Privacy

This page describes what Vrittara stores, why, and who else it reaches. It is written to be read, not to be survived. If something here is unclear, treat that as our bug and tell us.

Who is responsible

Reach us at our contact page.

What we collect

• Your account. Name, email address, profile image, and the stable account identifier Google gives us when you sign in. We never receive or store your Google password.
• Your waitlist entry. If you request access, we store your email address and whatever optional detail you chose to give: name, company, role, and what you said you would use Vrittara for. We also store the share code issued to you and, if you arrived through someone else's link, the code that referred you.
• Your workspace. Projects, knowledge documents and every version of them, connected repositories, and the commits, diffs, branches, tags, file paths, and commit author names imported from those repositories. Commit metadata routinely contains the names and email addresses of people who are not Vrittara users; you are responsible for having the right to bring that history here.
• Your questions. Questions asked in the browser or over MCP, the answers returned, the citations behind them, and a record of which retrieval steps ran. This is the product working as intended: the project keeps a record of what was asked and what it was told.
• Collaboration. Comments and discussion threads, document edits, and, while you have a workspace open, which part of the workspace you are currently viewing so teammates can see where you are. Presence is held in memory, expires within about thirty seconds of you leaving, and is never written to disk.
• Billing. Your plan and subscription state. Card details go directly to Stripe and never reach our servers.
• Operational data. Server logs and error reports, which may include IP addresses. Requests to the waitlist endpoint are rate-limited using a short-lived, in-memory counter keyed by IP address; that counter is not stored and not linked to your account.

What we do not collect

• No advertising or third-party analytics trackers. There are none in the page at all.
• No behavioural profiling, and no sale or sharing of personal data for advertising.
• We do not use your project content, questions, or answers to train our own models, and we have no models of our own to train.

AI providers: read this one

Answering a question sends your question and the retrieved evidence to an AI provider. That evidence can include commit messages, code diffs, and document text. This is the part of Vrittara that shares the most sensitive material, so it is worth being precise about.

• Which providers. Whoever runs the deployment configures them. On the hosted service the current set is listed in the provider settings. Their own terms govern what they do with a request.
• More than one, sometimes. When the evidence is too large for a single request, Vrittara splits it and sends the parts to several configured providers in parallel. One question can therefore reach more than one provider, each seeing a different portion of the evidence.
• Your own keys. If you add your own provider keys in provider settings, requests go to those providers under your account and your agreement with them, not ours. We store each key encrypted, use it only to answer your own requests, and delete it when you remove it.
• Your own assistant. When you ask through a connected MCP client and our providers are exhausted, Vrittara may ask that client, meaning your Claude Code, Cursor, or Codex session, to write the answer using your own model access. Your client asks you to approve this before it happens, and the evidence is sent to whichever model you have configured there.
• Nothing is sent unprompted. No content reaches a provider unless you ask a question, generate a context document, or run a tool that does so.

Who else processes your data

We use these providers to run the service. Each processes only what its job requires.

• Google: sign-in.
• Railway: application hosting and the PostgreSQL database.
• GitHub: reading the repositories you connect, when you connect them.
• Stripe: payments and card handling.
• Resend: transactional email, meaning your waitlist confirmation and your invite. We send no marketing email, so there is no list to unsubscribe from.
• AI providers: as described above.

Why we are allowed to hold it

Where UK or EU data protection law applies, our lawful bases are: contract for running your workspace and billing you; legitimate interests for keeping the service secure, preventing abuse, and operating the waitlist; and consent where you volunteer optional information, which you may withdraw at any time.

Cookies and local storage

One essential cookie holds your sign-in session. It is not used for tracking and there is no cookie banner because there is nothing non-essential to consent to. Your browser's local storage holds your interface preferences for theme, density, motion, and texture, none of which leave your device.

Where your data is held

Data is stored on infrastructure operated by our hosting provider, and our AI and email providers may process requests in the United States and elsewhere. Where personal data leaves the UK or EEA we rely on the providers' own transfer mechanisms, typically Standard Contractual Clauses.

Keeping it and deleting it

• Deleting a project deletes its documents, versions, repositories, imported history, and question log.
• Deleting your account removes the projects you own.
• Waitlist entries are kept until you ask us to remove them, or until the waitlist is retired.
• Backups age out on their own schedule, typically within 30 days, after which deleted content is gone from those too.
• We keep the minimum billing records that tax and accounting law requires us to keep, even after an account is deleted.

Your rights

You can ask for a copy of your data, correction of it, deletion of it, restriction of how we use it, or portability of it, and you can object to processing based on legitimate interests. Write to our contact page and we will answer within 30 days. If you are in the UK or EEA and we have not handled your request properly, you may complain to your data protection authority. In the UK that is the Information Commissioner's Office.

Children

Vrittara is a tool for professional software development and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.

If something goes wrong

If a breach puts your personal data at risk, we will notify the relevant supervisory authority within 72 hours where the law requires it, and tell you directly when the risk to you is high.

Changes

We will announce material changes to this policy by email before they take effect. The date at the top always reflects the current version.