Privacy Policy

We collect several different types of information for various purposes to provide and improve our Service to you. Information we receive from services you connect, such as Zendesk, Notion, Confluence and Google Drive, is described in section 3.

• Personal Data:

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). This may include:

• Email address
• First name and last name
• Phone number
• Company/Organization name

• Usage Data:

We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

The companies that process data on our behalf are listed on our sub-processors page.

• Product Analytics (PostHog):

On our marketing website only, not inside the Vensor app, we use PostHog to understand how visitors use our pages. It records which pages you view, the page and any campaign link that brought you to us, which links and buttons you click, and technical details such as your browser, device type and screen size, and it may receive your IP address. It also collects heat maps, which show where visitors click, move their pointer and scroll, and session recordings, which let us replay a visit. The characters you type into a form field are hidden in these recordings, and the Cal.com booking window is not recorded. PostHog keeps an identifier in a cookie and in your browser's storage so it can recognize a returning visitor. If you then create an account, we link that identifier, and your earlier visits to our website, to your new account, so we can see which page or ad brought you to us.

PostHog does not run in your browser inside the Vensor app, so it cannot record the app. Instead, our servers send PostHog a limited set of account events, such as signing up, connecting Zendesk, opening a ticket's details and changing certain settings. These events carry internal account and organization IDs and a few simple details, such as the plan you chose or a broad range of how many tickets were imported. These events never include your name, your email address, any ticket content, or any content or file names from Google Drive or other services you connect. PostHog processes this data for us in the United States and is listed on our sub-processors page.

• LinkedIn Advertising:

On our marketing website only, not inside the Vensor app, we use the LinkedIn Insight Tag, a script provided by LinkedIn, to measure our LinkedIn ads and to show our ads to people who have visited our site. When you visit a page, the tag sends LinkedIn the address and title of that page, the page that referred you, your IP address and technical details about your browser and device, and it may also record which links and buttons you click and how long you stay. If you arrive by clicking one of our LinkedIn ads, the tag stores LinkedIn identifiers from that click in cookies on vensor.ai and its subdomains for up to 30 days. If you use LinkedIn, LinkedIn may connect your visit to your LinkedIn account, using cookies it has set in your browser or other information such as your IP address. LinkedIn may also use this data, in a form that does not directly identify you, to improve its own services.

When you create a Vensor account, our servers send LinkedIn a hashed (scrambled) form of your email address, which LinkedIn can match to a LinkedIn account that uses the same address. With it we send the time you signed up, an identifier for your new account, used only so the sign-up is counted once, and the LinkedIn click identifier if your browser has one. We never send LinkedIn your name, your email address in readable form, or anything from inside the Vensor app. This report is sent from our servers, so apart from the Global Privacy Control signal described at the end of this section, your browser settings cannot block it; blocking or clearing cookies for vensor.ai only means no click identifier is included. You can control how LinkedIn uses it for ads in your LinkedIn ad settings.

• Meta Advertising:

On our marketing website, and once on our sign-up page when you create an account, your browser sends a request to Meta, the company behind Facebook and Instagram. We use this to measure our Meta ads and to show our ads to people who have visited our site, and Meta also uses it under its own terms, for example to personalize the ads and other content it shows you. Apart from what every web request carries, such as your IP address and browser type, the request tells Meta only that a page on vensor.ai was viewed or that a sign-up was completed. It does not include the page address, your name or your email address. If you are signed in to Facebook or Instagram, or Meta has set cookies in your browser before, Meta may connect the request to your account. You can control this with the "Your activity off Meta technologies" and ad preference settings in your Facebook or Instagram account, and blocking third-party cookies can limit it.

