Privacy Policy

This policy explains what data VVAI ESG, operated by the VVAI ESG team, collects, how we use it, and the rights you have.

What we collect

• Account data: your name (optional), email address and a hashed password (we never store your password in plain text).
• Company and report data: the company profile, environmental, social and governance metrics, policy and initiative descriptions you enter, the documents you upload and the text extracted from them, and the report drafts generated for you together with your edits.
• Billing data: your subscription status, plan and customer ID from our payment provider. We never see or store your card number.
• Technical data: IP address and request logs, kept for security and troubleshooting.

Report data can include personal data, such as the names of directors or employee statistics. Please provide only what is needed for your report and do not upload sensitive personal data that the report does not need.

How we use it

• To provide the Service, including generating report drafts when you ask us to.
• To manage your subscription and report allowance.
• To answer your questions and send service and billing notices.
• To prevent fraud and abuse and to comply with legal obligations.

We do not sell your data, use it for advertising, or use it to train AI models.

AI processing

Your data is stored on our server. When you generate a report or regenerate a section, the relevant content (company profile, metrics, narrative inputs and relevant excerpts from your uploaded documents) is sent through an API to our AI model provider, which generates the text on our behalf and returns it to us. Content is sent only when you generate, and only what is needed for that generation.

Service providers

• Our hosting provider, which stores and runs the Service.
• Our AI model provider, which generates report text.
• Creem, our Merchant of Record, which processes payments, billing and taxes under its own privacy policy.

These providers may be located outside your country. We share with them only the data they need to provide their service.

Cookies

We use essential cookies to keep you logged in and to remember your language. We do not use advertising or third-party analytics cookies.

Retention

We keep your data while your account exists. After a subscription ends we keep it for at least 90 days so you can resubscribe or request an export. You can ask us to delete your account and data at any time. Request logs are kept only as long as needed for security and troubleshooting.

Security

Data is encrypted in transit with HTTPS, passwords are hashed, and access to our servers is restricted.

Your rights

You may request access to, correction of, export of, or deletion of your personal data by emailing support@vvai.io. We reply within 3 business days.

Children

The Service is intended for businesses and is not directed at children under 16.

Changes

We will announce material changes to this policy by email or on this page.