Privacy Policy

1. Information We Collect

1.1. Information You Provide

When you create an account, we collect your name, work email address, and your company's name and legal identifiers. If you contact us, we also collect the information you include in your communications.

1.2. User Content

Our Service helps you manage your company's equity, including cap table and equity compensation plans. To do this, we process the documents and data you upload ("User Content"). This can include grant agreements, board resolutions, trustee reports, and other equity-related documents. This User Content may contain sensitive personal information about your employees and stakeholders (like names, ID numbers, tax identification numbers, and grant details). You own and control your User Content; we process it on your behalf.

1.3. Usage Data and Cookies

We automatically collect information about how you use the Service, such as the features you use and the pages you visit. This may include IP addresses and device information. We use this data and cookies (small text files on your device) to operate the Service, analyze performance, and improve your experience.

2. How We Use Your Information

We use your information to:

• Provide the Service: Operate the platform, process your User Content for data extraction and validation, and generate reports.
• Communicate with You: Send you service-related emails, security alerts, and respond to your support questions.
• Improve the Service: Analyze usage data to make our platform better.
• Manage Billing: Process payments and handle account administration.
• Ensure Security and Enforce Terms: Protect the Service from fraud and abuse and enforce our legal agreements.

3. How We Share Your Information

We do not sell your personal information. We may share information as follows:

3.1. With Our Personnel and Professional Advisors

Your information may be accessed by our authorized employees and contractors who need it to operate the Service and are bound by strict confidentiality obligations. We may also share it with our professional advisors (like lawyers and auditors) under the same conditions.

3.2. With Third-Party Service Providers

We share data with third-party service providers ("sub-processors") only as necessary to provide the Service. These providers are contractually required to process data only for the purpose of delivering their services to us, under data protection obligations at least as protective as those in this Policy.

Our sub-processors include providers in the following categories: cloud infrastructure and hosting (e.g., Google Cloud); AI document processing services (e.g., Google, OpenAI); email delivery services. A current list of our sub-processors is available upon request at privacy@get-vest.com. We will notify you of changes to our sub-processor list.

3.3. For Legal Reasons

We may disclose your information if required by law or in response to a valid legal request (e.g., a court order).

3.4. In a Business Transfer

If Vest is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Our Use of AI and Your Content

To provide AI-powered features, including automated extraction of equity data from uploaded documents, we transmit document content to third-party AI processing services under enterprise agreements that include data protection commitments.

Your documents and data are not used to train AI models. We have contractual protections with our AI providers ensuring your data is processed solely to perform the requested function and is not retained by those providers beyond the scope of the processing request.

You are responsible for ensuring you are authorized to submit any documents to the Service. A current list of our AI sub-processors is available in our Data Processing Agreement at get-vest.com/dpa.

5. Your Rights and Choices

Access and Update: You can access and update your account information through your settings.

Data Deletion: You can request the deletion of your account and data by contacting us at privacy@get-vest.com. We will make reasonable efforts to comply, subject to our legal and operational needs.

Promotional Communications: You can opt-out of receiving promotional emails by following the unsubscribe instructions in those emails. You will continue to receive essential service-related emails, such as security alerts and billing information.

6. Data Security

We take reasonable measures to protect your information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. These measures include practices like data encryption in transit and at rest, and logical access controls. However, while we strive to protect your data, no system can be 100% secure. If we detect a security breach, we will take immediate steps to address it and notify affected users without undue delay and as required by law.

7. Data Retention

We retain your data for as long as your account is active. Upon termination of your account:

• Days 1–90: You retain read-only access to the platform to export your data in a structured, machine-readable format (e.g., CSV, JSON) at no additional charge.
• After 90 days: We securely delete your data from our active systems. Backup copies are purged in accordance with our standard backup retention cycle (approximately 30 additional days).

Security audit logs (records of access and actions on the platform) are retained for 24 months for security and forensic purposes. These logs are not used for any commercial purpose.

We may retain certain data for longer periods where required by applicable law, including financial and accounting records required under Israeli law. Such retained data remains subject to the same protections as live customer data.

To request confirmation of deletion following account termination, contact privacy@get-vest.com.

8. International Data Transfers

Our company is based in Israel. Your information may be processed in Israel and other countries where our service providers operate. By using Vest, you consent to this transfer. For data transferred from regions with specific legal requirements, such as the EEA, we rely on established legal mechanisms. This includes the European Commission's adequacy decision for Israel and the use of Standard Contractual Clauses with our third-party service providers where necessary.

9. Children's Privacy

Our Service is not intended for individuals under 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post any changes on our website and notify you of significant updates. Your continued use of the Service after the changes constitute your acceptance of the revised policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@get-vest.com.