Privacy policy
What we do with your data, checked against the code on the date below. Stored in Frankfurt; only the founders can open a company's data, and that is logged.
Last updated 22 October 2026 · subprocessor list reviewed 2026-09-21
Who we are, and in which role
Vepartment S.r.l. ("Vepartment", "we") is an Italian company registered in Milan. It runs vepartment.com, a platform where organisations set up AI-operated departments. This policy explains what we do with personal data under the General Data Protection Regulation (GDPR) and Italian law.
For your account — we are the controller
Your name, email, sign-in method, role and what you do on the platform. We decide why and how this is processed.
For your workspace content — we are the processor
Briefs, uploaded materials, generated outputs, contacts you import, prospects you research. Your organisation is the controller; we process it on your instructions. A Data Processing Agreement (Art. 28 GDPR) is available on request — see section 13.
Data we process
Account data
Name, email address, sign-in method (Google or email code), role in the workspace, session and security records (sign-in time, forced logouts).
Workspace content
Department and domain configuration, briefs, uploaded files, knowledge-graph entries, generated text, images, audio and video, approvals and their audit trail.
AI interaction data
The prompts the platform builds from your brief and content, the model outputs, and per-call token counts by model, domain and route (used for quota and billing).
Third-party personal data you bring
Contacts you import for outreach, prospects and people found by Scouting or Persona research from public sources, email recipients and their engagement events (opens, clicks, replies, bounces), and the text of a reply to a one-to-one email you sent, so you can read it beside the company it came from. Your organisation is the controller for this data.
Website analytics (only with consent)
Pseudonymous page views via Google Analytics 4, IP-anonymised. Off until you accept analytics cookies.
Server logs
Request logs held by our hosting provider for operations and security, retained per their standard log rotation.
Purposes and legal bases
- Providing the service you signed up for — running departments, agents, generation, exports, approvals. Legal basis: performance of a contract (Art. 6(1)(b)).
- Metering usage against your plan and invoicing. Legal basis: contract, and legal obligation for accounting records (Art. 6(1)(c)).
- Security, abuse prevention, rate limiting and audit logs of administrative actions. Legal basis: legitimate interest (Art. 6(1)(f)).
- Account emails — sign-in codes, invitations, approval requests, budget alerts. Legal basis: contract. Alert emails can be switched off in Settings → Notifications.
- Website analytics. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time via the cookie preferences below.
- Improving the product from aggregate usage patterns — never from the content of your briefs or outputs.
How AI processing works
Where prompts go
Agents send prompts built from your brief and workspace content to a model provider — Anthropic by default, OpenAI or Google if you select their models. The provider returns the output and we store it in your workspace. Some small decisions — is this message a question or a request, is something said in chat a lasting fact worth remembering, does this evidence support that claim, does a draft break one of your brief's policies, is an edit a repeatable preference, does a Studio context hold enough of your earlier decisions, which of them matter for the unit being written, which names in an approved document are your own ideas, are two recorded facts the same — may be put to a separate decision model (Jev, by TypeSafe AI, reached through Vercel AI Gateway). It receives only the text needed for that decision (for example your message and an excerpt of the answer, a draft, the words an edit changed, the assembled context of a Studio unit, or the sentences around a name), returns probabilities rather than text, and every request is sent under a zero-data-retention, no-training requirement.
Your own key
If you store your own provider API key in Settings → API keys, calls to that provider run on your account and under your contract with them, not ours.
No training on your data
We do not train models. The providers we use process API traffic under commercial terms that exclude training on it. We never send your content to a provider for any purpose other than producing the output you asked for. The one exception is house-rule learning: when the same correction keeps coming back in a domain's Studio drafts, the words you changed (with email addresses, phone numbers and links masked) go to the provider under the same terms to propose short style rules, which change nothing until your workspace owner accepts them.
Workspace isolation
Every query is scoped to your workspace. Content from one organisation is never used as context for another. Platform administrators can inspect tenant data for support; every such action is written to an audit log you can request.
Human approval
Actions that leave the platform — sending email, publishing, deploying a department — require a human approval recorded with who approved what and when.
Subprocessors
These are the third parties that can receive data from the platform, grouped by when they are engaged. Most are used only when you run the feature that needs them. We do not sell or rent data to anyone.
