Privacy Policy

Vauda is a digital asset management (DAM) platform that catalogs your material with artificial intelligence and makes it searchable. When it comes to personal data we act in two distinct roles, and the distinction matters:

• As data controller: for your account and billing data (your name, your email, your organization, your plan). This policy covers it.
• As data processor: for the content you upload to your library. That content may include personal data of other people —faces, voices, names in a photo's metadata—. There, you (or your organization) are the controller: we process that material on your instructions and only to provide the service to you.

• Account data: name, email, organization and role, managed through our identity provider.
• Billing data: your plan, credit balance and usage, and your customer identifiers with our payment processor. We do not store your full card number: it is handled directly by our payment processor.
• Content you upload: your files (images, video, audio, documents) and their metadata, together with the catalog the AI generates (descriptions, tags, transcriptions, detected text and search vectors). It may contain personal data of third parties.
• Technical and security data: IP address, device and browser type, and an audit log of relevant actions in your account.
• Cookies and local storage: what we keep in your browser is listed one by one in the “Cookies and local storage” section below.

This is the full list of what Vauda keeps in your browser and why. It is written from what the site actually does, not from what it ought to do: if you find something that is not listed here, that is a mistake on our side and we want to hear about it.

• Session (necessary): “__client_uat” — which may appear with a suffix, for example “__client_uat_a1b2c3” — and “__clerk_environment”, from our identity provider. They keep your session open and secure. They also exist on the public site, because the top menu changes depending on whether you are signed in.
• Language (necessary): “vauda_lang”. It is only written when you pick a language — in the menu selector or by following the language notice — and it exists so we respect that choice instead of deciding it for you on every visit.
• Measuring our own campaigns (Google): on the public site, the Google Ads tag stores “_gcl_au” (cookie) and “_gcl_ls” (local storage). They record whether you arrived from one of our ads and whether you created an account.
• Measuring our own campaigns (Meta): on the public site, the Meta pixel stores “_fbp” (cookie). If you arrive from a Facebook or Instagram ad, it also stores “_fbc”, which holds the identifier for that click. They serve the same purpose: knowing which ad brought you here, whether you clicked the button to create an account, and whether you ended up creating one. Neither advertising tag is loaded inside the app: that is deliberate, and it will not change without this policy saying so first.
• Infrastructure analytics: our network provider measures load times and errors so the site works well. It stores nothing in your browser — no cookies, no local storage.

We also use your browser’s local storage to remember interface preferences that belong to you and to that device (how you prefer to view the library, thumbnail size, whether you dismissed the language notice). That data never leaves your browser.

We do not sell your data and we do not show third-party advertising inside Vauda. We use the measurement signals above to know whether our ads work; today we do not use them to show you our ads again on other sites, and if that changes we will say so here first.

• To provide the service: store, catalog, transcribe, index, and let you search and share your material.
• To authenticate you and protect your account and your organization's.
• To manage your plan, your credits and billing.
• To provide support and send operational communications (service notices, material changes).
• To operate, maintain and improve the platform, and to prevent fraud and abuse.

What we do not do: we do not sell your data, we do not use your content or your account data for advertising, and we do not use your content to train artificial intelligence models. We detail that last point in our Data & AI Policy.

We process your data on the following bases, as applicable to your jurisdiction: performance of the contract you enter into when using Vauda; our legitimate interest in operating and securing the platform; your consent, where the law requires it; and compliance with legal obligations (for example, tax obligations).

To operate Vauda we work with a limited number of carefully selected service providers (sub-processors) that process data solely on our behalf and under contract. We group them by category:

• Cloud infrastructure and file storage.
• AI processing for cataloging, transcription and semantic search.
• User identity and authentication.
• Email delivery: the messages the platform sends you (notices about your account and your material) go out through a transactional email provider, which receives your address and the contents of those messages. We do not hand it your uploaded content or your catalog.
• Payment processing (as Merchant of Record).

None of these providers uses your content to train their AI models, and none is permitted to sell your personal data. We do not share your data with third parties for their own marketing purposes. We may also disclose data where required by law or to protect rights and safety.

Some of our providers process data outside your country (for example, in the United States or the European Union). When an international transfer takes place, we rely on recognized safeguards —such as standard contractual clauses or equivalent adequacy frameworks— so that your data keeps an appropriate level of protection.

Because your library may include photos, videos or audio with identifiable people, when you upload that material you represent that you have the rights and authorizations needed to process it. We process it as a processor, following your instructions and only to provide the service.

If a person appearing in your content wishes to exercise their rights, the point of contact is your organization (the controller). For customers who need it, we offer a data processing agreement (DPA).

We keep your content and account data while your account is active. When you delete an asset, or when you delete your account, we remove the material and the derived catalog (including derivatives, transcriptions and search vectors); copies in backups are purged on the normal rotation cycle. Technical and audit records are kept for limited periods, for security and compliance.

Depending on your jurisdiction, you may exercise the rights of access, rectification, deletion, portability, objection and restriction of the processing of your personal data. For your account data, many of these actions are available directly in the platform (edit your profile, export or delete your content, delete your account).

To exercise any right, or if you have questions, write to us at legal@vauda.ai. Regarding third-party data appearing in your content, contact the organization responsible for that library.

We encrypt your material at rest and in transit, isolate each organization at the data layer, and all delivery uses signed links that expire —an asset never sits at a permanent public URL—. We apply role-based access control and log sensitive actions.

Vauda is a product for businesses and professionals; it is not directed at minors and we do not knowingly collect their data. If you believe a minor has provided us with personal data, write to us and we will delete it.

We may update this policy to reflect changes in the service or the law. When a change is material, we will notify you by a reasonable means. The “last updated” date at the top indicates the current version.

Vauda is operated by Patata Labs, based in Santiago, Chile. For any privacy question or to exercise your rights, write to us at legal@vauda.ai.