Legal
Our Privacy
policy
Last updated: September 16, 2026
Who this covers
This policy covers personal data we handle through vaxnori.co, the agent platform, our marketing site and support channels. It applies to workspace owners, invited members, applicants, and people we contact on a customer’s behalf. Two roles matter here. For account and billing data, Vaxnori AI Inc. is the controller. For the content inside a workspace - including data about your customers and vendors - you are the controller and we act as your processor under your instructions.
Where data comes from
Most of it you give us: your brief, brand material, documents, and the credentials you connect. Some is generated as you work - task history, approvals, agent logs, device and usage telemetry. Some arrives from third parties you authorize: banks and card networks, registrars, filing agents, email providers and identity checks. We receive only what the task needs and only while the connection is live.
What the agent can see and do
When a task runs, the agent is given the narrowest context that can complete it - the brief, the relevant documents, and the specific credentials required. It does not roam the workspace or read connections unrelated to the task. Bank connections default to read-only. Where a task genuinely needs to move money, that is a separate permission with its own limit and its own approval, and every movement is logged against the human who approved it.
How to control this
Workspace settings › Connections shows every credential, what it is scoped to, and which tasks used it last. Revoking there takes effect immediately.
Models and training
We use third-party foundation models to plan and carry out work. Content sent to them is covered by zero-retention or short-retention agreements, and it is not used to train their models. We do not train models on your workspace content.
We do use aggregated, de-identified signals - task success rates, failure patterns, timing - to improve routing and reliability. Nothing in that set can be traced back to a person or company. If you opt into sharing a specific failed run with us for debugging, that copy is kept for 90 days and then deleted.
How to control this
Model-sharing for debugging is off by default and set per workspace, not per task.
Why we process it
To run the tasks you brief, authenticate you, keep an audit trail of approvals, bill you, provide support, detect fraud and abuse, comply with law, and improve reliability. Where the law requires a legal basis, we rely on contract performance for running the service, legitimate interests for security and product improvement, consent for marketing email and non-essential cookies, and legal obligation for tax and filing records.
How long we keep it
Workspace content stays while the account is open. After closure you have 30 days to export, after which content is deleted from live systems within 30 days and from backups within 90. Some records survive deletion because we must keep them: invoices and tax records for seven years, and audit-log entries for filings and payments for as long as the law governing that filing requires.
Security
Data is encrypted in transit and at rest. Credentials are held in a dedicated secret store with separate keys and are never written to logs or shown back to the agent as plain text.
Access by our staff is role-based, requires a business reason, and is logged. We run background checks on employees with production access, require hardware keys, and test the platform with independent pentests annually. If a breach affects your data, we notify affected workspace owners without undue delay and within 72 hours where the law requires it.
International transfers
We are based in the United States and our infrastructure runs in US and EU regions. Where data moves out of the UK, EEA or Switzerland, we rely on Standard Contractual Clauses plus supplementary technical measures. Enterprise workspaces can pin content storage to the EU. Model inference may still route through US providers unless an EU-only inference option is enabled on the plan.
Your rights
Depending on where you live you may request access, correction, deletion, a portable copy, restriction of processing, or objection to processing based on legitimate interests. You can also withdraw consent for marketing at any time. California residents may request disclosure of categories collected and shared, request deletion, and are protected from discrimination for exercising those rights. We honor Global Privacy Control signals.
We verify requests against the account before acting. If you are a customer’s customer, contact them first - they control that data and we will refer your request to them.
How to control this
Export runs from Settings › Data without contacting us; it includes tasks, approvals, documents and the audit log in open formats.
Cookies and analytics
The app uses strictly necessary cookies for sessions and security. The marketing site adds first-party analytics that we self-host, with IP truncation and no cross-site identifiers. We do not run advertising pixels on logged-in pages. Non-essential cookies are set only after you accept them in the banner, and you can change that choice at any time.
Children
Vaxnori AI is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.
Changes to this policy
We update this policy as the product changes. Material changes are emailed to workspace owners at least 30 days before they take effect, and the effective date at the top always reflects the current version.
A smarter way to
build a company
Skip the endless research, planning, and setup. Vaxnori AI works alongside you to create your brand, organize your launch, and handle the operational details.
