Privacy Policy

When you visit the Site or apply to our waitlist, we collect:

• Contact and identity information: full name, work email address, and company name.
• Professional details: role, product URL, prototype platform, and current lead stage.
• Project information: primary blockers, desired start window, budget range, commercial deadlines, and messages or descriptions you provide.
• Technical and marketing data: landing and referring page URLs, UTM parameters, interaction and availability events, and security data associated with rate limiting and bot detection. We hash IP addresses with versioned salts rather than retaining them in raw form for rate limiting.
• Consent records: acceptance of the Privacy Policy and your marketing preference.
• Anti-bot data: Cloudflare Turnstile tokens and related device or interaction signals used to distinguish people from automated traffic.

Please do not submit sensitive personal information through free-text fields.

When you use the production readiness check on the Site, we collect answers you provide in the intake questionnaire, redacted paste text from diagnostic report paste-back, a parsed report derived from that paste (or from the manual fallback questionnaire), and contact information (name, email, and optional company) when you unlock scored results.

Redaction of credential-shaped secrets happens before storage: high-confidence secret patterns are blocked in the browser when possible and replaced with [REDACTED] on the server before any paste is persisted. We do not intentionally store unredacted secrets from readiness pastes.

We intend to retain raw redacted pastes for up to 90 days after collection, then delete or de-identify them. In v1 the automated purge job may be a documented stub; retention intent and the retention_expires_at field still apply, and we will enforce purge when the scheduled job is wired.

We collect information directly from you, automatically from your browser or device when you use the Site, and from the service providers identified below when they operate the Site on our behalf. We may also receive a referring URL and campaign parameters from the page or link that directed you to us.

We use personal information to:

• evaluate and respond to waitlist applications and service inquiries;
• send transactional messages about waitlist status;
• send marketing communications when you have opted in, which you may stop using the unsubscribe link in the message;
• understand Site use, measure demand, and improve the Site and our offerings;
• prevent fraud, spam, bot submissions, and other abuse;
• maintain, troubleshoot, and secure our systems; and
• comply with law and establish, exercise, or defend legal claims.

Where a law requires a legal basis, we process information as needed for our legitimate interests in operating, securing, and improving the Site and responding to inquiries; with your consent for optional marketing; to take steps at your request before entering a contract; and to comply with legal obligations. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

Cloudflare Turnstile may use necessary cookies, tokens, and device or interaction signals to protect the waitlist form from automated abuse. We also record Site interaction and availability events to understand application flow and demand. These analytics events do not include your name, email address, phone number, or free-text messages. We do not use advertising cookies or cross-site behavioral advertising on the Site.

Browser controls may allow you to block or delete cookies, but blocking necessary technologies can prevent the waitlist form from working.

We do not use personal information submitted through the waitlist to train artificial-intelligence models or make decisions that produce legal or similarly significant effects about you. If our practices change, we will update this policy before applying the new practice as required by law.

We disclose personal information to vendors that process it on our behalf to operate the Site:

• Resend delivers transactional and opted-in marketing email.
• Cloudflare provides Turnstile bot protection and security.
• Vercel hosts the marketing Site.
• Railway hosts the backend API, PostgreSQL database, and Redis cache.

We may also disclose information when required by law; to protect rights, safety, and security; in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets; or at your direction. We do not sell personal information or share it for cross-context behavioral advertising.

We retain waitlist and inquiry information while evaluating your application and for up to 24 months after our last substantive interaction with you, unless a longer period is needed for an active business relationship, legal compliance, dispute resolution, or enforcement of agreements. We retain marketing-consent records until you withdraw consent and for a reasonable period afterward to honor and document your choice. Security and analytics records are retained only as long as reasonably necessary for security, troubleshooting, and aggregate analysis. For readiness raw redacted pastes, our retention intent is 90 days (see Readiness Check Data Flow). We delete or de-identify information when the applicable retention period ends.

We use administrative, technical, and organizational safeguards appropriate to the nature of the information, including HTTPS encryption in transit, access controls, environment separation, secrets scanning, rate limiting, bot protection, and hashed IP identifiers for rate limiting. Our hosting providers manage infrastructure-level protections, including storage security. No transmission or storage system is completely secure, and we cannot guarantee absolute security.

We and our service providers may process information in the United States and other countries where they operate. Those countries may have different data-protection laws from your country. Where required, we use recognized transfer safeguards, such as contractual protections, and take steps designed to protect information consistently with this policy.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; object to or restrict certain processing; withdraw consent; or appeal our response. You may also opt out of marketing at any time.

To exercise a right, email hello [at] vygo.ai and describe your request. We may ask for information reasonably necessary to verify your identity and authority. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right. You may also complain to your local data-protection authority.

The Site is intended for people age 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information, contact us at hello [at] vygo.ai so we can delete it.

We may update this Privacy Policy by posting the revised version on the Site and changing the effective date. If a change is material, we will provide additional notice when required by law.

For questions, privacy requests, or notices concerning this Privacy Policy, contact VYGO LLC at hello [at] vygo.ai. Notices are effective when received.