Privacy Policy

1. Information We Collect

Information You Provide

We collect information you voluntarily provide when using our Service:

• Account Information: Name, email address, company name, and password
• Google Sign-In: If you choose to sign up or sign in with Google, we receive your name, email address, and a Google account identifier from Google. We use this information solely to create and authenticate your account. We never receive or store your Google password, and you can disconnect your Google account from your account settings at any time.
• Microsoft Sign-In: If you choose to sign up or sign in with Microsoft, we receive your name, email address, and a Microsoft account identifier from Microsoft. We use this information solely to create and authenticate your account. We never receive or store your Microsoft password, and you can disconnect your Microsoft account from your account settings at any time.
• LinkedIn Sign-In: If you choose to sign up or sign in with LinkedIn, we receive your name, email address, and a LinkedIn account identifier from LinkedIn. We use this information solely to create and authenticate your account. We never receive or store your LinkedIn password, and you can disconnect your LinkedIn account from your account settings at any time.
• GitHub Sign-In: If you choose to sign up or sign in with GitHub, we receive your name, verified email address, and a GitHub account identifier from GitHub. We use this information solely to create and authenticate your account. We never receive or store your GitHub password, and you can disconnect your GitHub account from your account settings at any time.
• Profile Data: User preferences, profile settings, and customization choices
• Content Data: Business process diagrams, documentation, comments, and other content you create
• Communication Data: Messages sent through our support system, feedback, and correspondence
• Payment Information: Billing address and payment method details (processed securely by third-party providers)

Information We Collect Automatically

When you use our Service, we automatically collect certain information:

• Usage Data: How you interact with our Service, features used, time spent, and navigation patterns
• Device Information: Browser type, operating system, IP address, and device identifiers
• Log Data: Server logs, error reports, and system performance metrics
• Cookies and Similar Technologies: Session management, preferences, and analytics data

2. How We Use Your Information

We use the information we collect for the following purposes:

Service Provision

• Provide, maintain, and improve our business process modeling platform
• Enable real-time collaboration and process sharing features
• Process AI-powered features and generate intelligent insights
• Store and sync your business process data across devices

Communication and Support

• Respond to your inquiries and provide technical support
• Send important service announcements and updates
• Notify you about new features and improvements
• Conduct user research and gather feedback

Business Operations

• Process payments and manage subscriptions
• Analyze usage patterns to improve our Service
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations and enforce our Terms of Service

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following limited circumstances:

Service Providers

We work with trusted third-party service providers who help us operate our Service:

• Cloud hosting and data storage providers
• Payment processing companies
• Email delivery and communication services
• Analytics and performance monitoring tools
• AI and machine learning service providers

Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes, court orders, or government requests
• Protect our rights, property, or safety, or that of our users
• Investigate potential violations of our Terms of Service
• Prevent fraud, security breaches, or other harmful activities

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the business transaction. We will notify you of any such change in ownership or control.

4. Data Security

We implement comprehensive security measures to protect your information:

• Encryption: Data is encrypted in transit using TLS and at rest using industry-standard encryption
• Access Controls: Strict access controls and authentication mechanisms for our systems
• Regular Audits: Periodic security assessments and vulnerability testing
• Employee Training: Comprehensive security and privacy training for our team
• Incident Response: Established procedures for handling security incidents

While we implement strong security measures, no system is completely secure. We encourage you to use strong passwords and keep your account credentials confidential.

5. Data Retention

We retain your information for as long as necessary to provide our Service and fulfill our legal obligations:

• Account Data: Retained while your account is active and for a reasonable period after account closure
• Process Data: Stored according to your subscription plan and user preferences
• Usage Data: Retained only for the period needed for analytics and service improvement, subject to the applicable service provider's configured retention settings
• Legal Requirements: Some data may be retained longer to comply with legal obligations

6. Your Privacy Rights

You have several rights regarding your personal information:

Access and Portability

• Request access to your personal information
• Export your process data and content
• Receive a copy of your data in a structured format

Correction and Deletion

• Update or correct inaccurate personal information
• Request deletion of your personal information
• Close your account and remove associated data

Control and Preferences

• Manage your communication preferences
• Control data sharing settings
• Opt-out of non-essential data processing

7. Cookies and Tracking

We use cookies and similar technologies to enhance your experience:

Essential Cookies

Required for basic functionality, including authentication, session management, and security features.