• Visitor Identification (RB2B):

On our marketing website only, not inside the Vensor app, we use RB2B, a website visitor identification service run by GetEmails, LLC (also known as Retention.com), together with its identity partner LiveIntent, the data company AtData, and other companies RB2B works with. When you visit, their scripts collect your IP address, cookie and device identifiers, the pages you view, the page that referred you, and when and for how long you view each page. They set cookies on vensor.ai, and RB2B's cookies can last up to one year. RB2B's script also contacts ip-api, a service run by Artia International S.R.L. in Romania, to look up your approximate location from your IP address. RB2B compares this with contact and profile information it obtains from other sources to tell us who may have visited. For visitors in the United States, this can include your name, job title, employer, business email address (or a personal email address if no business email is available), city, state and ZIP code, and LinkedIn profile, along with the pages you viewed. For visitors outside the United States, RB2B does not identify you personally. For all visitors, RB2B may also tell us which company visited, using its partner Demandbase. You can opt out of the collection of your personal data in compliance with the GDPR at rb2b.com/rb2b-gdpr-opt-out. We use this to understand which businesses are interested in Vensor, and we may contact you about Vensor. RB2B and LiveIntent also use this information for their own purposes under their own privacy policies, and AtData, Demandbase and the other companies RB2B works with may do the same. You can opt out of RB2B's database at app.retention.com/optout, and California residents can make a "Do Not Sell My Info" request at app.retention.com/ccpa_details. RB2B, LiveIntent, AtData, Demandbase and ip-api are listed on our sub-processors page.

If your browser sends a Global Privacy Control signal, if your IP address places you in the European Economic Area, Switzerland, the United Kingdom, Gibraltar, Jersey, Guernsey or the Isle of Man, or if we cannot tell where you are, we do not load the LinkedIn, Meta or RB2B tools described above and we do not send LinkedIn a sign-up report.

Vensor AI can connect to other services your organization uses, so it can check your customer support work against your organization's own policies and standard operating procedures (SOPs). A service is connected only when a signed-in member of your organization chooses to connect it and approves the access Vensor AI asks for. This section explains what we receive from each service, how we use it, and how you can remove it. Section 3.6 describes the data we receive from Google in full.

3.1 Zendesk

When you connect Zendesk, we copy your support tickets, including their content and details such as status and tags, so we can analyze them for you.

3.2 Notion

When you connect Notion, we read the Notion pages you share with Vensor AI, or only the pages you select, and store their text as SOPs for your organization.

3.3 Confluence

When you connect Confluence, we show you a list of the Confluence spaces you can view so you can choose which ones to add. Nothing is copied until you choose a space. We then read the pages in the spaces you choose and store their text as SOPs for your organization. We do not keep images, attachments or mentions of people from those pages, and we do not request or store information about your Atlassian account.

3.4 File upload

When you upload a policy document, we store the file and the text we extract from it. To read text inside images in those documents, we may send the images to Microsoft Azure.

3.5 How we use content from connected sources

• Before we store SOP text from Notion, Confluence or Google Drive, we automatically remove some personal details from it, such as email addresses, phone numbers and payment card numbers.
• We split SOP text into sections and send each section to OpenAI to create an embedding, which is a list of numbers that lets us find the sections of your SOPs that relate to a ticket.
• When we analyze a ticket, we send OpenAI the text of the ticket, with personal details removed, together with the sections of your SOPs that relate to it. OpenAI returns a score and notes on how well the ticket followed your SOPs, and we show these to members of your organization in the Vensor AI app.
• When a member of your organization asks a question in the Vensor AI assistant, we may send OpenAI the sections of your SOPs that relate to the question, so the answer can refer to them.
• OpenAI processes this data only to provide these features to us. OpenAI states that data sent through its API is not used to train or improve its models unless the customer chooses to share it, and we have not chosen to share it. OpenAI keeps the data we send for a limited time, generally up to 30 days, to process our requests and to monitor for abuse.
• Content from connected sources is kept separate for each organization. Other Vensor AI customers never see it.
• We do not use content from connected sources to train AI models, we never sell it, and we never use it for advertising.

3.6 Google user data (Google Drive)

Vensor AI lets your organization add SOPs from Google Drive. This part of our Privacy Policy describes how Vensor AI accesses, uses, stores, shares, protects, keeps and deletes the information we receive from Google APIs ("Google user data"). It applies together with the rest of this policy, and if anything elsewhere in this policy differs from this part, this part controls for Google user data.

