires it, or if our business changes hands. We do not sell your personal information, and we do not use it for third-party advertising.
• Your controls: export everything, delete conversations, or permanently delete your account any time from Settings → Privacy & data.
• Contact: contact@verttx.ai (subject line "Privacy Request").

---

1. Information We Collect

1.1 Information you give us

• Account information. Your email address, a password (we never see it in plain text — it is hashed by our authentication provider), your display name if you set one, and your preferences.
• Sign-in provider information. If you sign in with Google or Apple, we receive the basic profile information you authorize the provider to share — typically your name, email address, and a provider account identifier. With Sign in with Apple you may choose to hide your email; we then receive a private relay address.
• Business context. The answers you give when setting up an assistant — about your business, your customers, your products, your voice, your role, and similar — and any edits you make later in "What I know."
• Files. Documents you upload to an assistant so it can use them as reference. We extract the text from each file and store both the file and the extracted text.
• Conversations. The messages you send to your assistants, any files or images you attach in chat, the responses generated for you, and any documents the Services generate at your request.
• Feedback and reports. When you rate a response (thumbs up or down) or report a problem with it, we record the rating, the reason and note you give, and the message it concerns.
• Consent records. When you accept our AI-processing disclosure or these documents, we record which version you accepted and when.
• Payment information. When you subscribe, our payment processor, Stripe, collects your payment card details directly. We do not receive or store full card numbers; we receive limited details needed to manage your subscription, such as the card brand, last four digits, expiration date, billing country, and transaction status.
• Communications. What you send us when you contact support, reply to our emails, or otherwise communicate with us.

1.2 Information collected automatically

• Device and connection information. IP address, browser or app version, operating system, device type and identifiers, language, and time zone.
• Usage information. Which features you use and when — for example assistants created, messages sent (counts and timing, for plan metering), files uploaded, pages viewed, and settings changed.
• Log and diagnostic information. Server logs, error reports, and performance data that help us keep the Services reliable.
• Cookies and similar technologies. See Section 9.

1.3 Information from third parties

• Sign-in providers (Google, Apple) when you use them to sign in;
• Stripe about the status of your payments and subscription (for example a successful renewal or a failed charge);
• Our AI provider returns the responses generated for you and related metadata (such as token counts), which we store as part of your conversations.

We do not buy personal information from data brokers, and we do not collect precise geolocation.

2. How We Use Information

We use the information we collect to:

• Provide the Services. Create and secure your account; configure and run your assistants; store your business context, files, and conversations; generate responses; search the web when a question calls for current information; generate documents; and deliver them to you on web and mobile.
• Remember context. Keep your business context and files available to your assistants, and — on long conversations — generate a short AI-written summary of earlier messages so the assistant stays informed without re-reading the whole history.
• Meter and bill. Count messages for plan limits, manage your trial, subscription, upgrades, and cancellation, process payments through Stripe, and detect billing problems.
• Communicate with you. Send service messages such as sign-in links, password resets, receipts, billing notices, security alerts, and notices of changes to our terms; respond to your support requests.
• Improve the Services. Understand how features are used, diagnose errors, measure performance, and decide what to build. Where possible we do this with aggregated or de-identified data.
• Review reported responses. When you rate or report a response, our team may read the relevant conversation to investigate the problem and improve the product.
• Keep the Services safe. Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service and Usage Policy.
• Comply with law. Meet our legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
• Marketing (optional). We may send you product news and tips by email. You can opt out at any time using the unsubscribe link in any such email; service messages will continue while you have an account.

We do not use your personal information for automated decisions that produce legal or similarly significant effects on you, and we do not use it for third-party advertising or profiling.

3. AI Processing

3.1 What is sent to our AI provider

Your assistants are powered by Claude, an AI model developed by Anthropic, PBC ("Anthropic"), accessed through Anthropic's commercial API. To generate a response, we send Anthropic:

• the message you are sending and the recent messages in that conversation (and, on long conversations, the AI-written summary of earlier messages);
• the business context and extracted file text belonging to the assistant you are chatting with;
• any files or images you attach to the message.

We do not send Anthropic your account email, payment details, or account identifiers. (If you include your name or role in an assistant's business context, that is sent as part of the context.) When a conversation uses web search, the assistant's search queries are executed by Anthropic's web search tool on our behalf; the query and the page content it retrieves are processed by Anthropic and its search provider, not tied to your identity. When you ask for a document, it is built in a sandboxed environment operated by Anthropic and then stored in your account.