Analytics Cookies

With your consent, these enable Google Analytics and broader PostHog measurement to help us understand how people interact with our marketing website. Section 12 explains the limited, cookieless PostHog measurement that continues before you make a choice or after you decline optional analytics cookies.

Consent Storage

We store your choice in a strictly necessary cookie named vbpm_cookie_consent and in this site's browser storage. On a vevos.ai host, the cookie is written for the .vevos.ai domain, so compatible Vevos subdomains can read it. We do not represent that every subdomain uses the same analytics tools or honors this setting in the same way. See Section 12 for details.

Cookie Control

You can control cookies through your browser settings. Note that disabling certain cookies may affect Service functionality. To reset the choice shown on this site, clear both cookies and site data for vevos.ai; clearing cookies alone may not remove the browser-storage copy of your choice.

8. Third-Party Services

Our Service may integrate with third-party services that have their own privacy policies:

• Authentication: Google Sign-In, Microsoft Sign-In, LinkedIn Sign-In, and GitHub Sign-In as optional ways to create an account and sign in. When you use one, the provider (Google, Microsoft, LinkedIn, or GitHub) shares your name, email address, and account identifier with us; each provider's own privacy policy applies to your account with that provider
• Payment Processors: Stripe and other payment providers for subscription management
• AI Services: AI providers including Google Cloud Vertex AI (Gemini models) and Anthropic (Claude models) for AI-powered BPMN generation, process documentation, and intelligent analysis features. When you use AI features, content you submit — such as process descriptions, BPMN diagrams, chat messages, and documentation — may be sent to one or more of these providers for processing; we dynamically select the most appropriate model. Importantly, neither Google Cloud Vertex AI nor Anthropic use your submitted content to train their AI models. This is a contractual commitment: Google Cloud's Service Specific Terms (Section 17 "Training Restriction") and Anthropic's Commercial Terms both explicitly prohibit using API customer data for model training. Your content is used solely to generate the requested AI output. Each provider's privacy policy applies to its processing — see Google Cloud's Privacy Policy and Anthropic's Privacy Policy
• Analytics Providers: Tools for understanding Service usage and performance
• Communication Services: Email and messaging platforms for notifications
• Interactive Product Demos (Supademo): Our platform documentation (cloud.vevos.ai/docs) embeds interactive demos hosted by Supademo, Inc. (US), served from demo.vevos.ai (a Supademo-operated custom domain) and app.supademo.com. These demos load automatically when a documentation page containing one is viewed — no click is required. On such pages, your browser connects to Supademo, which receives your IP address, browser and device information, and your interactions within the demo (steps viewed, clicks, completion). We use this data in aggregate to understand how our demos are used. Supademo acts as an independent processor; see Supademo's Privacy Policy
• Embedded Videos (YouTube): Our platform documentation embeds videos (such as product tours and release videos) using YouTube's privacy-enhanced mode (youtube-nocookie.com). No data is sent to YouTube/Google merely by viewing the page — the player loads only after you click play. Once you play a video, Google LLC (US) receives your IP address and device/browser information and may set cookies or local storage under its own policies; see Google's Privacy Policy

We recommend reviewing the privacy policies of these third-party services as we are not responsible for their privacy practices.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place:

• Standard contractual clauses approved by regulatory authorities
• Adequacy decisions by relevant data protection authorities
• Industry-standard security measures and encryption
• Regular assessments of data transfer practices

10. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us through our support system.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will:

• Post the updated Privacy Policy on this page
• Update the "Last Updated" date at the top of this policy
• Notify you of material changes via email or Service notification
• Provide advance notice for significant changes affecting your rights

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

12. Analytics, Cookies & Tracking Technologies

How This Marketing Site Stores Your Choice

On this marketing site, we record your acceptance or refusal of optional analytics cookies in vbpm_cookie_consent. When the site is hosted on vevos.ai, this cookie is set on .vevos.ai and can be read by compatible subdomains. This helps reduce repeated prompts where another Vevos site supports the same setting. It does not mean that every Vevos subdomain uses identical analytics or cookie practices; consult the notice on the site you are visiting.

