Privacy Policy

Last updated: October 13, 2026

This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use the Service and tells You about Your privacy rights and how the law protects You.

We use Your Personal Data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy. Information We receive from Google is subject to the additional commitments in Google User Data.

Interpretation and Definitions

Interpretation

The words whose initial letters are capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access Our Service or parts of Our Service.

• Application refers to Vendis, the software program provided by the Company.

• Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Privacy Policy) refers to Vendis, Inc., 382 NE 191st St, PMB 637251; Miami, FL; 33179-3899; United States.

• Device means any device that can access the Service such as a computer, a cell phone or a digital tablet.

• Google User Data means information the Service receives from Google APIs when You sign in with Google or connect Your Google account to the Service, and data derived from it, such as summaries and the CRM facts extracted from it.

• Personal Data is any information that relates to an identified or identifiable individual.

• Service refers to the Application.

• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.

• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

• Workspace means the shared company account in the Service that You and the other members of Your organization use.

• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain Personal Data that can be used to contact or identify You. It may include, but is not limited to:

• Email address
• First name and last name
• Usage Data

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of Our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit Our Service.

Content You Provide

To turn Your conversations into CRM data, the Service stores what You give it: messages You type or speak to the Service, voice recordings, emails You forward to the Service, files You upload, and the contacts, companies, opportunities and other records created from them.

Data from Google

If You sign in with Google or connect Your Google account, the Service receives Google User Data as described in Google User Data.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain Our Service, including to monitor the usage of Our Service.

• To manage Your Account: to manage Your registration as a user of the Service. The Personal Data You provide can give You access to different functionalities of the Service that are available to You as a registered user.

• For the performance of a contract: to perform Our contract with You for the Service.

• To contact You: To contact You by email or other equivalent forms of electronic communication regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.

• To manage Your requests: To attend and manage Your requests to Us.

• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about Our Service users is among the assets transferred. Google User Data is transferred only as described in Business Transactions.

• To analyze and improve the Service: We may use Usage Data for data analysis, identifying usage trends, and evaluating and improving the Service.

Google User Data is used only as described in Google User Data.

We may share Your Personal Data in the following situations:

• With Service Providers: We share Personal Data with the Service Providers listed in Service Providers to host, operate, secure and support the Service and to provide its features.
• With other members of Your Workspace: data in a Workspace is visible to its members and may be accessed by AI apps those members connect, as described in Who Can See Your Data.
• For business transfers: We may share or transfer Your Personal Data in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company. Google User Data is transferred only as described in Business Transactions.
• With Your consent: We may disclose Your Personal Data for any other purpose with Your consent. This does not apply to Google User Data.

Retention of Your Personal Data

We keep Your Personal Data, including Google User Data, for as long as Your Workspace exists, unless You delete it earlier as described in Delete Your Personal Data. When Your Workspace is deleted, We delete all of its data, including all of its Google User Data. We will also retain and use Your Personal Data to the extent necessary to comply with Our legal obligations (for example, if We are required to retain Your data to comply with applicable laws), resolve disputes, and enforce Our legal agreements and policies.

The following retention periods apply:

• Emails: imported emails stay in the CRM according to Your Workspace’s email retention setting (13 months by default). Their full text and the stored email copies are removed sooner: after 3 months by default, and when You disconnect Google (unless another member of the Workspace imported the same email).
• Prompt logs: records of requests to Our AI providers (prompts and responses) are kept until Your Workspace is deleted.
• Backups and logs: after data is deleted, copies in backups and logs may be kept a little longer, for at most 180 days, and are then deleted automatically. Raw emails You forward to the Service are kept for up to 60 days.
• Monitoring and AI providers: Langfuse and Honeybadger keep data under their own retention; Langfuse traces are deleted with Your Workspace where Langfuse still lets Us find them. OpenAI keeps stored responses for at least 30 days. We delete the files We upload to Google’s Gemini API once text recognition is complete.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ from those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place, including the security of Your data. This does not cover AI apps that members of Your Workspace connect: data such an app reads is transferred under that app’s own terms.

Delete Your Personal Data

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You. You can:

• Disconnect Google: in the Service, open Profile → Integrations → Google Workspace and choose Disconnect. This stops syncing, asks Google to remove the Service’s access to Your Google account, and removes the emails and calendar events imported from Your account that nobody else in the Workspace uses. Records already in the CRM, such as contacts, companies, opportunities, tasks and Meet transcripts, stay.
• Remove the Service at Google: remove the Service at myaccount.google.com/connections. This stops all further access to Your Google account.
• Delete Your Workspace: ask Us at info@vendis.ai. Once We mark the Workspace for deletion, its members lose access, and after a 30-day grace period We permanently delete all of its data, including all of its Google User Data. Backup copies are deleted within at most 180 days.
• Ask Us: contact Us at info@vendis.ai to request access to, correction of, or deletion of Personal Data about You.

Step-by-step instructions are on Manage and delete your Google data.

Please note, however, that We may need to retain certain information when We have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy. Google User Data is transferred as part of a merger, acquisition or sale of assets only with Your explicit prior consent.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially reasonable means to protect Your Personal Data, We cannot guarantee its absolute security.

Google User Data

This section applies to Google User Data. Where it differs from the rest of this Privacy Policy, this section prevails.

Limited Use

Vendis’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google User Data only to provide and improve the features described below. If We change how We use Google User Data, We ask for Your consent before using it in the new way.

What We Access and Why

You choose which permissions to grant on Google’s consent screen. Each feature uses its own permission and stays off until You grant it.

Sign-in (openid, email, userinfo.email, userinfo.profile)

• Accessed: Your name, email address, Google account identifier and the other basic profile information Google provides.
• Why: to sign You in to the Service and to confirm that a Google connection belongs to Your Account.