3.2 No AI training

We do not use your content to train, fine-tune, or improve AI models, and under our agreement with Anthropic, Anthropic may not use it to train its models either. We will not change this without notifying you in advance and giving you the ability to choose.

3.3 Anthropic's retention

Anthropic processes this content as our service provider. Under its commercial data policy, Anthropic automatically deletes API inputs and outputs from its systems within 30 days, except where it is required by law to keep them longer or where content is flagged for a violation of its usage policy (in which case Anthropic may keep the flagged content for up to two years for trust-and-safety purposes).

3.4 Your customers' data — controller and processor

Your business context, files, and conversations may include personal information about other people (for example customers, prospects, or employees). For that information you decide what to provide and why, so you act as the data controller (or the equivalent under your local law), and we process it only on your behalf and on your instructions — to run the Services for you. You are responsible for having a lawful basis to provide it and for honoring those individuals' rights. If your jurisdiction requires a data processing agreement, contact contact@verttx.ai.

3.5 In-app disclosure and consent

Before any of your content is sent to Anthropic, we show you a disclosure in the app that names Anthropic and describes what is shared, and we ask for your agreement. We record the version you accepted. You can review the disclosure at any time in Settings → Privacy & data. If you do not want this processing, you can decline, and you can delete your account.

4. How We Share Information

We share personal information only as described here. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4.1 Service providers (subprocessors)

We use these providers to operate the Services. Each is bound by contract to process your information only to provide its service to us and to protect it.

We may add, replace, or remove providers. When we do, we update this table. Providers may process data in countries other than yours (see Section 8).

4.2 Legal reasons

We may disclose information if we believe in good faith it is necessary to comply with a law, regulation, legal process, or enforceable governmental request; to enforce our Terms of Service or Usage Policy; to detect, prevent, or address fraud, abuse, security, or technical issues; or to protect the rights, property, or safety of Verttx, our users, or the public. Where legally permitted, we will try to notify you before disclosing your information in response to a legal request.

4.3 Business transfers

If Verttx is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, your information may be transferred as part of that transaction, subject to this Policy. We will notify you (by email or in the Services) of any change in ownership or control of your personal information and of any choices you may have.

4.4 With your direction or consent

We share information with third parties when you ask us to or otherwise consent.

4.5 Aggregated or de-identified data

We may create and share aggregated or de-identified information that cannot reasonably be used to identify you — for example overall usage statistics — for any purpose.

5. Data Retention

• While your account is active, we keep your account information, business context, files, and conversations so your assistants can use them and you can access your history. You can delete individual conversations, all conversations, individual files, or an assistant at any time; deletion removes them from our live systems immediately.
• When you delete your account, we immediately delete your account record, assistants, business context, files, conversations, attachments, generated documents, feedback, and consent records from our live systems; delete your files from storage; delete your Stripe customer record and cancel any subscription; delete your authentication identity; and, if you used Sign in with Apple, revoke the Apple authorization. Copies in encrypted backups are overwritten within 30 days.
• What we keep after deletion: records we must retain for legal, tax, accounting, or regulatory reasons (for example payment records held by Stripe); information needed to resolve disputes or enforce our agreements; security and abuse logs for a limited period; and aggregated or de-identified data.
• Anthropic deletes the content we send it within 30 days, as described in Section 3.3.
• Technical logs are kept for a limited period (typically no more than 90 days) unless needed longer to investigate an incident.

6. Your Rights and Choices

6.1 Controls in the app

From Settings → Privacy & data you can, at any time:

• Export a copy of your data (account, assistants, business context, files, conversations) in a portable JSON format;
• Delete conversations — individually or all at once;
• Delete your account permanently, which triggers the deletion described in Section 5;
• Review the AI-processing disclosure you accepted.

You can update your account details in Settings → Profile, manage your subscription in Settings → Billing, and unsubscribe from marketing email using the link in any such message.

6.2 Rights that may apply to you

Depending on where you live, you may have the right to: know what personal information we hold about you and receive a copy; correct inaccurate information; delete your information; receive it in a portable format; restrict or object to certain processing; withdraw consent where processing is based on consent; opt out of "sales," "sharing," targeted advertising, or profiling (we do none of these); limit the use of sensitive personal information (we do not use it for purposes that would require this); not be discriminated against for exercising your rights; and appeal a decision we make about your request.

