Privacy Policy

Last updated 29 August 2026

Vevesh provides folder-native knowledge AI for lawyers, engineers, scientists, researchers, consultants, and other professionals who need citation-grounded answers — not consumer chat uploads. This Privacy Policy explains how Vevesh ("Vevesh", "we", "us") collects, uses, stores, and protects information when you use our website, desktop application, browser surfaces, and team knowledge-base services (collectively, the "Service").

We designed Vevesh around zero retention of customer corpora for model training, explicit data-plane separation, and administrator-controlled AI model routing. This policy should be read together with our Terms of Service and Security page.

1. Definitions

  • "Customer Data" means source files, folders, extracted chunks, embeddings, metadata, prompts, answers, citations, and configuration you or your organization provide to the Service.
  • "Account Data" means registration details, team membership, RBAC settings, billing identifiers, and usage metering records.
  • "AI Providers" means third-party model vendors you or your administrator enable (e.g. OpenAI, Anthropic, Google, Groq, Moonshot AI, DeepSeek, xAI, Qwen, MiniMax, GLM).
  • "Local Mode" means indexing and extraction primarily on your device with optional sync of derived artifacts only.
  • "Server Extraction Mode" means raw files are transmitted through a managed pipeline for vision-heavy or batch processing, as configured per knowledge base.
  • "Design Partner" means organizations in Vevesh private preview under separate onboarding terms.

2. Scope and roles

For business and team accounts, your organization is typically the data controller for Customer Data. Vevesh acts as a processor when handling Customer Data on your instructions — indexing, retrieval, generation, billing, and support.

For website visitors who only browse vevesh.com without an account, Vevesh may act as controller for minimal technical logs and marketing analytics described below.

3. Information we collect

3.1 Account and team data

  • Name, email, organization, role, and authentication identifiers.
  • Team membership, project assignments, RBAC privileges, and allowed knowledge-base IDs.
  • Stripe customer IDs and subscription state for team knowledge bases.
  • Support correspondence and onboarding notes you choose to share.

3.2 Customer Data you connect

  • Folder paths, file hashes, revision metadata, and exclude patterns — not necessarily full file contents in local mode.
  • Extracted text, layout structure, chunks, vectors, and index generations when you sync or use server extraction.
  • Conversation history, verification artifacts, and exported evidence packs.
  • Speech-to-text transcripts when you use voice input features.

3.3 Usage and technical data

  • Extraction engine usage, embed token metering, model lane selection, and latency metrics.
  • Error logs, crash reports, and pipeline stage timings (raw → chunks → indexed).
  • Device type, app version, and coarse network diagnostics for reliability.
  • Website cookies and similar technologies as described in Section 12.

3.4 What we do not intentionally collect

  • We do not require you to migrate your authoritative folder tree into a vendor-owned workspace.
  • We do not sell Customer Data or prompt content to data brokers.
  • We do not use Customer Data to train foundation models for other customers unless you explicitly opt in where such a feature exists.

4. How we use information

  • Provide, maintain, and improve indexing, retrieval, chat, verification loops, and team knowledge bases.
  • Route requests to AI Providers you enable, with minimum necessary context for each task.
  • Meter usage, generate invoices, prevent abuse, and enforce plan limits.
  • Respond to support, security, and legal requests.
  • Send product updates to design partners who opt in; you may unsubscribe from non-transactional email.
  • Comply with law, enforce Terms, and protect rights, safety, and integrity of the Service.

5. Zero retention and training

Vevesh is architected so Customer Data is not pooled into a shared training corpus for other tenants. Query traffic is processed to produce answers, citations, and billing records — not harvested as engagement analytics on prompt content.

Embeddings and chunks stored for your knowledge bases are treated with the same confidentiality expectations as Customer Data. Deleting a knowledge base or account triggers deletion workflows subject to backup retention windows described in Section 6.

When traffic routes to external AI Providers, retention at those providers depends on the lane your administrator configures (zero-retention APIs where available vs. provider default logging). We document applicable tiers during onboarding.

6. Retention periods

  • Active index artifacts persist until you delete the project, knowledge base, or account, or until your retention policy triggers re-sync.
  • Conversation history persists according to workspace settings; you may delete threads or request bulk deletion.
  • Billing and tax records may be retained up to seven years where required by law.
  • Security logs may be retained up to twenty-four months for incident investigation.
  • Backups may lag primary deletion by up to thirty days before overwrite.

7. Sharing and subprocessors

We share data only as needed to operate the Service, with contractual protections comparable to industry practice for enterprise knowledge SaaS (similar to Notion, Glean, and Microsoft Copilot enterprise tiers).

7.1 AI Providers

  • OpenAI, Anthropic, Google, Groq, Moonshot AI, DeepSeek, xAI, Qwen, MiniMax, GLM — only when your administrator routes a task to that vendor.
  • Context minimization: retrieval packs include indexed excerpts relevant to the query, not your entire corpus by default.

7.2 Infrastructure and payments

  • Hosting, object storage, vector indexes, and edge workers under isolated data planes.
  • Stripe for team knowledge-base subscriptions and payment processing.
  • Email delivery for transactional notices.

7.3 Legal and safety

  • We may disclose information if required by law, court order, or to prevent fraud, abuse, or harm.
  • We do not voluntarily provide Customer Data to governments without appropriate process except emergencies involving imminent harm.

8. International transfers

Vevesh and subprocessors may process data in the European Union, United States, and other regions depending on deployment. Where required, we offer Standard Contractual Clauses or equivalent mechanisms to design partners. Self-hosted deployment may keep primary processing on your infrastructure.

9. Security measures

  • Isolated data planes separating customer knowledge bases from marketing and operational surfaces.
  • Encryption in transit (TLS 1.2+) for remote APIs; encryption at rest for stored index artifacts.
  • Role-based access control, ghost disclosure modes, and project-level KB restrictions.
  • Access logging, token rotation, and least-privilege operator access.
  • See our Security page for responsible disclosure and questionnaire contacts.

10. Your rights

Depending on jurisdiction (GDPR, UK GDPR, CCPA/CPRA, and others), you may have rights to access, correct, delete, restrict, port, or object to processing of personal data. Team administrators can export or delete many artifacts directly; contact us for requests we cannot self-serve.

  • EU/UK: lodge a complaint with your supervisory authority.
  • California: opt out of "sale" or "sharing" — Vevesh does not sell personal information as defined by CPRA.
  • Design partners may execute a Data Processing Addendum on request.

11. Children

The Service is not directed to children under sixteen. We do not knowingly collect personal information from children. Contact us to request deletion if you believe a child provided data.

12. Cookies and analytics

  • Essential cookies for session security and load balancing on vevesh.com.
  • Optional analytics cookies only where enabled and consented where required by law.
  • No third-party advertising cookies on authenticated product surfaces.

13. Changes to this policy

We update this Privacy Policy as features mature toward general availability. Material changes will be notified to active design partners via email or in-app notice at least thirty days before effective date when practicable.

14. Contact

Privacy requests: helloo@vevesh.com with subject "Privacy".

Data Protection inquiries for EU/UK partners: same address; include your organization and deployment region.