Gmail — read (gmail.readonly)

• Accessed: Your email messages, including their headers (such as sender, recipients, subject and date), their text and their attachments.
• Why: to turn Your email conversations into CRM data: creating and updating contacts, companies and opportunities and enriching them with public business data, summarizing conversations, suggesting next steps and making emails searchable in the Service. Text in attachments is recognized so it can be used the same way.

Gmail — drafts and sending (gmail.compose)

• Accessed: email drafts in Your Gmail.
• Why: when You ask the Service’s chat assistant, it drafts, revises or discards emails as drafts in Your Gmail. It sends a draft only when You ask it to and You have not limited it to drafts. A per-user “drafts only” setting is on by default.

Google Calendar (calendar.events.owned)

• Accessed: events on calendars You own, including their title, description, location, time, attendees, organizer and video-conference details.
• Why: to show Your meetings with the contacts, companies and opportunities involved, and to match Google Meet transcripts to their participants. The Service currently only reads events; it does not create, change or delete them.

Google Meet (meetings.space.readonly)

• Accessed: records of Your Google Meet meetings, their participants and their transcripts.
• Why: to summarize meetings and update the CRM from what was discussed.

Google Contacts and “Other contacts” (contacts.readonly, contacts.other.readonly)

• Accessed: names, email addresses, phone numbers and organizations of Your saved contacts, and the names and email addresses Google saves automatically in “Other contacts” for people You have emailed.
• Why: to import Your contacts into the CRM, to enrich them with public business data, and to match the people in Your emails and meetings to the right contacts.

Google Workspace directory (directory.readonly)

• Accessed: names and email addresses in Your organization’s Google Workspace directory.
• Why: to tell Your colleagues apart from external contacts, to recognize Your company’s own email domains, and to identify participants in Your meetings.

How We Store It

Google User Data is stored in the Service’s database, file storage and search index, which are hosted on Amazon Web Services, and travels over TLS-encrypted connections. Copies of imported emails and their attachments are kept in file storage. How long each kind of data is kept is described in Retention of Your Personal Data.

How We Use AI

The Service uses AI models from the providers listed in Service Providers to read, summarize and extract information from Google User Data, only to provide the features described above.

We do not use or transfer Google User Data to create, train or improve generalized AI/ML models.

Who Can See Your Data

• Members of Your Workspace: mail, meetings and contacts You import are visible to every member of Your Workspace, and may be accessed by AI apps those members connect to Vendis, subject to the permissions described below.
• AI apps that members connect: an AI app (for example ChatGPT or Claude) connected to the Service acts with the access of the member who connected it. It can read emails, meeting transcripts and calendar details only if that member grants it the separate permission to read communications, and each such read is recorded. A personal API token is not limited by that separate permission: it can access the data available through the API in Workspaces its owner belongs to, using the owner’s permissions. Data an app reads leaves the Service and is then subject to that app’s own terms.
• Vendis administrators: Administrator access to customer workspaces is restricted to designated Vendis administrators. Vendis staff open Your Workspace only to handle Your support request with Your documented agreement to view the specific data needed, when necessary for a security investigation (including security-related bugs or abuse), or when required by applicable law.

The same conditions apply when Vendis staff read Google User Data in logs, traces and error reports.

How We Share It

We share Google User Data only:

• with the Service Providers listed in Service Providers, which process it on Our behalf to provide the features described above;
• with People Data Labs, which receives the name, email address, phone number, profile URL, company, company website and location of people in Your CRM and returns public business profile data for Your CRM records;
• with Brave and Exa, which receive the search queries the assistant writes, which can include business context from Your data; Brave also receives company and person names and company websites when the Service looks them up;
• with Telegram, if a member connects Telegram: the assistant’s replies to that member, which can include email summaries, meeting information and CRM data, are delivered through Telegram;
• with the members of Your Workspace and the apps they connect, as described in Who Can See Your Data;
• when required by law, or to investigate security incidents and abuse;
• as part of a merger, acquisition or sale of assets, only with Your explicit prior consent.

We do not sell Google User Data and do not use it for advertising.

Service Providers

We use the following Service Providers. Each of them processes Personal Data, which can include Google User Data, only for the role listed:

• Amazon Web Services (AWS): hosts the Service — database, file storage, search index, receipt of forwarded emails and application logs. We plan to also use AI models hosted on Amazon Bedrock.
• OpenAI: AI models that read, summarize and extract information from Your content, including text recognition in documents.
• Google (Gemini API): AI models, including text recognition in email attachments and uploaded documents.
• Anthropic (planned): AI models, provided through Amazon Bedrock, that will read, summarize and extract information from Your content. They are not in use yet.
• Langfuse: records Our requests to AI providers (prompts, responses and traces) for troubleshooting.
• Honeybadger: error reports and application telemetry, which can include the data involved.
• People Data Labs: receives name, email address, phone number, profile URL, company, company website and location, and returns public business profile data for Your CRM records.
• Brave: web search. It receives the search queries the assistant writes, which can include business context from Your data, and company and person names and company websites when the Service looks them up.
• Exa: web search. It receives the search queries the assistant writes, which can include business context from Your data.
• Firecrawl: retrieves the web pages the assistant visits, such as company websites.
• Apify: retrieves public LinkedIn profile and company pages.
• Telegram: delivers the assistant’s replies to members who connect Telegram. These replies can include email summaries, meeting information and CRM data.

Children’s Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect Personal Data from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.

We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the “Last updated” date at the top of this Privacy Policy.

If We change how We use Google User Data, We ask for Your consent before using it in the new way.

You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If You have any questions about this Privacy Policy, or want to request access to or deletion of Your data, You can contact Us:

• By email: info@vendis.ai