To exercise any right not covered by the in-app controls, email contact@verttx.ai with the subject line "Privacy Request." We will verify your identity — usually by confirming you control the account email — before acting. An authorized agent may make a request on your behalf if they provide evidence of your written authorization; we may still ask you to verify your identity directly. We respond within the time required by applicable law (generally 30 to 45 days, and we will tell you if we need longer). If we decline a request, we will explain why, and you may appeal by replying to our response.

6.3 European Economic Area, United Kingdom, and Switzerland

If you are in the EEA, UK, or Switzerland, we process your personal data under the following legal bases:

You have the rights listed in Section 6.2, including to object to processing based on legitimate interests. You also have the right to lodge a complaint with your local data protection authority — for the EU, the list is at edpb.europa.eu; for the UK, the Information Commissioner's Office at ico.org.uk; for Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first: contact@verttx.ai.

6.4 California and other U.S. states

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have the rights in Section 6.2 as provided by your state's law. For California residents, the following disclosures cover the preceding 12 months:

We have not sold or shared (for cross-context behavioral advertising) personal information in the preceding 12 months, and we do not sell or share the personal information of anyone, including consumers under 16. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit under California law. We honor Global Privacy Control signals as a request to opt out of sale or sharing; because we do neither, honoring the signal does not change how we process your data. We do not respond to browser "Do Not Track" signals, for which there is no accepted standard.

6.5 Canada

If you are in Canada, you have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including to access and correct your personal information and to withdraw consent (subject to legal and contractual restrictions). Your information may be processed and stored in the United States, where it may be accessible to U.S. authorities under U.S. law. You may complain to the Office of the Privacy Commissioner of Canada.

6.6 Other regions

If you are in Australia, Brazil, or another country with a data protection law, you may have similar rights under that law and the right to complain to your local regulator. Contact us at contact@verttx.ai to exercise them.

7. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS) and at rest, hashed passwords, per-user access controls at the database and storage layers, signed short-lived links for file downloads, least-privilege access for our team, rate limiting, security headers, and monitoring. Our providers maintain their own security programs and certifications.

No system is completely secure. If we learn of a security breach affecting your personal information, we will notify you and any regulators as required by applicable law. Please help protect your account by using a strong, unique password and keeping your sign-in provider account secure.

8. International Transfers

We are based in the United States, and our providers process data in the United States (see Section 4.1). If you use the Services from outside the United States, your information will be transferred to and processed in the United States, which may have data protection laws different from those in your country.

For transfers of personal data from the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), supplemented where appropriate, or on our providers' certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. You may request a copy of the relevant safeguards at contact@verttx.ai.

9. Cookies and Similar Technologies

We use a small number of cookies and browser storage on our website and web app:

• Essential. Authentication cookies that keep you signed in, security cookies (for example to protect sign-in and payment flows), and settings stored in your browser (for example your theme or a draft message). These are required for the Services to work and cannot be switched off.
• Analytics. Our product analytics and error-monitoring tools may set cookies or identifiers to understand how the Services are used and to diagnose problems. Where the law requires consent for these, we ask for it.
• No advertising cookies. We do not use advertising, retargeting, or social-media tracking cookies.

You can control cookies through your browser settings. Blocking essential cookies will prevent you from signing in. Our mobile apps do not use cookies; they use secure device storage for your session.

10. Children

The Services are for adults and are not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us personal information, contact contact@verttx.ai and we will delete it.

11. Third-Party Links and Content

Responses from your assistants may include links to, or content from, third-party websites, particularly when web search is used. Those sites have their own privacy practices, which we do not control. This Policy does not apply to them.

12. Changes to This Policy

We may update this Policy from time to time. If we make a material change, we will notify you at least thirty (30) days before it takes effect, by email to your account address or by a prominent notice in the Services. Changes that are not materially adverse to you — for example adding a provider to Section 4.1 for an existing purpose, or clarifications — may take effect when posted. The "Last updated" date at the top shows the current version. Your continued use of the Services after a change takes effect means you acknowledge the updated Policy.

13. Contact Us

Questions, concerns, or requests about this Policy or your personal information:

Verttx Solutions LLC Email: contact@verttx.ai (subject line "Privacy Request") Website: verttx.ai

We respond as soon as reasonably possible and within the time required by applicable law.