Privacy Policy

Information we collect

Account information: name, email address, and a hashed password.

Business profile: company name, website, and industry, which you may optionally provide to ground a report.

Content you submit for analysis: draft copy, uploaded media, and business context.

Usage data: log data, IP address, and device or browser information.

Billing data: handled directly by Stripe; we do not store your card number.

How we use it

To operate the service: authenticate your account and generate your reports.

To send transactional emails: email verification, low-credit balance alerts, and simulation-completion notices. We do not send marketing emails to your account address.

To process payments, through Stripe.

To prevent abuse and fraud, including rate limiting and bot protection.

To maintain and improve the service.

Who we share it with

We share data with sub-processors who help us run the service, under confidentiality obligations, and we do not sell personal data. Current sub-processors: MongoDB Atlas (database hosting), Vercel (application hosting), Mailgun/Sinch (transactional email delivery), Stripe (payment processing), OpenRouter and Google Gemini (AI model inference on submitted content), Cloudflare Turnstile (bot protection), and Upstash (rate-limiting infrastructure).

Cookies and similar technologies

We use essential session cookies for authentication and Cloudflare Turnstile to detect automated abuse. We also use Google Analytics (through Google Tag Manager) to understand how visitors use this site, which sets analytics cookies (for example _ga) and sends page views and product events, with campaign (UTM) parameters, to Google. Where the law requires it (for example in the EEA, UK and Switzerland) we only set these analytics cookies if you accept them in the banner. Elsewhere you can decline them by blocking cookies in your browser or by emailing us. We also use PostHog for product analytics, A/B tests and session replay on our public pages and signup page (form inputs are masked, and it only runs when analytics are allowed as described above), Vercel Web Analytics and Speed Insights, which measure page views and loading performance without cookies, and we log technical errors from your browser (without your account details) to fix bugs. When you sign in, PostHog links your activity to an internal account ID (never your name or email) so we can see how people move from sign-up to their first analysis. We do not use advertising trackers and we do not sell personal data.

Data retention

We retain account and report data for as long as your account is active, and for a reasonable period afterward to meet legal and accounting obligations, after which it is deleted or anonymized.

Your rights

You may request access to, correction of, or deletion of your personal data by emailing kether@vitapia.app. We will respond within a reasonable time, consistent with the Hong Kong Personal Data (Privacy) Ordinance and other applicable law.

International transfers

Because our sub-processors operate infrastructure outside Hong Kong, your data may be processed in other jurisdictions, including the United States. We require sub-processors to apply appropriate safeguards.

Children's privacy

The service is not directed to children, and we do not knowingly collect personal data from children under 16.

Security

We use industry-standard measures, including encryption in transit and hashed passwords, but no system can be guaranteed 100% secure.

Changes to this policy

We may update this policy from time to time. We will post the revised version here and notify you of material changes.

Contact

Questions about this policy or your data can be sent to kether@vitapia.app.