Privacy policy
Last updated: 19 October 2026
This policy explains what we do with your data when you use Vettena to review a document. We've tried to write it plainly rather than defensively. If something here is unclear, ask us.
1. Who we are
VII INITIUM j.d.o.o. za usluge, MBS 081504844, OIB 03930513116, registered at the Commercial Court in Zagreb (Trgovački sud u Zagrebu), with its seat at Brezovička cesta 38, 10000 Zagreb, Croatia, operates Vettena and is the data controller for the personal data described in this policy.
Contact: privacy@vettena.com
2. What this policy covers
This policy covers personal data we hold about you: your account, your billing, how you use the service.
It does not cover personal data that may be inside the documents you upload. If you upload a document containing information about other people (names in a tender bid, staff in a business plan, customers in a business case), you remain responsible for that data, and we process it on your instructions. This policy does not cover that. If you need a data processing agreement, email support@vettena.com.
3. What we collect
Account data. Your email address, and a password if you didn't sign in with Google. Authentication is handled by Supabase; we store an email address in our own database so we can contact you about your reviews. If you sign in with Google, Google shares your name and email address with us.
Document data. The file you upload and the text extracted from it. Section 4 covers what happens to it.
Review output. The issues the review produces, the reviewers' notes, and the ranked report.
Usage data. Which reviews you ran, when, how many characters each document contained, how many credits were charged, and technical token counts for each AI model call.
Billing data. Your credit balance and transaction history, and for each purchase: your name or company name, billing country, VAT number if you give one, and the purchase record (what you bought, when, and the amount). Your billing address is held by Stripe. Card details are handled by Stripe and never reach our servers.
4. Your documents
This is the part most people want to know about, so it's the longest section.
What happens when you upload. We extract the text from your file, and that text is sent to three AI providers, each of which reviews it independently. The providers are named in Section 5.
We do not use your documents to train anything. Neither do the three AI providers. Each of them confirms in their own terms that data sent through their API is not used for model training. We have not opted in to any data-sharing arrangement with any of them, and we will not.
How long we keep it. Your uploaded file, its extracted text and the temporary working files created during the review are deleted from our systems within minutes of the review finishing, whether it succeeds or fails. If you upload a file but never start a review, it is deleted after about an hour. If a review crashes, the document is deleted within 24 hours. Your review report may contain short quotes from your document.
Backups. Our database is backed up automatically, and each backup is kept for 7 days. A backup made while your document was with us (during those minutes) contains its text, so a document, a report or any other record that has been deleted can remain in a backup for up to 7 days, until that backup expires. Backups are used only to restore the service after a failure.
What we keep afterwards. Your review report. If you delete a review from your history, the report goes too.
Private reviews. Private reviews are deleted 1 hour after you first open the results, or 24 hours after the review finishes if you never open it.
What the AI providers keep. This varies by provider and is set out in Section 5. We can't promise on their behalf, so we've stated what each one does rather than making a single claim.
5. Who else sees your data
We use the following sub-processors. Each one is named because your data genuinely reaches it.
AI providers (receive your document text)
Anthropic (United States): provides the Claude reviewer and the proofreading check. If the current Claude model is ever unavailable, or its answer comes back cut off or empty, we use an earlier Claude model from Anthropic as a backup. Does not use API data for training. Deletes API inputs and outputs within 30 days. Content flagged by its automated safety systems as violating its usage policy may be kept for up to 2 years.
OpenAI (United States): provides the GPT reviewer. If the current GPT model is ever unavailable, or its answer comes back cut off or empty, we use an earlier GPT model from OpenAI as a backup. Does not use API data for training unless explicitly opted in. We have not opted in. Keeps API inputs and outputs for up to 30 days for abuse monitoring, then deletes them. We have turned off OpenAI's separate storage of API responses.
Fireworks AI (United States): provides the third reviewer. This is DeepSeek, or MiniMax as a backup if DeepSeek is ever unavailable or its answer comes back cut off or empty. Both are open models that Fireworks runs on its own servers. Does not log or store prompt or generation data for open models without explicit opt-in. We have not opted in.
Why Fireworks and not the model makers directly. Fireworks publicly commits not to log or store prompt or generation data for open models like these. DeepSeek's own privacy policy says it uses data to train and improve its technology, and doesn't exclude data sent through its API. We chose Fireworks for that written commitment. (Checked September 2026.)
Hosting (stores your data on our behalf, in the EU)
Hetzner Online GmbH (Germany): runs our application servers. Your document is processed on these servers during a review; the working files are stored temporarily on our server and deleted when the review is done.
Scaleway SAS (France): hosts our database and its backups. Your document text is stored there until it is deleted after your review (see Section 4), and your reports, account and billing records for as long as Section 8 says.
Both act only on our instructions, under a data processing agreement, and neither uses your data for anything else.
Everything else (does not receive your document text)
Supabase (Frankfurt, Germany): authentication and session management. Holds your email address and login credentials.
