Vesk Privacy Policy

This policy explains how Vesk, Inc. (“Vesk,” “we,” “us,” or “our”) collects, uses, shares, and retains personal information when you visit our website or use Vesk Simulation Coding Agent, the desktop application, command-line interface, hosted model service, and available API, MCP, and integration features. It also explains your choices and how to contact us.

1 Scope and responsibility

Our current service offering is for customers based in the United States. This policy covers visitors, account holders, team members, newsletter subscribers, and people who contact Vesk. Vesk is responsible for personal information used to administer accounts, bill customers, operate the Service, and conduct its own business. Contact support@vesk.app with privacy questions or requests.

Where an organization supplies personal information for processing solely on its instructions, the organization may be the controller and Vesk its processor or service provider, as determined by the actual arrangement and applicable law. The organization’s notice and any applicable data-processing agreement also govern that processing. This policy is not itself a data-processing agreement.

Independent services, including payment services, identity providers, repositories, and third-party API or MCP clients, may process information under their own notices when you use them. This policy describes Vesk’s processing and does not control those services’ independent practices.

2 Information we collect

Account and authentication information. We receive account identifiers, email addresses, authentication and session information, and profile information made available by the sign-in method you choose. Supabase supports authentication, including Google sign-in where offered. You do not give Vesk your Google password. Team records include membership, roles, invitations, and related account identifiers.

Billing and usage information. We process plan and subscription identifiers, Stripe customer references, seat information, usage allowances and credit balances, reservations and settlements, payment events, adjustments, refunds, spending settings, and related billing contact information. Stripe collects payment details through its payment interface. That checkout flow does not provide Vesk with full payment-card numbers or card security codes. Authorized billing workflows may expose invoices and billing contact information.

Requests and generated results. Hosted model requests can include your task text, robot information such as joint names and limits, retrieved context, and earlier generated files used for repair. Generated results may include software packages. Vesk stores generated responses and job information such as status, purpose, timestamps, model and provider references, token usage, and charges. Information retrieved through an integration may be included in a request when the workflow uses it.

Support and communications. We receive the messages, contact details, files, and context you choose to send us. Account and transactional messages may include invitations, receipts, payment failures, or service notices. Do not include passwords, private keys, or unnecessary personal information in support requests.

Newsletter information. If you opt in, we process your email address, subscription status, consent text or version, signup source, and the times of your request, confirmation, or withdrawal. Confirmation and unsubscribe tokens help verify and manage your choice. We also process limited delivery and abuse-prevention information, which may include an email-derived identifier and a hashed network identifier used for rate limiting. Hashing does not necessarily make information anonymous.

Technical information. Hosting, authentication, and infrastructure services may process IP addresses, request metadata, device or browser information, security events, and operational logs. Application diagnostics include error categories and operation outcomes. API and MCP requests can also create authentication, request, and usage metadata. Information can be processed by infrastructure providers even when it is not stored as a separate field in Vesk’s application database.

3 Local processing and data transfers

In local workflows, robotics orchestration, containers, simulation, and generated files operate on your computer. The ordinary robot-import workflow parses the robot file locally, but derived information can be transmitted in a model request. A file you separately send through support, an integration, or an export follows that additional transfer path.

Hosted model requests pass through Vesk to Anthropic. The model-job database stores generated responses rather than the full incoming request body. Inputs are still processed in transit and by the model provider, and content may also appear in support submissions or other records you choose to create. This distinction is not a promise that no system retains an input.

Where a direct-provider configuration is available, your own provider credentials can send model traffic directly to that provider without Vesk’s hosted model proxy. Downloads, authentication, documentation retrieval, and optional integrations may still contact network services. A local workflow is not necessarily offline.

Local tools retain workspaces, robot imports, history, reports, and other local data. You control copies exported outside Vesk’s working directories. Closing a hosted account does not remotely erase those copies or copies retained by another service.

