Vest works with the most sensitive documents a contractor has. This policy says what we collect, why, who handles it for us, how long we keep it, and how to reach us. It covers the Vest web app, the Vest apps for iPhone, iPad and Android, and this website.
Vest is made and operated by Vest AI, Inc., a Delaware corporation based in San Jose, CA 95126. Write to hello@vest.build with any question about this policy.
Vest is a business product. Your company signs up, its administrator invites each person, and the company decides what is uploaded. We handle your company's documents and its people's information on the company's behalf, to provide the service.
Sign-in runs through our identity provider, WorkOS. Vest stores your name, email address, company membership and role. Vest never stores your password. Sign-in events and admin actions, including the network address you sign in from, are kept in an activity log.
The documents your company uploads or syncs, the questions people ask, the passages Vest retrieves, and the answers it gives. These are visible to your company and to no other customer, and people see only the projects they are added to.
When you send feedback or report a problem, we receive your email address, your comment, the question and answer you flagged, and any photo, screenshot or video you attach, including the sound in a video. The report also carries a small set of diagnostics: the screen you were on, your time zone, your screen size, your browser or app version, and the last few error messages and failed requests, without their contents. Reports are emailed to the founders.
The web app and the apps measure how long documents, pages and answers take to appear, which sources you open, your network type and estimated speed, your screen width, and whether you are in the app. These measurements are tied to your account so we can find slow or broken experiences, and we use them for nothing else.
If you allow notifications, the app gets a device token from Google Firebase Cloud Messaging and sends it to Vest, which stores it with your account. We use it only to tell you, for example, that an answer is ready. Notifications reach your device through Firebase Cloud Messaging and, on Apple devices, the Apple Push Notification service. Signing out removes the token from your account. You can turn notifications off at any time in your device settings.
The apps ask for the camera, the microphone and your photo library only when you attach a photo or video to a problem report, and only what you choose is sent. The apps keep your sign-in in the device's secure storage (the Keychain on Apple devices, a Keystore-protected store on Android).
The web app uses cookies to complete sign-in and keep you signed in. It uses no advertising or analytics cookies.
We use what we collect to run Vest for your company: to sign you in, answer your team's questions, show the pages answers come from, send the notifications you allowed, fix problems you report, keep the service secure, and make it faster and more reliable.
We do not sell personal information, we do not share it for advertising, and we do not track you across other companies' apps or websites. The web app and the apps contain no advertising or analytics software.
Your documents, questions and answers are never used to train AI models, by us or, under their published terms, by any AI provider we use. Vest does not train models.
We share personal information only with the service providers below, only so they can run their part of Vest for us, and only with providers whose terms require them to protect it with the same or equal protection as this policy. None of them may use it for their own purposes.
Our security page lists these vendors and how each is used. We may also disclose information when the law requires it, or to a buyer of the business that keeps this policy in place.
Your files, your database and its backups are stored in Amazon Web Services in Northern Virginia, in the United States. An AI provider may process a request outside the United States.
When your company stops using Vest and asks us to delete its data, your documents, your database and stored files are removed from live systems right away, with copies in database backups expiring within 7 days and stored file versions expiring within 30 days. Records of questions and answers kept for quality review are deleted with them. Anything Vest compiled for you, like schedules and exports, stays with you.
Email hello@vest.build to ask for a copy of the data we hold about you or your company, to correct it, or to have it deleted. A founder answers. Your company's administrator creates and removes accounts, so you can also ask your administrator to remove yours; when someone is removed, their access ends immediately. You can withdraw notification, camera, microphone and photo permissions at any time in your device settings.
Data travels encrypted between your device and Vest. Our security page says where your data lives, who can reach it, and what we have not built yet.
The pilot request form collects only what you type into it: your name, company, email, and anything you choose to add. The form posts to a form service, we own the responses, and we use them to respond to you and for nothing else. This site does not run advertising trackers.
Vest is built for businesses and is not directed to children under 13. If you believe a child has given us personal information, email hello@vest.build and we will delete it.
When this policy changes, we update the date at the top. Customers hear about material changes from us directly.
Vest AI, Inc., San Jose, CA 95126. Privacy questions and requests: hello@vest.build. Security reports: security@vest.build. Help with the product: our support page.