What we access. When a member of your organization connects Google Drive, Google asks them to give Vensor AI the following permissions, and we ask for nothing more:

• Your Google Account email address (the openid and userinfo.email permissions). We use it only to open Google's file chooser on the Google account that was connected, and to show which Google account is connected to your organization.
• Access to only the Google Drive files you choose (the drive.file permission). You choose files in the Google Picker, a file chooser provided by Google. Choosing a file gives Vensor AI access to that file only. Vensor AI cannot see, list or open any other file in your Google Drive.

Although the drive.file permission would also allow an app to create or change files, Vensor AI only reads the files you choose. We never create, edit, move, share or delete anything in your Google Drive.

For each file you choose, we read its content and these details: its name, file type, size, version number, the time it was last changed, a checksum, and whether it is in the trash. We support Google Docs, Google Slides, PDF, Word (.docx) and PowerPoint (.pptx) files of up to 10 MB, and we skip any other file.

How we use it.

• We turn each file you choose into text. For Google Docs and Google Slides, we ask Google to export the file as text. For PDF, Word and PowerPoint files, our own servers read the file and extract its text in memory. We do not keep a copy of the original file. We keep only the text.
• Before we store the text, we automatically remove some personal details from it, such as email addresses, phone numbers and payment card numbers.
• We store the text as an SOP for your organization, titled with the file's name, together with the file's ID, type and version number, so we can tell when the file changes.
• We use the text as described in section 3.5: to create embeddings with OpenAI, to check your organization's support tickets against your SOPs and show the results, and to answer questions in the Vensor AI assistant. Members of your organization can read the SOP in the Vensor AI app.
• We check the files you chose for changes about every six hours, and whenever someone in your organization selects Sync. When a file changes, we update its SOP. If a file is moved to the trash, we remove its SOP. If we can no longer open a file, we remove its SOP after it fails two checks in a row.

We use Google user data only to provide and improve these features, which you can see and use in the Vensor AI app. We do not use it for any other purpose.

Who we share it with. We share Google user data only with the service providers that help us run these features, and only so they can provide them to us:

• OpenAI, to create embeddings, to check tickets against your SOPs, and to answer questions in the Vensor AI assistant.
• Supabase, our database provider, which stores the text, embeddings and encrypted access tokens in the United States.
• Vercel, which hosts the servers that extract text from PDF, Word and PowerPoint files.

Each of them is bound by contract to use the data only to provide their service to us. Apart from these providers, we disclose Google user data only when it is necessary for security purposes (for example, investigating abuse), when it is necessary to comply with applicable law, or as part of a merger, acquisition or sale of our assets, and in that last case only after obtaining your explicit prior consent.

We do not sell Google user data. We do not transfer it to, or use it for, advertising of any kind, including retargeting, personalized or interest-based advertising. We never send it to advertising platforms such as LinkedIn or Meta, to visitor identification services such as RB2B, to data brokers or information resellers, or to PostHog. We do not use it to determine creditworthiness or for lending purposes.

AI and machine learning. We do not use Google user data, or any data derived from it, to develop, improve or train generalized or non-personalized AI or machine learning models. OpenAI uses the Google user data we send it only to carry out the analysis your organization asked for, and, as described in section 3.5, it does not use that data to train or improve its models. The embeddings we create from your SOPs are stored only for your organization and are used only to find your organization's own SOPs. They are never combined with data from other customers.

Who can read it. Members of your organization can see your SOPs in the Vensor AI app, because that is part of the service. Vensor AI staff do not read Google user data, except when you give us permission to view specific files or SOPs (for example, to help you with a support request), when it is necessary for security purposes (for example, investigating a bug or abuse), when it is necessary to comply with applicable law, or when the data has been aggregated and anonymized and is used for our internal operations in line with applicable law.

How we protect it. We encrypt Google access and refresh tokens with AES-256-GCM before we store them. All Google user data travels over encrypted (HTTPS/TLS) connections. Our database provider encrypts all stored data at rest with AES-256. Within the Vensor AI app, your organization's data is available only to signed-in members of your organization. Files that our servers convert to text are processed in memory and are not stored.

