Privacy Policy

1. Introduction

Vester, Inc. (“Vester,” “we,” “our,” or “us”) operates the Vester platform, including our website, applications, and related services (collectively, the “Services”).

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you access or use our Services.

Please read this notice before deciding what to share or connect. Where a particular use requires your consent, we will request that consent separately.

2. Information We Collect

Information You Provide Directly

We collect information you voluntarily provide when you:

• Create an account
• Communicate with us
• Request support
• Subscribe to updates or newsletters
• Participate in surveys or events
• Use interactive features within the platform

This information may include:

• Name
• Email address
• Account credentials
• Organization or company name
• Communications or content you submit through the Services

Financial information can be sensitive. Do not submit government identification numbers, health information, biometric identifiers, or bank passwords in prompts, uploads, or communications with Vester.

Connected Financial Information

If you choose to connect financial accounts or provide financial records, we may receive institution and account details, balances, holdings, transactions, income and spending information, liabilities, and other data supported by the connection or included in your records. We use this information to provide the financial views and analysis you request. Prompts, goals, preferences, uploaded documents, and generated outputs may also contain financial information.

Connections are read-only. They let Vester see balances, holdings, transaction history, and the other data the connection supports, for the analysis you asked for. They do not carry permission to move money, make a payment, or place a trade, and we do not request those permissions.

We use connection providers such as Plaid. A connection can give Vester access to financial data and connection tokens; this is different from storing your institution password. Review the permissions shown during connection and Plaid’s applicable privacy information. Do not share your institution password directly with Vester.

Waitlist and Personal Invitations

When you request beta access, we collect your email address, the request time, the version of the access notice presented, and the status of our review. If approved, we link the request to a personal invitation and record its issuance, expiration, revocation, and acceptance. We store hashes of invitation credentials and verification codes rather than their original values.

We use waitlist information to review requests, manage invitations, prevent abuse, and follow up about access. Joining the waitlist does not sign you up for a general newsletter. To withdraw a request or ask for deletion, email alex@vesterai.com.

Information Generated Through Use of the Services

When you use Vester, we may collect information related to platform usage, including:

• Login activity and timestamps
• Features accessed
• Queries and interactions with platform tools
• Preferences and configuration settings
• Technical performance data

This information helps us operate, maintain, and improve the Services.

Automatically Collected Information

We automatically collect certain technical information such as:

• IP address
• Browser type
• Device information
• Operating system
• Referring pages
• Interaction and navigation data

We use cookies and similar technologies to:

• Maintain secure sessions
• Remember preferences
• Analyze usage patterns
• Improve platform performance

The marketing website uses PostHog for basic page and button analytics, including the beta access page. On that page we record that a visit happened, whether an invitation or a waitlist request was submitted, whether it was accepted or rejected, and whether an invitation took the form of a six-character code or an older invitation link. We never record the invitation code itself, the email address, or the page's query string or URL fragment: those are removed before any event is sent, not filtered afterwards. Marketing session recording, session replay, autocapture and heatmaps are disabled, we do not build a marketing profile of you, and we honour your browser's Do Not Track setting. The application has its own operational and usage telemetry. You may control cookies through your browser settings, though some features may not function properly if cookies are disabled.

3. Artificial Intelligence Processing

Providing AI features can involve sending relevant prompts, connected financial context, documents, and conversation content to AI service providers. We also retain operational records needed to troubleshoot errors and assess product quality. Authorized team members may review relevant interactions or outputs for support, troubleshooting, security, and product evaluation, subject to the restrictions applicable to the source of that information.

Vester provides analytics and insights using artificial intelligence and automated systems. Information you submit through the Services, including prompts, queries, and interactions, may be processed by automated models to:

• Generate responses and insights
• Improve platform functionality
• Maintain system reliability and safety
• Enhance product performance

We do not train AI models on your content

Your prompts, connected financial information, uploaded documents, and conversation content are processed to produce the output you asked for and to operate the Services. We do not use this content to train or fine-tune AI models.

We may retain records to detect abuse, keep the Services secure, or meet a legal obligation, as described in this policy. Retaining those records does not permit us to use your content to train or fine-tune AI models.

Vester does not use user content to make automated decisions that produce legal or similarly significant effects.

4. Third-Party Accounts and Integrations

You may choose to connect third-party services to Vester, such as authentication providers or external platforms.

When authorized by you, we may receive limited information necessary to enable the requested integration. The information received depends entirely on the permissions you grant.

We use this information solely to operate integration features you enable.

5. Google API Services Disclosure

If you connect your Google account to Vester, we may access limited Google user data permitted by the OAuth scopes you approve (such as basic profile information).

Vester’s use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Google user data is used only to provide or improve user-facing features requested by you.
• We do not sell Google user data.
• We do not use Google user data for advertising, profiling, or retargeting.
• We do not use Google user data for creditworthiness or lending decisions.

Google user data may only be shared:

• With service providers necessary to operate requested features
• For security or fraud prevention
• To comply with legal obligations
• With your explicit consent

Human access to Google data occurs only when required for support, security, or legal compliance.

6. Information From Other Sources

We may receive limited information from analytics providers, authentication partners, or publicly available sources to help operate and improve our Services.

7. How We Use Information

We use collected information to:

• Provide and operate the Services
• Authenticate users and maintain accounts
• Deliver requested functionality
• Improve performance and reliability
• Provide customer support
• Communicate service updates
• Detect fraud or misuse
• Maintain platform security
• Comply with legal obligations

8. How We Share Information

We share information only in limited circumstances:

Service Providers

With vendors that assist with hosting, analytics, infrastructure, customer support, or security operations under confidentiality obligations.

Legal Compliance

When required by applicable law or governmental request.

Business Transactions

During mergers, acquisitions, financing events, or asset transfers.

With Your Consent

When you explicitly authorize sharing.

We do not rent, sell, or trade personal information to advertisers or data brokers.

9. Data Retention

We retain personal information only as long as necessary to:

• Provide Services
• Meet legal requirements
• Resolve disputes
• Enforce agreements

Aggregated or anonymized information may be retained indefinitely.

Disconnecting an account

You can disconnect a financial connection at any time. When disconnection succeeds, we revoke the connection with the provider so it can no longer be used to retrieve new data. Disconnecting does not delete your Vester account or all previously received information. To request deletion of your account or information, email alex@vesterai.com. Retained information remains subject to the retention rules above.

10. Security

We implement commercially reasonable safeguards including:

• Encryption in transit, and encryption at rest for our financial databases
• Access controls
• Secure cloud infrastructure
• Authentication protections

No system can guarantee absolute security.

If a security incident occurs, we will notify affected users as required by law.

11. Your Privacy Rights

Depending on your jurisdiction, you may have rights to:

• Access personal information
• Correct inaccurate data
• Request deletion
• Withdraw consent
• Request data portability
• Opt out of marketing communications

Requests may be submitted to: alex@vesterai.com

12. U.S. State Privacy Rights

Residents of certain U.S. states, including California, Colorado, Virginia, Connecticut, and Utah, may have additional privacy rights under applicable laws.

13. Children’s Privacy

Vester Services are intended for individuals aged 18 or older.

We do not knowingly collect personal information from children under applicable legal age thresholds. Any such information will be deleted upon discovery.

14. International Data Transfers

Vester operates primarily in the United States. By using the Services, you understand that your information may be transferred to and processed in the United States or other jurisdictions.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Material updates will be posted on our website or communicated through the Services.

For material changes to how we use previously collected information, we will provide appropriate notice and obtain consent where required.

16. Contact Information

Vester, Inc.
Email: alex@vesterai.com
Website: https://vesterai.com