Privacy Policy

1. Who we are

Vincentt ("Vincentt", "we", "us") provides the tools, hosting, and account services available at vincentt.studio and its subdomains, together with projects published to vincentt.app. For the purposes of the UK GDPR and EU GDPR, Vincentt is the data controller for the account information described in this policy.

For privacy questions, contact us at hello@vincentt.studio.

2. Information we collect

We collect a deliberately small amount of information. There are three sources.

Information you give us

Data	Why we hold it
Email address	It identifies your account, is how you sign in, and is how we send invites, password resets, and security notices.
Display name	Shown to you and to other members of any organization you join.
Password	Only if you choose password sign-in. We never store the password itself, only an `argon2id` hash of it.
Avatar URL	Optional. Only if you supply one. We do not import a photo from Google.
Theme preference	Remembers whether you prefer the light, dark, or system interface.
Organization and project names	The content you create. Project names include the address your project is published at.

Information created by using the service

Session and access tokens. When you sign in we store a hashed session record and set a secure, HttpOnly cookie. If you use our command line tools, we store a hashed personal access token. We never store the token values themselves, only hashes of them.
Organization membership. Which organizations you belong to and your role in each.
Invitations. If you invite someone, we store the email address you entered, who sent the invitation, and when. This means we may briefly hold the email address of a person who has no account with us. Invitations expire and are automatically deleted after 72 hours.
Service logs. We log the fact that a request happened: a random request identifier, the route, the response status, and where applicable the account, organization, or project identifier involved. Email addresses appearing in logs are masked (for example a***@example.com).

Information used only in memory

We derive your IP address from incoming requests and use it solely as a rate-limiting key, to prevent brute-force sign-in attempts and abuse. It is held in server memory, is never written to our database or to a log line, and is discarded when the service restarts.

3. What we do not collect

This section is as important as the one above. We do not:

use advertising or behavioural tracking services of any kind, or any analytics other than the website analytics described in section 4, which runs only if you agree;
set advertising cookies. Apart from website analytics cookies you have agreed to, the only cookies we set are the ones needed to keep you signed in and to complete a sign-in flow securely;
store your IP address or browser user-agent in our database or logs;
receive or store your card details. When you pay, you enter them on Stripe's checkout page and they go to Stripe, never to Vincentt;
collect phone, address, or date-of-birth information;
sell or rent your personal information to anyone, for any purpose;
use your personal information or your project content to train machine learning models.

On cookies. Our website at vincentt.studio asks before setting any analytics cookies, through a cookie banner (see section 4). The cookies that keep you signed in are strictly necessary for the service to function and cannot be turned off while signed in.

4. Analytics on our website

This section covers our website at vincentt.studio: the pages that describe Vincentt, our pricing, and our blog. We want to know which pages are useful and how people find us, for example whether they came from a search engine, a social media post, or an AI assistant. For that we use Google Analytics, provided by Google, and only if you agree.

It does not apply to published camera experiences. As described in section 8, camera feeds are processed on the visitor's own device and Vincentt does not receive, store, or transmit camera imagery.

Your choice

Category	What it does	Can you turn it off?
Necessary	Remembers your cookie choice and your light or dark theme, stored in your browser	No. The website needs it to respect your choice
Analytics	Google Analytics, described below	Yes. It is off unless you choose it

"Accept all" and "Reject all" are equally easy to choose. If you reject analytics, Google Analytics is not loaded and nothing is sent to Google. You can change your choice at any time through Cookie settings in the footer of our website. If you withdraw consent, we stop Google Analytics straight away and delete its cookies from your browser.

What Google Analytics collects, if you agree

the pages you view and how long you spend on them;
which buttons you use, such as "Create an experience", "Free to Join", or choosing a plan on our pricing page;
where your visit came from, such as the referring website or campaign tags in the link you followed;
general device information: browser, operating system, screen size, and language;
your approximate location (country and city), which Google estimates from your IP address. Google does not store the IP address itself in Analytics.

It sets two cookies, _ga and _ga_<ID>, which last up to two years and let Google Analytics recognise a returning browser.

What we do not do with it

We do not use Google Analytics for advertising, and we have not enabled Google's advertising features or Google signals. We do not combine website analytics with your account details. We see reports and totals, not a record of you as a named person.

Legal basis, retention, and transfers

Legal basis: your consent, which you can withdraw at any time as described above.
Retention: Google keeps website analytics data for 14 months, then deletes it automatically. Your cookie choice stays in your browser until you change it or clear your browser data.
Transfers: Google may process analytics data in the United States. Google is certified under the EU-US Data Privacy Framework and its UK Extension, which provides the safeguards for those transfers.

5. Signing in with Google

If you choose to sign in with Google, we ask Google for three standard scopes: openid, email, and profile. These are Google's basic sign-in scopes. We do not request access to your Gmail, Drive, Calendar, Contacts, or any other Google service, and we could not access them if we tried.

From the identity token Google returns, we keep only:

your Google account identifier, so we can recognise you on your next sign-in;
your email address;
your name;
whether Google has verified your email address.

We do not store your Google profile photo, and we never receive or store a Google access token or refresh token. The identity token is verified at sign-in and discarded. You can disconnect Google from your Vincentt account at any time in your account settings, provided you have another way to sign in.