4 How and why we use information

We use information to authenticate users, deliver requested model and simulation workflows, administer teams and integrations, meter usage, process payments and corrections, respond to support requests, diagnose failures, prevent abuse, enforce service restrictions, and meet legal obligations. We also maintain appropriate records of transactions, consent choices, privacy requests, and their resolution.

If you opt in to the newsletter, we use your information to record and manage your choice, send any required confirmation, and provide the robotics, AI, and product updates you requested when newsletter delivery is offered. Newsletter enrollment is optional and separate from account registration and payment. You can withdraw through the available newsletter controls, an unsubscribe link in a newsletter, or support@vesk.app. Unsubscribing from marketing does not stop necessary account, security, billing, or legal notices.

Where applicable law requires a legal basis, we rely on contract necessity to provide services requested by an individual, legitimate interests in proportionate service administration, security, and support where those interests are not overridden by your rights, legal obligations for required records and disclosures, and consent for optional uses that require it. Processing solely on an organizational customer’s instructions is governed by that arrangement and the customer’s applicable legal basis. Contact us for information about the basis relevant to a particular use.

5 Teams and connected services

Team billing and pooled usage do not automatically make every member’s work visible to others. Where sharing is enabled, the owner can expressly share a completed team run. Active administrators of that team can then access the selected generated results. Personal runs and later outputs are not automatically included.

Sharing records can include account, team, run, and selected-output identifiers; the time and version of the sharing disclosure; and selected reported outcome information. A local outcome may include a simulation-completion category, advisory status, and completion time. Such outcomes are member-reported observations, not independently authenticated evidence of hardware performance.

Stopping sharing or removing membership changes future access. Removing membership removes that member’s sharing receipts and outcome metadata; rejoining does not restore them. Former administrators lose access authorization, but copies already downloaded cannot be recalled. Administrator reads do not extend an owner’s stored-result retention deadline. Team membership and usage administration remain distinct from authority to access invoices or payment records.

If you authorize an integration or export, selected information is sent to or retrieved from the connected service according to the action and permissions you choose. GitHub export can send files and commit or pull-request metadata to your selected repository. Check its visibility and access settings. External API or MCP clients may retain prompts, outputs, tool activity, or credentials under their own policies. Disconnecting an integration or revoking credentials does not erase information already transferred.

6 Metrics and model training

Local CLI metrics can include counts, timing, failure categories, token use, and hashes of tasks or files. Local recording can be disabled through the applicable no-capture control. Recording locally does not itself upload metrics or authorize central collection. A hash can allow a guessed input to be recognized; account-linked or hashed records are not necessarily anonymous.

Optional central customer-metrics collection is not enabled by accepting this policy, buying a plan, authorizing spending, or joining a team. That optional collection is currently disabled. If offered, it will require a separate disclosure and permission explaining what is collected and how to withdraw. Any central metrics already held can be addressed through the available withdrawal process or support@vesk.app. Withdrawal stops new consent-based collection; deletion failures remain subject to follow-up rather than restoring consent. Required billing and consent records are handled separately.

We do not use your inputs or generated outputs to train models without a separate affirmative permission for that use. The hosted model workflow still processes content to answer your request. We do not submit your content as optional model-provider feedback without the necessary authority.

Anthropic’s published commercial policy says API inputs and outputs are not used for training by default; explicit feedback or other permission can change that treatment. Its standard API retention is up to 30 days, with exceptions including certain features, separate agreements, safety review for covered models, policy enforcement, and legal obligations. We do not represent that Vesk has a zero-data-retention agreement or that all provider records share one deletion deadline.

Anthropic’s current commercial notices are available at https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data and https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training. A direct-provider configuration is also governed by your own provider agreement and settings.

7 Who receives information

We disclose information to providers as needed for the functions described in this policy. Anthropic processes hosted model requests and generates responses. Supabase supports authentication and the database for account, job, usage, and related records. Render hosts the model-service application and operational logs. Vercel hosts the website and handles web requests. Google supports Google sign-in and company email workflows.

