Privacy Policy

Last updated: August 7, 2026

This Privacy Policy explains how Vestigo (“Vestigo,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when you use the Vestigo website and application (the “Service”).

By using the Service, you acknowledge the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

1. Information We Collect

Account and profile information

When you create or use an account, we may collect your email address, name, authentication information, profile details, and account preferences.

Google sign-in

You may optionally sign in to Vestigo using Google OAuth. When you use Google sign-in, Google and Supabase Auth provide Vestigo with basic account information such as your name, email address, and Google account identifier. We use this information to create, authenticate, secure, and manage your Vestigo account. Vestigo does not request access to your Gmail, Google Drive, Google Calendar, or other Google services, and does not use Google sign-in data for advertising.

Workspace and team information

Vestigo lets you create workspaces and collaborate with other users. We may collect workspace names, website URLs, team-member email addresses, invitations, roles, and workspace settings.

Prompts, research, and application data

We collect the information you submit to the Service, including tracked prompts, selected countries and topics, competitor information, research requests, model selections, generated responses, citations, audits, opportunities, and related usage history.

Do not submit sensitive personal information, confidential information, or information that you are not authorized to provide through the Service.

Billing information

If you purchase a paid plan, billing and payment information is processed by Stripe. We receive billing-related information such as subscription status, plan, billing interval, Stripe customer or subscription identifiers, and transaction status. We do not receive or store your full payment-card number.

Support and communications

If you contact support or submit a feature request, we collect the email address, request type, and message you provide, together with information needed to respond to you.

Automatically collected information

When you use the Service, we may automatically receive technical and usage information such as your IP address, browser and device type, operating system, pages or features accessed, dates and times of access, and diagnostic information. We use this information to operate, secure, troubleshoot, and improve the Service. With your consent where required, our analytics provider PostHog may also receive product-usage events, navigation information, feature interactions, and masked session-replay data.

2. How We Use Information

We use information to:

• create and maintain user accounts and workspaces;
• provide, operate, and improve the Service;
• process prompts, research requests, analyses, and generated results;
• enforce plan limits, trials, usage quotas, and account security controls;
• process subscriptions and payments;
• communicate with you about your account, the Service, support requests, security, and important changes;
• send product or marketing communications where permitted by law and subject to your choices;
• detect, investigate, and prevent fraud, abuse, security incidents, and violations of our terms;
• comply with legal obligations and protect our rights; and
• create aggregated or de-identified information that cannot reasonably identify you.

3. How We Share Information

We may share information in the following circumstances:

Service providers

We use carefully selected service providers to help operate Vestigo. Depending on the feature used, these providers may include:

• Supabase for authentication, database, and related application infrastructure, including Google OAuth sign-in;
• Stripe for payment processing and subscription billing;
• Maileroo for transactional or support email delivery;
• Cloudflare and other hosting or infrastructure providers;
• PostHog for product analytics, feature usage, and consented session replay;
• AI, search, scraping, and workflow providers used to process research requests and generate results; and
• security, reliability, and technical support providers.

These providers may process information on our behalf and are expected to use it only to provide services to us or as otherwise permitted by law.

Workspace administrators and other users

Information you submit to a workspace may be accessible to that workspace’s administrators and members according to the workspace’s permissions and settings.

Legal and safety reasons

We may disclose information when reasonably necessary to comply with law, legal process, or a government request; enforce our agreements; detect or prevent fraud or security issues; protect the rights, property, or safety of Vestigo, our users, or others; or establish or defend legal claims.

Business transactions

Information may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, or similar transaction. We will provide notice where required by law.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising unless we provide the disclosures and choices required by applicable law.

4. AI and Third-Party Processing

Vestigo uses third-party services to process prompts, website or competitor information, research requests, and related data in order to provide analyses and results. Information sent to a provider depends on the feature you use and may include your prompt, selected country or topic, workspace website, and related research inputs.

Third-party providers may process information in countries other than the country where you live. Their handling of information is governed by their own terms and privacy policies, in addition to our contractual arrangements where applicable.

You are responsible for ensuring that you have the necessary rights and permissions to submit content to Vestigo and to request its processing by these providers.

5. Cookies and Similar Technologies

Vestigo uses cookies and similar technologies that are necessary for authentication, security, session management, preferences, and core functionality. With consent where required, we also use PostHog for product analytics and masked session replay to understand how the Service is used and improve the product.

You can control cookies through your browser settings. Blocking necessary cookies may prevent parts of the Service from working correctly. See our Cookie Policy for more information.

6. Data Retention

We retain information for as long as reasonably necessary to provide the Service, maintain business and financial records, resolve disputes, enforce agreements, prevent abuse, and comply with legal obligations. Retention periods vary depending on the type of information and the purpose for which it was collected.

When information is no longer required, we will delete it, de-identify it, or securely isolate it where deletion is not immediately possible.

7. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Transfers

Vestigo and its service providers may process information in countries outside your country of residence. Where required, we use appropriate safeguards for international transfers, such as contractual protections or other mechanisms recognized by applicable data-protection law.

9. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have rights to:

• request access to personal information we hold about you;
• request correction or deletion of personal information;
• request restriction of or object to certain processing;
• request portability of information you provided to us;
• withdraw consent where processing is based on consent;
• opt out of marketing communications; and
• appeal a decision concerning a privacy request where applicable.

To submit a request, contact us at privacy@tryvestigo.com. We may need to verify your identity before completing a request. You may also have the right to complain to the data-protection authority in your jurisdiction.

10. Children’s Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us so we can take appropriate action. A higher minimum age may apply in some jurisdictions.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date. If changes are material, we will provide additional notice where required by law.

13. Contact Us

For questions or privacy requests, contact Vestigo at privacy@tryvestigo.com.