Privacy Policy

Information we collect

Account information: name, email address, and a hashed password.

Business profile: company name, website, and industry, which you may optionally provide to ground a report.

Content you submit for analysis: draft copy, uploaded media, and business context.

Usage data: log data, IP address, and device or browser information.

Billing data: handled directly by Stripe; we do not store your card number.

How we use it

To operate the service: authenticate your account and generate your reports.

To send transactional emails: email verification, low-credit balance alerts, and simulation-completion notices. We do not send marketing emails to your account address.

To process payments, through Stripe.

To prevent abuse and fraud, including rate limiting and bot protection.

To maintain and improve the service.

Who we share it with

We share data with sub-processors who help us run the service, under confidentiality obligations, and we do not sell personal data. Current sub-processors: MongoDB Atlas (database hosting), Vercel (application hosting), Mailgun/Sinch (transactional email delivery), Stripe (payment processing), OpenRouter and Google Gemini (AI model inference on submitted content), Cloudflare Turnstile (bot protection), and Upstash (rate-limiting infrastructure).

Cookies and similar technologies

We use essential session cookies for authentication and Cloudflare Turnstile to detect automated abuse. We do not use third-party advertising trackers.

Data retention

We retain account and report data for as long as your account is active, and for a reasonable period afterward to meet legal and accounting obligations, after which it is deleted or anonymized.

Your rights

You may request access to, correction of, or deletion of your personal data by emailing kether@vitapia.app. We will respond within a reasonable time, consistent with the Hong Kong Personal Data (Privacy) Ordinance and other applicable law.

International transfers

Because our sub-processors operate infrastructure outside Hong Kong, your data may be processed in other jurisdictions, including the United States. We require sub-processors to apply appropriate safeguards.

Children's privacy

The service is not directed to children, and we do not knowingly collect personal data from children under 16.

Security

We use industry-standard measures, including encryption in transit and hashed passwords, but no system can be guaranteed 100% secure.

Changes to this policy

We may update this policy from time to time. We will post the revised version here and notify you of material changes.

Contact

Questions about this policy or your data can be sent to kether@vitapia.app.