Vaitu(“Vaitu”, “we”, “us”) operates the Vaitu local business discovery platform at https://vaitu.vercel.app. We are the data controller for the personal data described in this policy. For any privacy question or to exercise your rights, contact us at privacy@vaitu.app.

We collect the following categories of personal data:

• Account data — your email address and password (stored hashed) when you create an account, and your role (user or business).
• Business data — for business accounts, the listing details you provide, verification status, and contact channels including phone numbers.
• Communications — messages you send and receive through our portal, email, and chat relay, including the content of those messages.
• AI assistant input — the queries and conversation content you submit to the in-app assistant.
• Payment data — for business verification we use Stripe; we receive subscription and payment status but never store full card details.
• Usage and device data — pages visited, performance metrics, approximate location for map results, and diagnostic data when errors occur.

• To operate the discovery map, AI assistant, and messaging features.
• To verify businesses and process verification subscription payments.
• To deliver email and connect you with businesses you choose to contact.
• To secure the service, prevent abuse, and diagnose errors.
• To understand aggregate usage and improve the product.

Where the EU/UK GDPR applies, we rely on: contract (to provide the service you request), legitimate interests (security, fraud prevention, and product improvement), consent (where required, e.g. non-essential cookies), and legal obligation (e.g. tax and accounting for payments).

We share data with the following processors only as needed to run the service. Each is bound by data-processing terms:

• Convex — Application database and backend functions.
• Vercel — Application hosting, traffic analytics, and performance metrics.
• Sentry — Error and crash diagnostics.
• Stripe — Payment processing for business verification subscriptions.
• Twilio — Phone number provisioning and messaging for business contact.
• Brevo — Transactional and contact email delivery.
• OpenRouter — AI model routing for the assistant.
• Google — Places data, photos, and map tiles for business discovery.

Some providers process data outside your country, including the United States. Where data leaves the EU/UK, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

We keep account and business data for as long as your account is active, and communications for as long as needed to provide the service and resolve disputes. Payment records are kept as required by law. When data is no longer needed, we delete or anonymise it.

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing or withdraw consent. To exercise any right, email privacy@vaitu.app. You also have the right to lodge a complaint with your local data protection authority.

We use cookies and similar technologies that are strictly necessary to run the service (for example, to keep you signed in) and, where you allow it, to measure aggregate usage and performance. You can control non-essential cookies through your browser settings.

Vaitu is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact privacy@vaitu.app.

We may update this policy from time to time. Material changes will be reflected by the date above, and where required we will notify you.

Vaitu, Lisbon, Portugal. Privacy enquiries: privacy@vaitu.app.