Vega privacy policy

1. Who we are

Vega is provided by Zumy Labs Limited, Dublin, Ireland (“Zumy”, “we”, “us”). Zumy Labs Limited is being incorporated in Ireland; until registration is complete, Zumy is run by its founder, who is responsible for these commitments, and the company takes them over once it is registered. We decide how and why your information is used (we are the “controller”). Contact us about privacy at hello@zumy.ai.

2. What we collect

• Account: your name, email address, password (stored only as a salted hash) and preferred language. If you sign in with Google, Microsoft, Apple, GitHub, X, Facebook or your company's single sign-on, we receive your name, email address and an account ID from that service. With Sign in with Apple and a hidden email, we only see Apple's relay address. If you set up passkeys or two-step verification, we store the public key or an encrypted secret and hashed recovery codes.
• Sign-in sessions: a hash of the session token, the device and browser type, the country (two-letter code) of the IP address you signed in from, and when the session was last used. Sessions end after 30 days without use, and after 90 days at most.
• Workspaces: the workspaces you create or join, their members and roles, and workspace settings.
• Your work: the goals and messages you give Vega, the plans it makes, the steps it takes, the files you upload and the files, slides, documents, images, audio, video and websites it creates.
• Connected services: when you connect another service (for example Gmail, Google Drive, Slack or GitHub), the access token it gives us, and the content Vega reads from it while doing a task you started. See Connected services.
• Purchases: your plan, credit balance and usage, and a record of each payment from Stripe. Stripe handles your card; we never see the full card number.
• Usage records: for each AI request, the model used, the number of tokens, the cost and how long it took, so we can bill credits and keep the service reliable. These records do not contain your prompts.
• Messages from channels you link: if you link Vega to email, SMS, WhatsApp, Telegram, LINE or a website chat widget, the messages sent to it through those channels.

We do not collect your precise location, contacts or photos. Vega has no advertising or analytics trackers, and no third-party crash-reporting tool.

3. How we use it

• To run Vega: plan and do the tasks you ask for, store your work and show it on all your devices.
• To act for you in connected services, only for tasks you start and within the permissions you give (see Actions).
• To keep accounts secure, limit abuse (we use your IP address for rate limiting) and fix problems.
• To bill your plan and count credits.
• To send you account emails: verification, sign-in codes, security alerts, receipts and important changes. We send product news only if you agree.
• To meet legal obligations, such as keeping tax records.

4. AI processing

Vega sends your request, the relevant parts of your task (including files and content from connected services that the task uses) and the conversation so far to an AI model provider, which returns the answer or the next step. Depending on the model chosen for your workspace, the provider is Anthropic, OpenAI or Google; images are made with OpenAI or Google, speech with OpenAI or ElevenLabs, and video with Higgsfield.

These providers process the data only to return a result to us, under terms that do not allow them to train their models on it. We do not use your content, or anything from your connected services, to train AI models. Workspace settings include a training opt-in that is off by default; Vega has no training use for it today, and we will ask you clearly before that ever changes.

5. Connected services

You choose which services to connect, and you can disconnect any of them at any time in Vega's Connectors settings. When you disconnect, we ask the service to revoke Vega's access and delete our copy of the access token (if the service cannot be reached, we delete the token and retry the revoke later).

• Tokens are encrypted with AES-256 before they are stored, and are used only by Vega's servers.
• Content that Vega reads from a connected service during a task (for example an email, a calendar event or a file) is stored with that task so you can see what Vega used, and is sent to the AI model doing the task. It is deleted when you delete the task or your account, or earlier if your workspace sets a retention period.
• Shared tasks never include content from connected services: when you share a task by link, tool results and connector content are removed from the shared view.
• Vega only uses what the permissions you approve allow. For example, Gmail access is read-only unless you also allow Vega to create drafts and send email.

Google user data

Vega's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail, Google Calendar, Google Drive and other Google data only to provide the features you use in Vega: reading, summarising, searching and acting on that data in the tasks you start.
• We transfer it only to the AI model providers listed above, to answer your task, and as needed for security or to comply with the law.
• We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalised AI or machine-learning models.
• No person at Zumy Labs Limited reads it, unless you ask us to (for example in a support request), it is needed for security or abuse investigation, or the law requires it.