Stripe processes payments, subscriptions, invoices, and associated fraud-prevention or regulatory functions. Resend supports enabled email workflows, including newsletter confirmation and transactional messages, and processes recipient details, message content, and delivery metadata. GitHub and its container registry support source and software distribution, as well as exports you request. Domain and DNS services, including Porkbun, process domain-administration and technical information rather than receiving model content as part of that role.

We may disclose selected information to team participants or connected services as described in Section 5, to professional advisers under appropriate confidentiality duties, and where reasonably necessary to comply with a legal obligation, protect lawful rights, address fraud or security incidents, or investigate misuse. Each disclosure remains subject to applicable law. Some providers, including payment and identity services, also process information independently under their own notices.

In a proposed financing, merger, acquisition, reorganization, or sale of business assets, information may be disclosed under appropriate confidentiality and legal controls and transferred as part of the transaction. A successor remains subject to applicable privacy obligations, and we will provide any legally required notice or choice concerning a material change in use.

8 Retention and deletion

We retain information for the purposes described in this policy, taking account of the information’s sensitivity, the service relationship, legal and accounting requirements, security needs, disputes, and applicable deletion rights. Different records and systems have different retention periods. A content-deletion request does not necessarily delete related transaction or audit records.

Hosted generated results. The standard active-database retention period is 90 days after the owner’s last use of a stored result. A successful result begins the period, and an owner read restarts it. Owner deletion can remove the result earlier. Expired results are removed by service cleanup and are refused and purged when accessed through the expiry-checking path. An outage can delay background cleanup. Job and billing metadata have separate retention, and this period does not promise simultaneous deletion from backups or provider systems.

Local data. Staged desktop robot imports are subject to cleanup after 90 days without use, with cleanup occurring while the application runs or when it next starts. Available deletion controls allow earlier removal. Local history and workspaces may also have count-based limits. Exported copies outside managed directories remain under your control. Keep your own copies of information you need.

Accounts and closure. After appropriate identity verification, operator-assisted account closure disables new hosted access and initiates removal or minimization of account contact data, hosted results, metrics, sharing records, and pending notification content, as applicable. Personal subscriptions are cancelled during closure processing rather than left to renew or run until the paid period ends. A shared team subscription requires an authorized billing owner’s action. A stable account identifier and soft-deleted authentication record may remain for billing integrity, security, or other lawful purposes. Already-admitted work may settle its accounting, and unfinished cleanup requires follow-up.

Billing and audit records. Transaction ledgers, payment references, adjustments, and related audit records are retained separately from hosted content. Account closure does not automatically erase them. Retention depends on applicable accounting and legal obligations, reconciliation, fraud prevention, and unresolved disputes. Consent and security records are retained as needed to demonstrate choices, protect accounts, or resolve claims. We assess retained personal identifiers separately when handling deletion requests; an append-only design is not itself a legal reason to retain personal information indefinitely. This policy does not promise automatic deletion of these records after a fixed number of years.

Newsletter records. We retain subscription information while your subscription is active and retain limited consent and suppression records as needed to demonstrate and honor your choices. Unsubscribe stops future newsletter sends; it does not necessarily erase the record needed to prevent resubscription or demonstrate a prior consent. Expired pending requests and short-lived rate-limiting records are cleaned up through the subscription workflows.

Metrics and sharing records. Local metrics have age and count limits. Optional central collection is disabled; existing central records can be addressed through withdrawal or a privacy request. Sharing receipts and reported outcomes remain until unsharing, membership removal, account cleanup, or another applicable deletion process. They do not extend the retention of the underlying hosted output.

Backups and provider records. Deletion from active systems does not immediately remove copies from backups, security logs, exported files, or providers’ independent records. Backup and log retention depends on the service and configuration, the purpose of retention, and applicable law. We restrict retained information to the purpose that justifies keeping it, and prior deletion or deactivation requests must be respected if data is restored. Providers may retain transaction or compliance records under their own legal obligations. Contact us for information about retention relevant to your data.

