Legal
This page explains what personal data Vercilio collects, why, who we share it with, and the rights you have over it. We've tried to keep it readable. If anything is unclear, write to privacy@vercilio.ai.
For the purposes of the EU General Data Protection Regulation (GDPR), the French Data Protection Act, and the UK GDPR, Vercilio is the data controller for the personal data processed through the service.
Our contact for privacy is privacy@vercilio.ai.
Account data: your email address, your name (if you choose to provide it), and your sign-in identifier from our authentication provider (Clerk).
Usage data: the chats and messages you exchange with AI models on Vercilio, the models you used, credit balances, and contribution events linked to your payments.
Billing data: when you upgrade to a paid plan, Stripe collects your payment method and billing details on our behalf. We receive an identifier and high-level metadata (plan, amount, status) but not your full card number.
Technical data: IP address, browser user agent, device type, language preference, and approximate location derived from your IP, used for security and abuse prevention.
Analytics data: aggregated usage metrics collected via Google Analytics (event counts, page views, anonymized IP).
Performance of contract (Art. 6.1.b GDPR): to create your account, deliver chat responses, manage your subscription, and provide the environmental contribution feature.
Legitimate interest (Art. 6.1.f GDPR): to keep the service secure, prevent abuse, debug issues, and produce aggregated product analytics. We balance our interest against your fundamental rights.
Legal obligation (Art. 6.1.c GDPR): to keep accounting records as required by French tax law (typically ten years) and to respond to lawful requests from authorities.
Consent (Art. 6.1.a GDPR): for optional analytics cookies where required by local cookie law. You can withdraw consent at any time without affecting prior processing.
We share the minimum data necessary with the following processors who act under written agreements with us:
Clerk (US) — authentication and session management.
Convex (US) — application database hosting.
Vercel (US) — application hosting and edge delivery.
Our AI model providers (which may include OpenAI, Anthropic, Google, Meta, xAI, Mistral, DeepSeek, Cohere, Perplexity, etc.) — to generate responses to the messages you send.
Stripe (US / EU) — payment processing.
Google (US) — aggregated analytics through Google Analytics 4.
We do not sell your personal information. We do not share it with advertisers.
Most of our processors are based in the United States. When personal data leaves the European Economic Area we rely on EU Standard Contractual Clauses (or an adequacy decision where one applies) to maintain a comparable level of protection.
You can ask us for a copy of the relevant safeguards by writing to privacy@vercilio.ai.
Account and chat data: for as long as you have an account. When you delete your account from Settings, your profile, chats, messages, contribution attributions, and credit history are removed within 30 days.
Billing and tax records: retained for 10 years from the end of the relevant accounting year, as required by French tax law. These records are minimized to the data legally necessary.
Anonymized analytics aggregates may be retained indefinitely; they cannot be linked back to you.
Under GDPR, French data protection law, the UK GDPR, and analogous US state laws (including the California Consumer Privacy Act / CPRA), you have the right to:
Access — get a copy of the personal data we hold about you.
Rectify — correct inaccurate data.
Erase — ask us to delete your data ("right to be forgotten"); you can also do this yourself from Settings → Security → Delete account.
Restrict or object — limit or object to certain processing based on legitimate interest.
Portability — receive your data in a structured, machine-readable format.
Withdraw consent — where processing is based on consent, you can withdraw at any time.
California residents specifically: rights to know, delete, correct, and limit the use of sensitive personal information. We do not sell or "share" personal information for cross-context behavioral advertising as defined by the CCPA/CPRA.
To exercise any of these rights, email privacy@vercilio.ai. We will respond within 30 days.
We use a small set of cookies and similar technologies. See our Cookie Policy for the specific cookies, their purpose, and how to manage them.
We protect personal data with industry-standard measures: HTTPS for all traffic, encrypted storage with our hosting providers, narrow access for our team, secret rotation, and audit logging.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant supervisory authority where required by law.
We do not use your personal data for automated decisions that produce legal or similarly significant effects on you. The AI model responses are generated by third-party providers based on the message you send; they are not personalized decisions about you.
Vercilio is not intended for users under 16 (or the age of digital consent in your country, whichever is higher). If we learn that we have inadvertently collected personal data from a child under that age, we will delete it.
If you are in France, the United Kingdom, or any country in the European Economic Area, you can lodge a complaint about our processing with your local data protection authority. In France this is the CNIL (cnil.fr); in the UK this is the ICO (ico.org.uk).
We may update this policy from time to time. Material changes will be announced by email to the address on file at least 30 days before they take effect.
Questions, complaints, or requests: privacy@vercilio.ai.
