Privacy Policy
Vesta is an event-planner co-pilot that drafts venue enquiry and outreach emails from WhatsApp messages. This policy explains what we collect, how we use it, who we share it with, and the choices you have. Vesta is operated by Fleapo ("we", "us"). Questions? Email [email protected].
1. What we collect
We only collect what we need to draft your emails:
- Account details: the name, email address, and Fleapo Marketplace identifier you sign in with.
- WhatsApp messages you send Vesta: the message body, your phone number, and Meta's message identifiers. We do not access any other messages on your phone or in your WhatsApp account.
- Your venue directory and client list: the names, email addresses, and notes you add to Vesta.
- Your email templates: the subject and body templates you configure for enquiry and outreach drafts.
- Gmail OAuth tokens: the access and refresh tokens Google issues when you connect your Gmail. These are stored encrypted at rest and used only to create drafts in your Drafts folder via Gmail's Drafts API.
- Processing logs: the message we processed, the fields we extracted, the venue or recipient we matched, and the Gmail draft we created. Used to power the in-app log and to debug failures.
2. What we do NOT collect or do
- We do not send emails on your behalf. Vesta only saves drafts — you review and send them yourself from Gmail.
- We do not read your existing Gmail inbox, sent mail, or other drafts.
- We do not read WhatsApp messages you did not explicitly send to the Vesta bot.
- We do not sell, rent, or share your data with advertisers.
- We do not train AI models on your data.
3. How we use your information
- Run the Vesta service: extract enquiry fields, match the venue or recipient, render your template, and save a draft in your Gmail.
- Authenticate you via the Fleapo Marketplace.
- Bill and meter usage against your subscription plan.
- Debug failures and improve service reliability.
- Send transactional communications about your account.
4. Third parties we share data with
We use a small number of processors, each only for the purpose listed:
- Google (Gmail API): when you connect your Gmail, Vesta uses Google's Gmail API to save drafts. Your use of Gmail data complies with Google API Services User Data Policy, including the Limited Use requirements. Vesta requests only the
gmail.composescope. - Meta (WhatsApp Cloud API): WhatsApp messages you send the Vesta bot pass through Meta's WhatsApp Cloud API. Meta's handling is governed by their own privacy policy.
- Anthropic (via Fleapo Mesh): the text of your messages is sent to Anthropic's Claude model to extract structured fields. Anthropic does not train on this data under our zero-data-retention configuration.
- Amazon Web Services: our servers and database run on AWS in ap-south-1.
- MongoDB Atlas: stores your account, directory, templates, and event logs.
We do not share data with any other third parties unless legally required.
5. Data retention
- Account, directory, and template data persist until you delete them or close your account.
- Processing logs are retained for 90 days, then deleted automatically.
- Gmail OAuth tokens are deleted immediately when you disconnect Gmail or close your account.
- Backups are retained for 30 days and then overwritten.
6. Your rights and choices
- Disconnect Gmail from your Vesta dashboard at any time (Settings → Disconnect).
- Delete venues or clients from your directories at any time.
- Request full account deletion — see our Data Deletion Instructions.
- Request a copy of the data we hold about you by emailing [email protected].
Depending on where you live (EU, UK, California), you may have additional rights under GDPR, UK GDPR, or CCPA. Email us to exercise them; we respond within 30 days.
7. Security
We protect your data with industry-standard practices: TLS in transit, encryption at rest, least-privilege access controls, and AWS Secrets Manager for credential storage. No system is perfectly secure; we will notify affected users if we ever detect unauthorized access.
8. International transfers
Vesta processes data in AWS ap-south-1 (Mumbai, India). If you access Vesta from outside India, your data will be transferred to and processed in India. We rely on Standard Contractual Clauses where required for transfers from the EEA, UK, or Switzerland.
9. Children
Vesta is a business tool not intended for anyone under 18. We do not knowingly collect data from children.
10. Changes to this policy
We may update this policy from time to time. Material changes will be announced via in-app notice or email at least 14 days before they take effect.
11. Contact
For any privacy question or request, email [email protected].