Who we are
Vetta is an operating system for how a company runs its quarter - goals, a weekly review, a scorecard, tasks and issues. This policy explains what personal data we collect when you use Vetta at app.vetta.team, why we collect it, who we share it with and what you can ask us to do with it.
The controller of your personal data is Vetta Team LLC, of 404 Reid Way, West Chester, PA 19382. Where your employer or organization provides Vetta to you, they are the controller of the content inside their workspace and we process it on their behalf. Organizations that need a data processing addendum (DPA) for procurement or compliance purposes can request one at nick@vetta.team.
What we collect
Account details. Your name, email address and whether your account uses a password or a social provider. We receive these from our authentication provider when you sign up or sign in; we never see your password or your Google or Microsoft credentials.
Workspace content. Everything you and your colleagues put into Vetta: organisations, teams and membership, goals and key results, tasks, issues, scorecard metrics, weekly review records, comments, reminders and any files you attach.
Usage and operational data. Last sign-in time, in-product notifications, activity records used to build your workspace’s reports, and server logs containing IP address, browser user agent and timestamps.
Billing details. Subscription plan, seat count and invoice history. Card numbers are handled by our payment processor and never reach our servers.
How we use it
- To provide Vetta: authenticating you, showing your workspace and saving your work.
- To send service messages you have asked for, such as task reminders, weekly review notifications and account or security notices.
- To bill your organisation and manage its subscription.
- To keep the service secure and reliable - detecting abuse, diagnosing faults and maintaining backups.
- To improve Vetta, using measures of how features are used. We may also use this usage data in de-identified or aggregated form, for example to publish benchmarks, but never in a way that identifies you, your organization or any individual, and never including the content of what you write.
We do not sell personal data, and we do not use your workspace content for advertising.
Legal bases for processing
Where the GDPR or UK GDPR applies, we rely on these legal bases:
- Contract - to provide the service your organization has signed up for, including your account, workspace and billing.
- Legitimate interests - to keep the service secure, diagnose faults, improve Vetta using usage data, and send service messages. We weigh these interests against your rights, and you can object to them.
- Consent - where we ask for it, such as for optional communications. You can withdraw consent at any time.
- Legal obligation - where the law requires us to keep or disclose data, such as tax records.
Artificial intelligence features
Some features use a third-party large language model to draft or critique text - for example suggesting goal wording or summarising a review. When you use one of these features, the relevant workspace content is sent to Anthropic’s API in the United States to generate the response. Under Anthropic’s commercial terms, data submitted through its API is not used to train its models.
These features run only when a user invokes them. Workspace admins can turn AI features off for the whole workspace in settings; when they are off, no workspace content is sent to Anthropic, and the rest of Vetta works as normal. Questions about AI features can go to nick@vetta.team.
Who we share it with
We use a small number of service providers to run Vetta. Each is bound by contract to process data only on our instructions.
| Provider | Purpose | Data involved |
|---|---|---|
| WorkOS | Authentication and sign-in | Name, email, sign-in events |
| Amazon Web Services | Hosting, database, file storage and outbound email | All workspace content and server logs |
| Postmark | Transactional email (reminders, notifications, account and security messages) | Recipient name and email, and the content of each message, such as task titles in a reminder |
| Stripe | Subscription payments | Billing contact and payment details |
| Anthropic | AI drafting and summarising features | Only the content submitted to that feature |
| GitHub | Source code hosting and deployment | No workspace content; limited operational data, such as error details, where needed to fix a fault |
We will update this list and give notice in the product or by email before a new provider begins processing personal data. We may also disclose data where the law requires it, to enforce our terms, or to a successor in the event of a merger or acquisition - in which case we will tell you before your data becomes subject to a different policy.
Cookies
Vetta sets only the cookies it needs to work. We do not use advertising or cross-site tracking cookies.
- vetta-session — keeps you signed in. Strictly necessary.
- vetta-context — remembers which team you were last looking at.
- vetta-theme — remembers light or dark mode.
We also set short-lived cookies during sign-up and administration to carry state between steps. Clearing cookies signs you out but does not delete your workspace.
How long we keep it
Workspace content is kept while the workspace is active and for 90 days after it is closed, so it can be restored if the closure was a mistake. Server logs are kept for 7 days. Backups roll off on their own schedule. When you delete your account we remove your personal details, though work you contributed may remain in your organisation’s records where it is needed for their history.
Security
Data is encrypted in transit and at rest. Each workspace is isolated at the database level so one organisation cannot read another’s rows. Access to production systems is limited to staff who need it. No system is perfectly secure, but if a security incident affects your personal data we will notify affected customers without undue delay, and notify any regulator as the law requires.
Your rights
Depending on where you live, you may have the right to access a copy of your personal data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. You can exercise these rights by writing to nick@vetta.team. If your workspace is managed by your employer, we may refer your request to them.
You may also complain to your local data protection authority if you think we have mishandled your data.
US state privacy rights
If you live in a US state with a consumer privacy law, such as California, Virginia, Colorado or Connecticut, you may have the rights described above to know, access, correct, delete and receive a copy of your personal data. We do not sell personal data, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We do not use sensitive personal information to infer characteristics about you. You can make a request yourself or through an authorized agent by writing to nick@vetta.team; we will verify the request before acting on it, and we will not treat you differently for exercising these rights.
International transfers
Vetta is hosted on Amazon Web Services in the United States (region us-east-1). If you access it from elsewhere, your data is transferred there and protected by the standard contractual clauses approved by the European Commission, together with the UK Addendum where the transfer is from the United Kingdom. These clauses are incorporated in our data processing addendum, available on request at nick@vetta.team.
Children
Vetta is a workplace tool and is not directed at anyone under 16. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will remove it.
Changes to this policy
We will post any change on this page and update the date above. If a change materially affects how we handle your personal data, we will tell you in the product or by email before it takes effect.
Contact
Questions about this policy, or about data we hold, go to nick@vetta.team, or write to Vetta Team LLC, 404 Reid Way, West Chester, PA 19382.
See also our Terms of Service.