Resend: sends account emails, such as sign-up confirmation and password reset. Receives your email address.
mailbox.org: our support email provider. Holds the emails you send to us.
Stripe: payment processing. Holds your payment details and billing history. We never see or store your card number.
Sentry (Functional Software, Inc.; we use its EU region, so this data is stored in the EU): error monitoring. When something goes wrong on our servers, Sentry receives technical error data only: what kind of error it was, where in our code it happened and when, and internal reference numbers such as the ID of a review or an account. It never receives your document text, your reviews, or anything sent to or received from the AI providers. Our servers don't send it your IP address, the contents of your requests, or other personal details.
We will tell you before we add a new sub-processor or replace an existing one, so that you have the opportunity to object.
6. Sending data outside the EU
All three AI providers are based in the United States, so your document text leaves the European Economic Area every time you run a review. There is no version of this service where that doesn't happen.
Transfers to these providers are covered by Standard Contractual Clauses in each provider's data processing agreement.
Stripe, which processes your payments, is also a US company. Transfers to Stripe are covered by Standard Contractual Clauses in Stripe's data processing agreement.
Sentry is run by a US company (Functional Software, Inc.). We use its EU region, so error data is stored in the EU, but the company may be able to access it from the US. Any such access is covered by the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a backup, under Sentry's data processing agreement. That data is technical error data only, never your document text (see Section 5).
7. Why we're allowed to process your data
Under the GDPR we need a lawful basis for each thing we do:
| What | Basis |
|---|---|
| Running a review you asked for | Performance of a contract |
| Holding your account and credits | Performance of a contract |
| Taking payment | Performance of a contract |
| Keeping billing and tax records | Legal obligation |
| Keeping anonymised technical usage records | Legitimate interests: understanding and controlling our own costs |
| Security logging | Legitimate interests: keeping the service working and unabused |
You can object to anything we do on the basis of legitimate interests. Section 9 explains how.
8. How long we keep things
| Data | Kept for |
|---|---|
| Extracted document text, uploaded file and working files | Deleted within minutes of the review finishing, whether it succeeds or fails |
| Review reports | Until you delete them or close your account |
| Private review reports | 1 hour after first opened, or 24 hours after the review finishes if never opened |
| Account data | Until you close your account |
| Credit and transaction records | Until you close your account |
| Access logs (including IP addresses) | 30 days |
| Database backups | 7 days. A deleted document, report or record can remain in a backup until it expires (see Section 4) |
| Invoices and purchase records | 11 years, as required by Croatian accounting law. Kept after you close your account, without any link to your reviews |
| Anonymised usage records | Indefinitely (see below) |
Anonymised usage records. When you close your account we keep the technical records of how many tokens each AI model call used, with all links to you and to your documents removed. These records contain no document text, no account identifier and nothing that could identify you. We keep them because they are how we understand what the service costs to run. This is the same reasoning under which we retain invoices.
9. Your rights
If you're in the EU or EEA, you have the right to:
- Get a copy of the personal data we hold about you
- Correct anything that's wrong
- Delete your account and the data attached to it
- Object to processing we do on the basis of legitimate interests
- Take your data elsewhere in a machine-readable format
- Restrict how we use your data while a dispute is being resolved
You can delete your account yourself from your account settings. Doing so removes your reviews, your reports, your credit history and your login. Invoices and anonymised usage records are retained as described above. After account deletion, Stripe keeps the name, email and invoices linked to your payments, because the law requires it.
For anything else, email privacy@vettena.com. We'll respond within one month.
If you think we've handled your data badly, you can complain to the Croatian Personal Data Protection Agency (AZOP) at azop.hr, or to the supervisory authority where you live.
10. Cookies
We use a small number of cookies, none of them for advertising or tracking:
- A session cookie, so you stay signed in
- A preference cookie recording whether you've collapsed the sidebar
Your light or dark theme choice is saved in your browser's local storage, not in a cookie. It never leaves your device.
That's it. There's nothing here to consent to, and no third party is watching you on our site.
11. Security
Documents are transmitted over encrypted connections. Vettena is run by one person, who has technical access to its systems. We don't open your documents or review results unless you ask us to, or to fix a problem you've reported. Reviews are isolated per account; a query for someone else's review returns nothing rather than a permission error.
Our system logs never contain text from your documents.
No system is perfectly secure. If a breach affects your personal data we will tell you and the supervisory authority as the GDPR requires.
12. Children
This service is not for anyone under 18. We don't knowingly collect data from children, and we'd delete it if we found we had.
13. Changes to this policy
If we change something material (a new sub-processor, a different retention period, a new purpose), we'll email you before it takes effect. Smaller corrections will be reflected here with an updated date at the top.
14. Contact
VII INITIUM j.d.o.o. za usluge, Brezovička cesta 38, 10000 Zagreb, Croatia