What we hold, and what we never do.

This website

valistry.ai sets no cookies, writes nothing to your browser’s storage and makes no third-party request. There is no analytics, no advertising pixel and no session recording, which is why there is no consent banner: there is nothing to consent to.

If you email us from a link on this site, we hold that email and your reply as you would expect any company to.

The product

Signing in sets a session cookie so you stay signed in, and one cookie remembering which organization you are looking at. Your browser also remembers whether you folded the navigation and which theme you chose. All of it is necessary for the product to work, and none of it follows you to another site.

That is a property of the record’s shape, not a setting: the usage record has no content field, and a test fails the build if one is added.

A person on a coding seat is stored as a hash of the vendor’s identifier, never the login or the email. Employee usage is reported at team level by default.

Who else processes it

• SupabaseHosts the database and the sign-in.database
• VercelServes the site and the application.hosting
• Amazon BedrockWrites the one sentence on an Ask Valistry answer. It is given the computed result and nothing else: never your prompts, never a ledger row.result only

Credentials you give a connector are encrypted before they are stored, and the product shows only their last four characters.

Your choices

Where it lives

The database and the sign-in run on Supabase in AWS us-east-1, in the United States. The product’s own mail goes through Resend in the same region.

The company is registered in India and the site is served from Vercel’s edge, but the records themselves sit in the United States. If your organization needs them elsewhere, tell us before you connect a source.

How long we keep it

Your records stay while your organization exists. Deleting the organization deletes them; disconnecting a source stops new ones arriving.

The ledger is append-only by design, so a decision is never rewritten. Deleting the organization removes the ledger with everything else.

Two things outlive that: entries in our own billing records, and the call log a connector writes, which holds a URL and a status and never a secret.

Your rights

Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. We answer within thirty days.

Under the GDPR that covers access, rectification, erasure, restriction, portability and objection, and you may complain to your supervisory authority. Under the CCPA and CPRA it covers knowing, deleting, correcting and opting out.

The opt-out is short here: we do not sell or share personal information, under any definition of either word. There is no advertising, no data broker and no analytics on this site.

Your ledger exports as CSV and JSON from the product, so portability needs no request.

Children

Valistry is sold to companies and is not for anyone under 16. We do not knowingly collect their data, and we delete it if we find it.

Changes

The date at the top moves when this notice changes. A change that affects what we collect or who processes it is emailed to account owners before it takes effect.

Reaching us

A question, a correction or a deletion request: hello@valistry.ai. A person reads it.

VedicSync Pvt Ltd, Bangalore, India. We have not appointed a data protection officer; that address reaches the people who decide.