Privacy Policy

Tactical Edge AI LLC operates Vectory. This policy covers personal information we process through vectoryai.com, the hosted application at app.vectoryai.com, related APIs, private evaluation engagements, and communications with our team.

We determine how account, website, and business-contact information is used to operate Vectory. When an organization supplies evaluation content for us to process on its behalf, that organization directs the processing under its service agreement. Its own privacy notices also apply to people whose information appears in that content.

Local and self-hosted deployments are described below. This policy does not govern independent websites or model providers simply because you reach them through a link or integration.

• Account and identity information: account identifiers, name, email address, sign-in provider information, organization or project membership, and access permissions supplied when you sign in or join a workspace.
• Evaluation content: datasets, prompts, model responses, reference answers, retrieved documents, agent traces, tool inputs and outputs, rubric settings, scores, human reviews, corrections, and dataset releases you upload, connect, or create. These can contain personal information if you include it.
• Contact and support information: your name, email, company, message, and any attachments or diagnostics you choose to send. Our website contact form also sends the page URL, browser user agent, and submission timing to route requests and prevent abuse.
• Service records: access times, IP addresses, browser and device information, authentication events, job status, errors, permission changes, and other operational or security logs.
• Commercial information: order details, billing contacts, invoices, and payment status when you purchase services. Payment information is handled through the payment method specified for your engagement.
• Website preferences and engagement: theme and cookie choices stored in your browser, plus page, referral, device, session, and account-level engagement information when you enable optional tracking.

When you choose Sign in with Google, Vectory requests basic identity access: OpenID, email, and profile. This can provide your Google account identifier, email address and verification status, name, and profile image, depending on the information Google returns. We do not receive your Google password. This sign-in access does not grant access to Gmail messages, Drive files, Calendar events, or contacts.

We use identity information to authenticate you, associate you with your Vectory account and workspace permissions, maintain your session, and protect access. Identity records are processed by our authentication service and retained with account records; session information may also be stored in your browser. Our hosted sign-in uses Amazon Cognito.

Google sign-in data is not an evaluation dataset. We do not use it for model training, advertising, or sale to data brokers. Access is limited to service providers supporting authentication and hosting, authorized personnel handling support or security when needed, and disclosures required by law.

Vectory’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements where applicable. We will disclose and request permission for any additional Google access before using it.

You can remove Vectory’s connection in your Google Account connections. Removing it prevents further access through that authorization but does not automatically delete your Vectory account or previously stored records. To request deletion, use the process in the retention and rights sections below. See Google’s instructions for managing connections.

• Provide sign-in, project access, trace import, evaluation jobs, human review, and requested exports.
• Associate results, data-use permissions, and review history with the appropriate project and user.
• Answer inquiries, deliver agreed evaluation work, administer orders, and send service or security messages.
• Investigate faults and abuse, secure accounts, and maintain the website and hosted service.
• Understand website engagement and support business follow-up according to your optional tracking choices.
• Meet legal obligations, preserve necessary business records, and resolve disputes.

Hosted evaluation content is processed to perform the tasks you or your organization request. The persistent workspace stores project records, imported traces, reviews, permissions, and job results in a database; dataset release files are stored in object storage. Authorized project participants can access content according to their assigned roles.

Remote model calls send the selected prompts, responses, context, or rubric to the configured model provider. The Training Workspace requires explicit provider-processing consent for model judgments. Other evaluation screens use the provider configuration you select. Review the provider’s data terms and settings before sending confidential or personal information.

Training Workspace records begin with evaluation-only permission. A project owner must authorize training use before eligible records can be included in a training dataset release. Creating a release prepares data for the organization’s training workflow; it does not itself train a model. We do not treat a Google sign-in or an evaluation upload as permission to train general-purpose models on that information.

Revoking a record’s permission blocks future authorized use and release downloads within the workspace. It cannot retrieve a file already downloaded or remove the influence of data from a model trained elsewhere. Minimize personal information and redact secrets before import; automated evaluation is not a guarantee that sensitive information has been removed.

The open-source Vectory application can run on infrastructure you control without a Vectory hosted account. Files and results in that deployment are managed by you or its operator. They are not submitted to our hosted workspace merely because you installed the software.

A remote model, trace source, package download, or other external connection can still send information outside your environment. Your configuration and those providers’ policies determine that processing. If you send us local data or logs for support, we handle that submission under this policy. For deletion from an independently operated deployment, contact its administrator.

Browser storage remembers theme and consent choices. Authentication and other necessary service storage support sign-in and security. Optional analytics and marketing choices start disabled on this website and can be changed in Cookie Preferences.