How long we keep it, and how to delete it. We keep Google user data only while it is needed to provide the features described above:

• Removing a file or deleting an SOP. If you delete an SOP that came from Google Drive, or remove its file from your Google Drive selection in Vensor AI, we delete that SOP's text and embeddings and stop reading that file.
• Disconnecting Google Drive. When you disconnect Google Drive in Vensor AI, we ask Google to revoke Vensor AI's access, delete the stored access tokens and the connected email address, and delete the SOPs, text and embeddings we created from your Google Drive files.
• Removing access from your Google Account. You can also remove Vensor AI's access at any time in your Google Account's third-party connections settings (https://support.google.com/accounts/answer/13533235). After that, we can no longer read your files, and we delete the SOPs we created from them as soon as we detect that access was removed.
• Deleting your Vensor AI account. When your organization's Vensor AI account is deleted, we delete all of its data, including SOPs from Google Drive, their embeddings, and the stored tokens. Backup copies held by our database provider are deleted automatically when those backups expire.
• Copies held by our providers. Data we have sent to OpenAI is kept by OpenAI for up to 30 days, as described in section 3.5.
• Asking us. You can ask us to delete your organization's Google user data at any time by emailing privacy@vensor.ai. We respond within 30 days.

Changes. If we change how we use Google user data, we will update this Privacy Policy and ask for your consent before we use Google user data in a new way or for a different purpose.

Google API Services User Data Policy. Vensor AI's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace User Data and Developer Policy, including the Limited Use requirements.

3.7 Disconnecting other services

You can disconnect Zendesk, Notion or Confluence in Vensor AI at any time. When you do, we delete the stored access tokens for that service. SOPs already copied from Notion or Confluence stay in your organization's SOP library until you delete them. You can also remove Vensor AI from the connected apps settings of your Notion workspace or your Atlassian account.

Cookies are small files that a website stores in your browser. Browser storage, such as local storage, works in a similar way. We use them as follows:

• Strictly necessary: The Vensor app uses a cookie to keep you signed in. Our sign-up and sign-in pages may also run security checks that set cookies to tell people apart from automated scripts. The app also remembers a few display choices, such as your theme, in your browser's storage.

• Analytics: PostHog, on our marketing website only, as described in section 2. Its cookie lasts up to one year and is set for vensor.ai and its subdomains, so your browser also sends it to the Vensor app. We read it there only when you create an account.

• Advertising and visitor identification: On our marketing website, plus two steps at sign-up described in section 2: a request to Meta from our sign-up page, and a report from our servers to LinkedIn. If you arrive by clicking one of our LinkedIn ads, LinkedIn's Insight Tag stores LinkedIn identifiers from that click in cookies on vensor.ai and its subdomains for up to 30 days, and our servers read one of them once, when you create an account, to report the sign-up to LinkedIn. RB2B and LiveIntent set their own cookies on vensor.ai, and RB2B's last up to one year. LinkedIn, Meta, LiveIntent and the other companies RB2B works with may also read or set cookies on their own domains when your browser contacts them. On every page of our website and app, and for every visitor, we also set our own cookie, vensor_ads. It holds a single value, 1 or 0, recording only whether these tools may run for your visit under the rules at the end of section 2. It contains no identifier and no location, and it is deleted when you close your browser.

• Scheduling: Our marketing pages load a script from Cal.com, and the booking window is provided by Cal.com, which may use its own cookies.

You can view, block or delete cookies and other site data in your browser settings. If you block the sign-in cookie, you will not be able to sign in. Clearing or blocking site data for vensor.ai stops PostHog from recognizing you between visits, and you can control how LinkedIn uses your visits in your LinkedIn ad settings. You can also control how Meta uses your visits in your Meta settings and opt out of RB2B's database at app.retention.com/optout. Clearing cookies does not stop services that identify visitors by their IP address.

Vensor will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We keep and delete information from services you connect, including Google user data, as described in section 3. When your organization's Vensor AI account is deleted, we delete your organization's data, as described in section 3.6.

If you have any questions about this Privacy Policy, please contact us by email:

You can also use this address to ask us to delete your data, including Google user data.

privacy@vensor.ai