Privacy notice

What this notice covers

This notice covers the public website, demo and access requests, and related communications. Data supplied under a client engagement is governed by that engagement’s written agreement and any applicable data-processing terms. Private product demonstrations may also carry additional notices. Third-party websites have their own privacy practices.

Information you provide

The demo-request form asks for your work email address. If you email us or continue the conversation, we receive the contact details, organizational information, and message content you choose to provide. You do not need to submit a demo request to browse the public website.

Please do not send license agreements, royalty statements, account credentials, or other confidential or sensitive material through an initial inquiry. We will arrange an appropriate process if those materials are needed.

Technical information

Our hosting and security providers process information needed to deliver and protect the website, such as IP address, request time, requested page, browser information, and error or security logs. We also use IP information to prevent abuse of inquiry forms. This operational processing is used to deliver and protect the website.

Analytics, cookies, and recordings

We use Vercel Speed Insights on public pages to measure loading speed, responsiveness, and visual stability. Its performance measurements include the page path, browser and device information, network speed, and country, without identifying individual visitors or reconstructing browsing sessions. We also use Vercel Web Analytics to count visitors and page views on public pages and understand referring sites, approximate location, and browser and device categories. Web Analytics uses aggregated statistics without analytics cookies; its visitor identifiers expire after 24 hours. We remove URL query parameters and fragments before reporting page views or performance measurements. The public website uses the Meta pixel and Conversions API, which tell Meta that a browser visited the site or requested a demo so we can reach similar audiences on Meta platforms. When you request a demo we send Meta a hashed form of your email address, your IP address and browser information with that event. Meta may set its own cookies and use this information under its data policy. When your browser sends the Global Privacy Control signal, the pixel does not load and we send nothing to Meta about your demo request. We use PostHog session replay to understand how visitors use the site, with every form input masked. We do not use invitation codes to track visits to the public website.

Hosting and security providers may use cookies or similar technologies needed to deliver and protect the site. Access to private demonstrations may use authentication cookies. Private demonstrations may carry additional notices describing their own practices.

Optional analytics was previously available on the public website with consent. Removing it stops future collection through that previous analytics service; it does not automatically erase information previously collected or remove existing browser storage. You can clear stored site data through your browser settings and contact team@vestra.so to request deletion of information previously collected.

How we use information

We use inquiry information to respond, evaluate demo or engagement requests, arrange conversations, and maintain related business correspondence. We maintain business records of inquiries and related correspondence to administer prospective business relationships. We use technical information to operate, troubleshoot, and protect the website. We may also process information to meet legal obligations, resolve disputes, or protect legitimate rights.

A demo request does not subscribe you to a marketing mailing list. We do not use the form to collect payment details or create an account.

Service providers and other disclosures

We may disclose personal information to service providers that support the operation and administration of our business, including website hosting, infrastructure and security, communications and email delivery, data storage, business recordkeeping, and inquiry management. Such disclosures are made for the purposes described in this notice. Access within Vestra is limited to authorized personnel in connection with their responsibilities.

We may disclose information when reasonably necessary to comply with law or legal process, investigate abuse, protect rights or safety, or carry out a business transfer such as a merger or acquisition, subject to applicable law. We do not sell personal information or rent contact lists. The Meta pixel described below shares limited visit and demo request information with Meta for advertising; you can opt out by sending the Global Privacy Control signal from your browser, which the site honors by not loading the pixel.

Retention

We keep personal information only for as long as reasonably needed for the purposes described here. Relevant factors include whether an inquiry is active, whether it leads to a business relationship, our legal and recordkeeping obligations, and the need to address security issues or disputes. Provider logs and backups may follow separate retention schedules. You may ask us to delete an inquiry; lawful retention requirements may limit what can be removed immediately.

Your rights and choices

Depending on where you live and which laws apply, you may have rights to access, correct, delete, or obtain a copy of your personal information; to object to or restrict certain processing; and to withdraw consent. We will handle requests under applicable law and may need to verify your identity or an authorized agent’s authority. We will not discriminate against you for exercising applicable privacy rights.

Email team@vestra.so with a privacy request or question. You may also have a right to complain to your local data-protection authority. Where an appeal process is required by applicable law, you may reply to our decision to request a further review.

International visitors

Vestra is based in the United States. Information may be processed in the United States and other locations where our providers operate. Those locations may have different privacy laws. Where applicable law requires safeguards for international transfers, we use the safeguards required by that law.

Where European or UK data-protection law applies, we rely on our legitimate interests in handling business inquiries, operating the website, and preventing abuse; steps taken at your request before entering an agreement where relevant; and legal obligations where applicable. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

Security and children

We use safeguards designed to protect personal information, but no website, transmission, or storage system can be guaranteed secure. The site is intended for business users and is not directed to children under 13. If you believe a child has submitted personal information, contact us so we can investigate and take appropriate action.

Changes and contact

We may update this notice as the website or our practices change. The effective date identifies the current version. We will provide additional notice or request consent when required by applicable law.

Privacy contact: Vestra Partners, Inc., team@vestra.so.