9 Your privacy choices and rights

Email support@vesk.app to request access, correction, a copy, deletion, restriction, or withdrawal of optional consent, or to ask about an automated refusal. Depending on your location and the processing, you may also have rights to portability, to object, to appeal a denied request, and to complain to a privacy regulator. Where applicable, you may opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain profiling, and request limits on qualifying sensitive-information uses. The availability of these rights depends on the law and whether the relevant processing occurs.

We may request proportionate information to verify identity and authority. Where permitted, an authorized agent may submit a request with evidence of authorization. If an organization controls the relevant data, we may direct the request to that organization or assist it under our agreement. We will explain a denial, limitation, or lawful exception and any applicable appeal route. To appeal, reply to our decision or email support@vesk.app with the subject “Privacy appeal.”

We respond within applicable legal deadlines and aim to acknowledge and resolve requests promptly. Some requests require additional time; we will explain any legally permitted extension. We do not discriminate against you for exercising applicable privacy rights. Withdrawal of consent does not affect prior lawful processing, and deleting certain information may prevent us from providing the corresponding service.

Requests are supported by an operator-assisted process; not every action is available through a self-service dashboard. Technical difficulty does not remove an applicable right or excuse an unlawful delay. We will not describe retained identifiers as anonymous merely because account contact details have been removed.

10 Cookies and automated processing

We use cookies and similar storage for sign-in, session security, authentication redirects, invitations, cookie preferences, and a newsletter choice during signup. Relevant website storage includes Supabase authentication cookies, short-lived redirect and invitation cookies, a short-lived newsletter-intent cookie, and a cookie recording your cookie preferences. Browser controls can block or delete storage, but doing so may interfere with sign-in or other requested functions.

Cookie preferences and newsletter permission are separate. This policy does not itself authorize optional analytics or advertising. Where we offer nonessential technologies requiring consent, they require the applicable choice before activation. Available cookie settings explain the controls offered for the website. Hosting and security providers may also process technical request information as described in Sections 2 and 7.

Automated policy screening can refuse a task. Authentication, entitlement, and billing checks may restrict access. These controls can be wrong and do not establish your legal status or certify that a proposed use is lawful. Contact support@vesk.app to ask about a refusal or exercise any applicable right to challenge an automated decision. Do not submit sensitive operational details unnecessarily.

11 Processing locations

Although the Service is offered to customers based in the United States, Vesk and its providers may process information in the United States and other countries where the relevant providers operate. Privacy protections may differ between countries. Local robotics workflows can involve international transfers for authentication, model processing, support, or integrations.

The location of a customer does not by itself determine where a provider processes information. Our US customer offering is not a promise of US-only storage or processing. Contact support@vesk.app for information about processing locations and any transfer arrangements applicable to your data. Any safeguards required by applicable law must be in place for the relevant transfer; this policy does not itself establish a transfer mechanism or claim an international certification.

12 Security and children

We use administrative, technical, and organizational safeguards appropriate to the information and Service. No system or transmission method can guarantee complete security. Please protect your credentials, restrict integration permissions, and report suspected account compromise to support@vesk.app. This policy does not claim an independent security certification or waive any applicable incident-response or notification obligation.

The Service is intended for adults aged 18 and older and is not directed to children. We do not knowingly solicit personal information from children under 18. If you believe a child has provided information, contact support@vesk.app so we can investigate and take appropriate action, including deletion where required.

13 Policy changes

We may update this policy and will display the last-updated date. This version applies when published. We will provide notice of material changes and obtain consent where required by law before applying a new use. A change to this policy does not itself override a prior choice concerning optional marketing, metrics, or training.

14 Contact

For privacy questions, requests, or complaints, email support@vesk.app or write to Vesk, Inc., 2613 Princeton Drive, Vestal, NY 13850, United States. Our website is https://vesk.app. Please identify the account or request involved without sending passwords, private keys, or unnecessary sensitive information.