Infrastructure — always engaged
| Provider | Purpose | Location | Engaged | Data |
|---|---|---|---|---|
| MongoDB Atlas (AWS eu-central-1) | Primary database — accounts, workspaces, briefs, generated content, usage ledgers | Frankfurt, Germany (EU) | Always | All account and workspace data, encrypted at rest |
| Vercel | Application hosting, serverless compute, edge network, file storage (Vercel Blob) for uploaded materials and exports; AI Gateway, which relays requests to the Jev decision model | United States (functions), global edge network | Always | Every request; uploaded files and exports in Blob |
| Brevo (Sendinblue) | Transactional email (sign-in codes, invitations, alerts) and outbound campaigns you create | France (EU) | Always for account email; campaigns only when you send them | Email address, name, message content; campaign recipients you import |
| Google (Sign-in, Analytics) | Google sign-in (OAuth) and Google Analytics 4 on the website, the latter only after cookie consent | United States | Sign-in: when you choose it. Analytics: only after you accept analytics cookies | Google account email at sign-in; pseudonymous page-view events with consent |
AI model providers — used unless you bring your own key
| Provider | Purpose | Location | Engaged | Data |
|---|---|---|---|---|
| Anthropic | Language models behind agents, chat and generation (default provider) | United States | Unless the workspace has stored its own Anthropic key | Prompts built from your brief and workspace content; generated outputs |
| OpenAI | Optional language models (GPT) when selected; image generation (gpt-image) when the workspace chooses OpenAI as its image provider | United States | Only when an OpenAI model or the OpenAI image provider is selected; on your own key when stored | Prompts and generated outputs for that call |
| Google AI (Gemini / Vertex AI) | Image generation (Nano Banana — the default image provider) and optional Gemini language models when selected | United States | For generated images unless the workspace chooses another image provider, and when a Google model is selected; on your own key when stored | Image prompts, reference images you supply, and generated outputs for that call |
| TypeSafe AI (Jev), reached through Vercel AI Gateway | Decision model that answers yes/no, pick-one and rating questions — for example whether a chat message is a question or a request, or whether a piece of collected evidence supports a persona claim. It returns probabilities and writes no text | See provider | Only when a Jev-backed check runs. Every request is sent with Vercel AI Gateway's zero-data-retention and no-training requirement and is restricted to TypeSafe | The text being judged — a chat message, or a collected evidence excerpt with the persona claims it is compared against — and the questions asked about it |
Feature providers — only when that feature runs
| Provider | Purpose | Location | Engaged | Data |
|---|---|---|---|---|
| Hugging Face (Inference Router) | Image generation models (FLUX and similar) in Studio | United States | Only when you generate an image with a hosted open model | The image prompt |
| Recraft | Vector logo and illustration generation | United States | Only when you generate or vectorise a logo | The prompt and, for vectorisation, the source image |
| ElevenLabs | Voice and audio generation (Sonic branding lab) | United States | Only when you generate audio | The script text |
| Seedance | Short video generation | See provider | Only when you generate a video | The prompt and any reference image |
| Tavily, Exa, Brave Search | Web search and page retrieval for research-grounded generation | United States | Only when a research or deep-define step runs | Search queries derived from your brief (never account data) |
| Jina AI (Reader) | Fetching and cleaning web pages you or an agent point at | Germany (EU) | Only when a URL is read | The URL |
| ScrapeCreators, Apify | Public social-media and web listening (Scouting, Persona research) | United States (ScrapeCreators), Czech Republic (Apify, EU) | Only when a listening sweep or scouting run is configured and runs | Public handles, keywords and URLs you configure |
| NewsData, Semantic Scholar, EUR-Lex | News, academic and legal sources for research | See provider | Only when a research step queries them | Search queries derived from your brief |
| Pexels, Unsplash, Openverse, Pinterest, Brandfetch | Stock imagery, moodboards and brand-asset lookups | United States | Only when you search images or fetch a brand's public assets | Search keywords and brand domains |
Integrations — only when you connect them
| Provider | Purpose | Location | Engaged | Data |
|---|---|---|---|---|
| Pipedrive | CRM sync for prospects and outreach | United States / EU per your Pipedrive account | Only after you connect your Pipedrive account | Contacts and deals you choose to sync |
| Google Analytics 4, Search Console, Microsoft Clarity (telemetry) | Reading YOUR site's traffic metrics into the Observatory | United States | Only after you connect the property; read-only | Aggregate metrics from your own property |
| Figma | Design file import | United States | Only when you connect Figma | Files you select |
We will update this list before engaging a new subprocessor. Customers with a signed DPA are notified by email and may object within 30 days.
Where data is stored and processed
Database — European Union
All account and workspace data lives in MongoDB Atlas on AWS in Frankfurt, Germany (eu-central-1), encrypted at rest. Stored API keys are additionally encrypted by the application before they reach the database.
