Vestige Operator Privacy

Vestige Operator Privacy Notice
Effective August 25, 2026

1. Scope. This Notice explains how Vestige Operator collects, uses, discloses, and retains personal information when you use the Service, visit its authenticated customer surfaces, communicate with support, or complete an authorized purchase.

2. Information we collect. We may collect account and profile information; organization and workspace identifiers; content, evidence, decisions, and metadata you choose to submit; subscription, invoice, entitlement, and payment-status metadata received from Stripe; device, browser, network, authentication, security, and diagnostic information; and support communications. We do not intentionally store full card numbers or card security codes. Stripe processes payment credentials under its own privacy notice.

3. How we use information. We use information to provide and secure the Service; authenticate users; enforce authorization, entitlements, and release controls; process and reconcile billing status; prevent fraud and abuse; investigate incidents; provide support; communicate operational or legal notices; maintain records; comply with law; and improve reliability and usability. We do not use customer content to train a general-purpose model unless you separately give informed written permission.

4. Legal bases and choices. Depending on your location, processing may rely on performance of a contract, legitimate interests in operating and protecting the Service, compliance with legal obligations, or consent. Where consent applies, you may withdraw it without affecting prior lawful processing. Some information is required to provide, secure, or bill for the Service.

5. Sharing. We may share information with infrastructure, authentication, payment, monitoring, communications, and professional-service providers that process it for us; with authorities when legally required; in connection with a lawful business transaction; or with your direction or consent. We do not sell personal information or share it for cross-context behavioral advertising.

6. International processing. Service providers may process information in countries other than your own. Where required, we use appropriate contractual or legal safeguards for cross-border transfers.

7. Retention. We retain information for as long as needed to provide and secure the Service, maintain accurate billing and authorization records, resolve disputes, enforce agreements, and comply with law. Retention may continue in protected backups for a limited operational period. Deletion requests are evaluated against security, billing, legal, and integrity-record obligations.

8. Security. We use access controls, encryption where appropriate, least-privilege service boundaries, integrity checks, monitoring, and incident-response procedures. No method of storage or transmission is completely secure. Do not submit secrets through fields that are not expressly designed for them.

9. Your rights. Depending on your location, you may have rights to access, correct, delete, restrict, object to, or export personal information, and to appeal or complain to a regulator. Submit requests through the authenticated support surface. We may verify your identity and may retain information where law or security obligations require it.

10. Children. The Service is not directed to children under thirteen, and the initial invite-only offer is not intended for anyone who cannot form a binding agreement. If you believe a child provided personal information, contact us through the authenticated support surface.

11. Automated processing. The Service may organize or evaluate evidence using software and models, but customers remain responsible for consequential decisions. The Service does not represent that automated output is provider truth, legal advice, or a guaranteed factual determination.

12. Changes to this Notice. We may update this Notice to reflect legal, security, operational, or product changes. Material changes will be presented through the Service or verified customer communication channel when required by law.

13. Contact. Use the authenticated Vestige Operator support surface shown in your account for privacy questions and requests. The opening is not approved until that destination has been verified as monitored and able to route privacy and security matters to the owner.

Back to account