Privacy Policy

The data controller for the Vesper AI platform (vesperai-agent.com) is:

Account Information

When you register, we collect your name, email address, company name, and password (stored in hashed form). We may also collect billing and payment information for subscription management.

Uploaded Documents

You may upload documents (e.g., legal contracts, financial statements, property reports) for AI-powered due diligence analysis. We process these documents solely for the purpose of generating Reports within your account.

Usage Data

We automatically collect information about how you interact with the Platform, including pages visited, features used, timestamps, IP address, browser type, device information, and referring URLs.

Documents you upload are processed by our AI models to extract, analyse, and summarise relevant due diligence information. During processing:

• Documents are encrypted in transit (TLS) and at rest (AES-256).
• Document content is sent to our AI processing providers strictly for analysis purposes.
• We do not use your documents to train AI models.
• Documents and generated Reports are retained for the duration of your account, unless you request earlier deletion. Upon account termination, documents are deleted within 10 days.

We take the security of your documents seriously. Our measures include:

• Encryption in transit and at rest.
• Access controls limiting document access to your account only.
• Regular security audits and vulnerability assessments.
• Secure cloud infrastructure with industry-standard certifications.
• Employee access restricted on a need-to-know basis under confidentiality obligations.

While we implement robust safeguards, no system is completely secure. We cannot guarantee absolute security of your data.

We process your personal data on the following legal bases:

• Contract performance — to provide the Platform services you have requested.
• Legitimate interest — to improve our Platform, prevent fraud, and ensure security.
• Consent — where you have given explicit consent (e.g., marketing communications).
• Legal obligation — to comply with applicable laws and regulations.

We use trusted third-party service providers to operate the Platform. These may include:

• AI processing providers — for document analysis and report generation.
• Cloud hosting providers — for data storage and infrastructure.
• Payment processors — for subscription billing.
• Analytics providers — for usage analytics and Platform improvement.

All third-party processors are bound by data processing agreements and are required to comply with GDPR and applicable data protection legislation. We do not sell your personal data to third parties.

As a data subject, you have the following rights under the General Data Protection Regulation:

• Right of access — request a copy of your personal data.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your personal data ("right to be forgotten").
• Right to restriction — request restriction of processing in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest or direct marketing.
• Right to withdraw consent — where processing is based on consent, withdraw at any time.

To exercise any of these rights, please contact us at info@vesperai-agent.com. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use cookies and similar technologies for:

• Essential cookies — required for authentication and Platform functionality.
• Analytics cookies — to understand usage patterns and improve the Platform.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA) where our third-party processors operate. In such cases, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

We retain your personal data for as long as your account is active or as needed to provide services. After account termination, we retain data for up to 10 days before deletion, unless longer retention is required by law. Usage data and logs are retained for up to 24 months for analytics and security purposes.

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or by email. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

For questions about this Privacy Policy or your personal data, please contact us at: info@vesperai-agent.com

Vesper AI — The Netherlands