Vincentt's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use your information

We use the information described above only to:

create and operate your account and keep you signed in;
let you create organizations, invite collaborators, and manage projects;
publish your projects and serve them to the people you share them with;
send you service email: invitations, password resets, and notices when your password changes. We do not send marketing email to accounts;
take payment for plans and traffic packs through Stripe;
if you accept analytics, measure how many visitors sign up and choose a plan (see section 4);
protect the service against abuse, brute-force attempts, and fraud;
diagnose faults and keep the platform reliable;
comply with legal obligations.

Where the UK or EU GDPR applies, our lawful bases are performance of a contract (operating the account and service you asked for), legitimate interests (securing the platform and preventing abuse), consent (where you opt in, such as accepting analytics or joining the early-access list), and legal obligation where applicable.

We do not sell your information. We share it only with the service providers needed to run the platform, and only to the extent each one needs:

Provider	Purpose	What it receives
Amazon Web Services	Hosting, storage, database, and content delivery	Your account, organization, and project records, and your published project files
Resend	Sending service email	The recipient address and the message content
Google	Sign in with Google, if you use it	The sign-in request itself. Google necessarily learns you are signing in to Vincentt
Google Analytics	Measuring visits, sign-ups, and plan choices, only if you accept analytics	The steps and identifiers listed in section 4. Never your name, email address, or card details
Stripe	Taking payment for plans and traffic packs	Your card and billing details, which you enter on Stripe's checkout page, and the email address of the account that starts the checkout
Cloudflare	DNS and network protection	Network-level request metadata

Other members of an organization you join can see your name and email address. That is how collaboration works, and it is worth knowing before you accept an invitation.

We may disclose information if legally required to do so, or to protect the rights, safety, or property of Vincentt or others. If Vincentt is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction, and we will give notice before it becomes subject to a different policy.

A note on our email. The HTML emails we send load a web font from Google Fonts. If your mail client displays remote content, this discloses your IP address to Google when you open the message. Most mail clients block remote content by default. We mention it because it is a real data flow and you should know it exists.

8. Projects you publish

When you publish a project, its files are uploaded and served from a public web address, typically yourproject.vincentt.app. Anyone with the address can view a published project. There is no access control on published projects. Do not publish anything you are not comfortable making public, and do not embed personal information or secrets in a project you publish.

You are responsible for the content of your projects, including anything they collect from the people who view them. If your project gathers information from its visitors, you are the controller of that information and you are responsible for telling those visitors about it.

Published projects run in your visitor's browser. Augmented reality features such as camera-based tracking process the camera feed on the visitor's own device. Vincentt does not receive, store, or transmit camera imagery.

9. How long we keep information

Data	Retention
Account record	Kept while your account exists
Sessions	Expire after 30 days at the latest, then deleted automatically
Access tokens	Kept until you revoke or replace them
Pending invitations	72 hours, then deleted automatically
Password reset links	Short-lived and single use, then deleted automatically
Sign-in attempt counters	Kept briefly to rate limit sign-in. We store a hash of the email address, not the address
Project addresses	Retained after a project is deleted, so an address is not silently reassigned to someone else
Service logs	Retained for a limited operational period
Analytics identifiers held for a checkout	Deleted once the payment is sent to Google Analytics, or 72 hours after the checkout if it is never completed
Google Analytics data	14 months, then deleted by Google

Deleting a project or leaving an organization removes the associated records. The published address of a deleted project is retained deliberately, so that a link someone shared previously cannot be taken over by an unrelated project.

10. How we protect information

All traffic is encrypted in transit using TLS.
Passwords are hashed with argon2id using parameters at or above current OWASP guidance. We cannot recover your password, and neither can anyone who obtains our database.
Session and access tokens are stored only as hashes.
Session cookies are HttpOnly, Secure, and SameSite=Lax, so they are not readable by scripts and are not sent from other sites.
State-changing requests are protected against cross-site request forgery.
Sign-in and password-reset endpoints are rate limited.
Access to production systems is limited to those who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator where the law requires it.

11. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal information, to object to processing, and to withdraw consent. Residents of the EEA and UK have these rights under the GDPR. California residents have comparable rights under the CCPA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under the CCPA.

You can act on some of these directly in the product:

update your name, avatar, and theme in account settings;
change your password, or connect and disconnect Google sign-in;
sign out of all devices, which revokes every active session;
cancel a pending invitation you sent;
accept or decline analytics from on vincentt.studio;
delete your projects and organizations.

Account deletion. Vincentt does not yet have a self-service "delete my account" button. Until it does, email hello@vincentt.studio and we will delete your account and associated personal information manually. We will respond within 30 days. We would rather tell you this plainly than imply a button exists.

To make any other request, contact us at hello@vincentt.studio. We may need to verify your identity first. If you are in the EEA or UK and are unhappy with our response, you have the right to complain to your local data protection authority.

12. International transfers

Vincentt operates internationally and our service providers are located in several countries, including the United States. If you access the service from outside the country where our infrastructure is hosted, your information will be transferred across borders. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

If you accept analytics, the data described in section 4 is transferred to Google in the United States. Stripe also processes payment data in the United States. Both transfers rely on the UK and EU transfer safeguards: the EU-US Data Privacy Framework and its UK extension where the provider is certified, and Standard Contractual Clauses otherwise.

13. Children

Vincentt is not directed at children and is not intended for anyone under 13, or under 16 in the EEA and UK. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the product changes. When we do, we will revise the "last updated" date above. For changes that materially affect your rights or how we handle your information, we will give notice by email or in the product before the change takes effect.

15. Contact us

Questions, requests, or complaints about this policy or your personal information: hello@vincentt.studio.