6. Actions and approvals

Before Vega does something with consequences, such as sending a message, publishing, pushing code or changing data in another service, it asks you: refuse, allow once, or always allow that kind of action. Payments are asked about every time and can never be pre-approved. A request you do not answer within 30 minutes is refused. We keep a record of what you approved.

If you turn on Vega's own phone number or email inbox, messages it sends come from a number or address we provide, using Twilio for phone and SMS and Amazon SES for email.

7. Links you share and websites you publish

A task or file you share by link can be opened by anyone with the link until you turn sharing off or the link expires. You choose whether a shared task includes the transcript and files. A website you publish with Vega's website builder is public at its zumy.app address until you unpublish it.

8. Who we share it with

We share information only with the service providers below, who process it on our instructions and under contracts that require them to protect it, and only as much as each needs.

We may also share information if the law requires it, to protect someone's safety, or with a new owner if Zumy is reorganised or acquired, who must keep the promises in this policy.

9. Legal bases (EU, UK and similar laws)

Where the law asks us to name a reason for each use of your information, these are ours:

• Contract: running Vega, your tasks, connected services and your plan
• Legitimate interests: security, abuse prevention, rate limiting and fixing problems
• Consent: connecting a service, optional emails, and anything else we ask your permission for (you can withdraw it at any time)
• Legal obligation: tax and accounting records

10. How long we keep it

• Your work (tasks, files, creations) is kept until you delete it or your account. A workspace admin can set a retention period for content from connected services.
• Sign-in sessions end after 30 days without use, 90 days at most.
• Deleting your account: you can do it in Settings → Account or on our delete account page. Deletion is scheduled 7 days later, in case you change your mind; signing in again within those 7 days cancels it. Then your profile, tasks, messages, files, connections and personal workspace are deleted. Workspaces you share with other people stay with them.
• Kept after deletion: credit and billing records and the security audit log, which no longer identify you once your account is deleted, and purchase records as long as tax law requires (usually up to 7 years). Backups are overwritten within 30 days.

11. Security

Information is encrypted in transit (HTTPS/TLS) and at rest. Passwords are stored only as salted hashes. Access inside Zumy is limited to the people who need it to run Vega. Access tokens for connected services are encrypted separately with AES-256. No system is perfectly secure; if a breach affects your information, we will tell you and the relevant authorities as the law requires.

12. Where your information is stored

Vega's servers run on Amazon Web Services in Ireland (EU). Some providers listed above process data in the United States or other countries. When information leaves the EU or UK, we rely on the European Commission's standard contractual clauses, the UK addendum, or the EU-US Data Privacy Framework where the provider is certified.

13. Children

Vega is not meant for children. You must be at least 18 to use it. If you believe a child has given us personal information, write to hello@zumy.ai and we will delete it.

14. Cookies and local storage

Vega's website uses one cookie, vega_session, to keep you signed in (90 days). Your browser's local storage keeps your selected workspace, language, model and view settings on your device. There are no advertising or analytics cookies.

15. Your rights and choices

Wherever you live, you can ask us to:

• show you the information we hold about you, or give you a copy in a portable format;
• correct it, or delete it;
• stop or limit a particular use, or object to it;
• withdraw a consent you gave, at any time.

To get a copy of your data, write to hello@zumy.ai; until a self-service export is available in Vega, we prepare it for you within 30 days.

Write to hello@zumy.ai from the email address on your account, or delete your account. We answer within 30 days and never charge for it. If you are in the EU, UK or another place with a data protection authority, you can also complain to that authority. California residents have the same rights under the CCPA/CPRA; we do not sell or “share” personal information as those laws define it.

16. Changes to this policy

If we change this policy we update the date at the top. If a change is significant, we tell you in Vega or by email before it takes effect.

17. Contact

hello@zumy.ai. Please say that your question is about Vega.