Privacy Policy

Last updated: February 19, 2026

This Privacy Policy describes how Vanna AI, Inc. ("Company," "we," "us," or "our") collects, uses, and protects your information when you use x1pm, including our website, APIs, mobile applications, and related services (collectively, the "Service"). By using the Service, you agree to the practices described in this policy.

1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and authentication credentials. If you sign in using a third-party provider (such as Google or Apple), we receive your name and email address from that provider. We do not store third-party passwords.

Workspace Content

You create, upload, and store content within your workspaces, including files, structured data, and project information ("Workspace Content"). We host and process this content solely to provide the Service. We do not access, review, or analyze your Workspace Content except as necessary to operate the Service, comply with the law, or enforce our Terms of Service.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, API calls made, timestamps, and general usage patterns. This data helps us operate, maintain, and improve the Service.

Device and Connection Information

We collect technical information such as your IP address, browser type, operating system, and device identifiers when you access the Service. This information is used for security, diagnostics, and to ensure compatibility.

API and Integration Data

When you use our APIs or connect third-party tools, we log API requests, including authentication method, timestamps, and the operations performed. We do not log the full content of API request or response bodies beyond what is needed for operational purposes.

Support and Onboarding Interactions

When you use our AI-powered support chat or onboarding assistant, we collect your conversation messages and store them to track and resolve your issues. To generate responses, our systems may access portions of your workspace content (such as file listings and file contents) as needed to fulfill your request. These interactions are processed on our behalf by third-party AI providers.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service.
  • Authenticate your identity and manage account access.
  • Process billing and enforce plan limits.
  • Send transactional communications, such as account confirmations, security alerts, and service updates.
  • Monitor for security threats, abuse, and violations of our Terms.
  • Improve the Service, including analyzing aggregate usage patterns.
  • Provide AI-powered features, including in-app onboarding assistance and customer support.
  • Comply with legal obligations.

We do not use your Workspace Content to train machine learning models. We do not sell your personal information.

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information in the following limited circumstances:

  • Service providers: We work with third-party vendors who help us operate the Service, such as hosting providers, payment processors, email delivery services, and AI infrastructure providers. These providers access your information only to perform services on our behalf and are bound by confidentiality obligations. When you use AI-powered features such as in-app support or onboarding assistance, your conversation messages and relevant workspace content may be processed by third-party AI providers on our behalf.
  • Workspace members: When you share a workspace with other users, those users can see workspace content and member information within that workspace.
  • Third-party integrations: If you connect third-party tools or agents to your workspace, those tools may access your Workspace Content as authorized by you. We are not responsible for how third parties handle your data.
  • Legal requirements: We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

4. Data Storage and Security

We store your data using commercially reasonable security measures, including encryption in transit and at rest. We use access controls to limit who can access your information internally. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your Workspace Content is stored in the region associated with your account. We may offer additional data residency options in the future.

5. Data Retention

We retain your account information and Workspace Content for as long as your account is active. If you delete your account, we will delete your personal information and Workspace Content within a reasonable period, except where retention is required by law or necessary for legitimate business purposes (such as resolving disputes or enforcing our Terms).

Usage logs and aggregated, de-identified data may be retained indefinitely for analytics and service improvement.

6. Your Rights and Choices

Depending on your jurisdiction, you may have rights regarding your personal information, including:

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request that we correct inaccurate information.
  • Deletion: Request that we delete your personal information.
  • Export: Export your Workspace Content at any time using the tools and APIs we provide.
  • Objection: Object to certain uses of your information where applicable.

To exercise these rights, contact us at support@vanna.ai. We will respond within a reasonable timeframe and in accordance with applicable law.

7. Cookies and Tracking

We use cookies and similar technologies for essential functions such as authentication and session management. We may also use analytics tools to understand how the Service is used. You can manage cookie preferences through your browser settings, though disabling essential cookies may affect the functionality of the Service.

8. Third-Party Services

The Service may contain links to or integrations with third-party websites, tools, or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party service you connect to or use through our platform.

9. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete it promptly.

10. International Data Transfers

If you access the Service from outside the United States, your information may be transferred to and processed in the United States or other jurisdictions where our service providers operate. By using the Service, you consent to these transfers. We take steps to ensure that your information receives an adequate level of protection in the jurisdictions in which we process it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

If you have questions or concerns about this Privacy Policy or our data practices, contact us at support@vanna.ai.