Application compute — United States
The application runs on Vercel. Server functions execute in Vercel's default United States region and static assets are served from its global edge network. Uploaded files and exports are stored in Vercel Blob. This means data transits and is processed in the United States even though it is stored in the EU.
AI providers — United States
Anthropic, OpenAI and Google process prompts in the United States.
Transfers outside the EU
For providers outside the EU we rely on the European Commission's Standard Contractual Clauses in their data processing terms and, where the provider holds it, EU-U.S. Data Privacy Framework certification. Details per provider are in the links above.
Encryption
TLS 1.2 or higher in transit everywhere. AES-256 at rest for the database and file storage.
Access
Workspace data is reachable only by members of that workspace, with role-based permissions you manage in Settings → People & access. Platform-admin access is limited to the founders, and every admin action on tenant data is written to an audit log.
If you need processing to stay in the EU end-to-end, contact us before onboarding: an EU-region deployment is possible on the Enterprise tier and is not the default.
Retention
- Account and workspace data: kept while the workspace exists.
- Deletion: when a workspace or account is deleted, its data is removed from the live database with a cascade over every collection, and its stored files are removed from file storage; it is not soft-deleted. A workspace deletion requested by its owner waits 7 days (the workspace is read-only and the owner can cancel), then runs automatically; a member's own account is deleted immediately. Requests sent by email are completed within 30 days.
- Data exports: an export archive you download from Settings is kept in private file storage for 24 hours, then deleted.
- Usage ledgers: monthly token counts per workspace (no content) are kept as billing records for as long as accounting law requires.
- Database backups: MongoDB Atlas snapshots expire on the cluster's backup schedule. We do not restore deleted tenants from backups.
- Server logs: rotated by the hosting provider on its standard schedule; not retained by us.
- Email engagement events from campaigns you send: kept with the campaign until the workspace is deleted.
- Replies to one-to-one emails you sent: the text of the reply is kept for 12 months after it arrives, then deleted automatically; the fact and date of the reply stay. A workspace owner or admin can delete a reply's text sooner.
Your rights, and how to exercise them today
Under the GDPR you can access, correct, export, restrict, object to, and erase your personal data. This is exactly how each works on Vepartment right now:
Access and correction — in the app
Your name and email are editable in Settings → Profile. Workspace content is visible to you in the dashboard.
Export — in the app
Any domain's content can be exported from the dashboard in PDF, Markdown, JSON and other formats. A complete machine-readable export is one click in the app: the workspace owner can download all workspace data (Settings → Workspace → “Take everything out”), and every member can download their own profile (Settings → Profile → “Download my data”), conversations and the records of the workspace that name them. The export is a ZIP of JSON files (one per collection) with a list of the stored files it refers to; passwords, API keys, access tokens and webhook addresses are never included. One export per workspace (or person) per hour; the download link works for 24 hours. Without an active workspace (for example after being removed from one) you can still download and delete your account at /account/data; records held inside a workspace stay with that workspace. If you cannot sign in, email us and we deliver the archive within 30 days.
Erasure — in the app
Settings → Profile → “Delete my account” removes a member's account immediately after they type their email to confirm: their profile, personal settings and connected accounts are deleted, together with the conversations only they took part in (chats, meeting-room meetings, persona chat sessions); other records they appear in (approvals, tasks, one-off persona questions) stay with the workspace with their name cleared. The workspace owner can delete the whole workspace by typing its name: it becomes read-only at once, the other admins are notified, and it is deleted with all of its data and files after 7 days unless the owner cancels. An owner whose workspace other people use must transfer ownership or delete the workspace before deleting their account; a sole owner's account is deleted together with the workspace after the same 7 days. Deletion is a hard delete across every collection and cannot be undone once carried out. If you cannot sign in, email us from the address on the account and we delete within 30 days, then confirm by email.
Objection, restriction, withdrawal of consent
Analytics consent: withdraw with the cookie preferences button below. Alert emails: Settings → Notifications. Anything else: email us.
Requests go to info@vepartment.com; we answer within 30 days. You may also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali.
People whose data you bring to the platform
Scouting, Persona research and outreach let you collect and contact people. You are the controller for that data and responsible for having a legal basis to process it and to contact them. The platform helps: outbound messages require a human approval, unsubscribe handling runs through Brevo, and every sourced record keeps its provenance. Public-source research collects only what is publicly posted and stores no more than you configure.
Children
The service is for organisations and not directed at anyone under 16. If we learn we hold a child's data we delete it; write to info@vepartment.com.
Changes to this policy
When we change what we do with data — a new subprocessor, a new region, a new purpose — we update this page and the date at the top, and email account owners at least 30 days before a material change takes effect. The subprocessor list carries its own review date.