Cookies We Use

We use different types of cookies to operate and improve our Service. Below is a detailed overview of the cookies we use:

Limited PostHog Measurement Before You Choose

When PostHog is configured for this marketing site, we use a limited, cookieless form of measurement before you make a choice and if you decline optional analytics cookies. It records page views and selected funnel events, such as calls-to-action, plan selection, sign-up, login, subscription, and free-trial journey steps. We rely on our legitimate interests in understanding and improving the marketing site for this limited processing.

When a visit begins without accepted optional analytics, PostHog uses in-memory browser persistence rather than creating PostHog cookies or local storage. We disable automatic interaction capture, page-leave capture, and session recording. If you accepted previously and later withdraw, PostHog identifiers already stored under your earlier consent may remain until you clear cookies and site data, and the identity already active in the page may remain until you reload it. Your withdrawal does not retroactively delete data already collected. For a visit that begins without accepted optional analytics, Google Analytics 4 and Google Tag Manager do not load.

Analytics Tools After Acceptance

• Google Analytics 4: We use GA4 to understand how visitors find and use our marketing pages. This helps us improve the user experience. Data collected includes page views, referral sources, device type, and general geographic location.
• PostHog: After your acceptance takes effect, PostHog may use cookies and local storage for broader marketing-site analytics. Depending on the site's configuration and when your choice takes effect, this can include automatic interaction telemetry and page-leave capture used to measure visit duration. Session replay is not currently enabled on this marketing site; if it is enabled in the future, it will be limited to visits with accepted optional analytics. PostHog provides the analytics service and receives and processes these events.

Third-Party Embedded Content

Some pages of our platform documentation contain third-party embeds that may involve third-party cookies or local storage governed by those providers' own policies, independent of the analytics consent choice described in this section: Supademo interactive demos load automatically when a page containing one is viewed, while YouTube videos (privacy-enhanced mode) connect to Google only after you click play. See Section 8 (Third-Party Services) for details on what each provider receives.

Your Cookie Choices

• When you first visit this marketing site, you'll see a cookie consent banner at the bottom of the page.
• You can accept or decline optional analytics cookies. Essential storage cannot be disabled as it is required for the site to function.
• On vevos.ai, we write a shared-domain consent cookie that compatible subdomains may read. Other Vevos sites can have different privacy notices and settings.
• You can change or withdraw your consent at any time by clearing your browser's cookies and site data for vevos.ai (which will cause this site's consent banner to appear again, so you can make a new choice) or by contacting us.
• If you decline optional analytics cookies, Google Analytics and Google Tag Manager will not load during a visit that began without accepted optional analytics. Limited cookieless PostHog page-view and funnel measurement will continue as described above. Such a visit does not create PostHog cookies or local storage and has no automatic interaction capture, page-leave capture, or session replay. If you withdraw after previously accepting during the same visit, already-loaded Google Analytics and Google Tag Manager code may remain until you reload the page. Existing PostHog identifiers may remain in cookies or local storage until you clear cookies and site data, and PostHog identity already active in the page may remain until you reload it.

Data Retention

We retain analytics data only for as long as needed for the purposes described in this policy. The applicable retention period is controlled by our configuration with Google Analytics or PostHog and may change; we do not represent a fixed retention period here. In-memory PostHog persistence used for limited measurement is not retained in your browser after the current page session.

Third-Party Data Sharing

• Google Analytics data may be processed by Google LLC in accordance with Google's privacy policy.
• PostHog Inc. provides our analytics service and receives and processes limited and consented analytics data in accordance with its privacy policy.
• Supademo, Inc. (US) — interactive demo hosting and viewing analytics — processes data from auto-loading demo embeds in accordance with its privacy policy.
• Google LLC (YouTube) (US) — video embedding (privacy-enhanced, click-to-load) — processes data after you play an embedded video, in accordance with Google's privacy policy.
• We do not sell your data to third parties.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: