Privacy Policy

Last updated August 2026

What we collect

Account information: your name, work email, organization name, and a salted hash of your password. We never store your password itself.

Content you enter: vendor records, contact names and email addresses, assessment questionnaires and responses, notes, and scores. Much of this is information about your vendors and their staff rather than about you.

Operational records: a log of emails the service queued or sent on your behalf, including delivery status, so failures are visible rather than silent.

How we use it

To operate the service: storing your register, delivering questionnaires to the vendor contacts you specify, scoring responses, generating your exports, and sending you account email such as password resets. We do not sell personal information, and we do not use your content to train AI models.

Vendor contacts

When you send an assessment, we email the vendor contact you entered and host the questionnaire they complete. You are responsible for having a proper basis to share that contact's details with us. We use those details only to deliver and process the assessment you requested.

AI features

Assessment scoring is entirely deterministic and computed locally: no third-party AI service is involved in producing a score or rating. If an administrator configures an optional API key, a language model may be used to write a narrative summary of an already-computed result. That feature is off unless deliberately enabled.

Service providers

We use a small number of infrastructure providers to run Vetrail, including a cloud hosting provider, a DNS and network provider, and an email delivery provider. They process data only to provide those services to us.

Where data is held

The application and its database run on cloud infrastructure located in the United States.

Retention and deletion

We keep your data for as long as your account is active. You can export a complete copy at any time from the Team page. Ask us to delete your organization and we will remove it.

Security

Passwords are stored as salted hashes. Traffic is encrypted in transit. Data is scoped to your organization, and public endpoints are rate limited. Backups of the underlying storage are taken daily. No system is perfectly secure, and we will not pretend otherwise.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to complain to a regulator. Contact us to exercise them. In Canada you may also contact the Office of the Privacy Commissioner.

Contact

Privacy questions: privacy@vetrail.io