When you allow marketing, the website loads Prospectory to measure visitor and account engagement for sales and marketing follow-up. It may process page URLs, referral information, browser and device details, session identifiers, and associated business-account signals. It stops loading when you revoke marketing consent or enable the sale-or-sharing opt-out.

We do not sell personal information for money. Optional marketing disclosures can be treated as sale or sharing under some privacy laws. Use Do Not Sell or Share My Personal Information to disable optional analytics and marketing tracking in this browser. These website choices do not authorize advertising uses of your Google sign-in data or private evaluation content.

Preferences are stored per browser, so set them again if you use another browser or clear storage. Revoking consent stops future optional tracking; it does not erase information already collected. Contact us to request deletion. More information is in the Cookie Policy.

• Hosting and operations: providers supporting infrastructure, authentication, storage, communications, and service administration, including Amazon Web Services for the hosted workspace.
• Selected integrations: model providers or connected systems receive the information needed for the operation you authorize.
• Your organization: administrators and collaborators receive the records their permissions allow them to access. An export recipient controls its own copy.
• Optional website marketing: Prospectory receives website engagement information when you grant marketing consent, as described above.
• Legal and business needs: disclosures required by law, necessary to investigate abuse or protect rights, or part of a business transfer subject to applicable privacy obligations.

Providers processing information for us are limited to the purposes of their engagement. Google user data remains subject to the restrictions in the Google sign-in section, including any consent required for a business transfer. We do not make private evaluation content public simply because it is uploaded.

Where European or UK data protection law applies, we rely on contract performance for requested services; legitimate interests for security, service administration, and responding to business inquiries where those interests do not override your rights; consent for optional tracking and other processing that requires it; and legal obligations for required records or disclosures.

You may withdraw consent for future processing. This does not affect processing already lawfully performed. When we process customer-provided content on an organization’s behalf, that organization is responsible for its lawful basis and instructions.

We retain account and sign-in records while needed to provide access and administer the account. Hosted project data remains available according to the engagement and applicable data permissions. Contact and support records are kept for follow-up and service history; operational records are kept for maintenance and security. Accounting, dispute, and legally required records may need longer retention.

Retention depends on the purpose, deployment, agreement, and legal requirements. The hosted workspace does not promise automatic deletion after a fixed number of days. Backups and audit records may remain after active records are removed where needed for recovery, security, or legal obligations, with access restricted accordingly.

To request account closure or deletion of personal information, contact Vectory, identify the account email and relevant workspace, and state what you want removed. Do not send passwords, tokens, or full datasets with the request. We will verify your authority, explain any records we must retain, and process the request within the period required by applicable law. Organization-controlled content may require coordination with its administrator.

Signing out, removing a Google connection, deleting a local copy, and revoking training permission are distinct actions; none by itself deletes all hosted records. We cannot delete copies held independently by your organization or an export recipient.

We use administrative and technical safeguards appropriate to the information handled, including authenticated workspace access, project permissions, encrypted network connections, and restricted operational access. No service or transmission method can eliminate all security risks. Protect your credentials and tell us promptly about suspected unauthorized access.

Our hosted services use infrastructure in the United States. Information may also be processed where an authorized provider operates. Where law requires safeguards for an international transfer, those safeguards must be established for the engagement, such as an applicable adequacy decision or contractual protections. Contact us about the locations and transfer arrangements relevant to your deployment before submitting data subject to residency restrictions.

Depending on your location and the law that applies, you may request access to personal information, correction, deletion, a portable copy, restriction of processing, or an explanation of disclosures. You may also object to certain processing, withdraw consent, and complain to your local data protection authority.

California and other US state residents may have rights to know the categories and specific information collected, opt out of sale, sharing, or targeted advertising, and limit certain uses of sensitive information. The categories, sources, purposes, and recipients are described above. We do not require sensitive personal information for website inquiries or basic sign-in. We will not penalize you for exercising applicable privacy rights.

Submit a request using the contact details below. We may need information to verify your identity or an authorized agent’s authority. If we decline a request, you may ask us to review the decision and, where applicable, appeal it using the same contact method. For personal information inside an organization’s evaluation data, contact that organization; we assist with requests according to its instructions and applicable law.

Vectory is intended for adult business and technical users, not children. Do not create an account if you are under 18. If you believe a child has provided personal information to us, contact us so we can investigate and address it.

We will update this page and its date when our practices change. Material changes will be communicated through the website, application, or available account contact details as appropriate. New uses that require consent will be presented before that processing begins.

For privacy questions, access requests, corrections, or deletion, use the Vectory contact form and begin your message with “Privacy request.” Include an email where we can reply and enough context to locate the relevant account or records.

You may also send a Vectory privacy or legal request to Tactical Edge AI LLC at legal@tacticaledgeai.com. Specify Vectory so the request reaches the appropriate team.