Privacy Policy

Vectoad (the product at vectoad.com) is run by Vectoad Ltd (placeholder), registered at 123 Placeholder Street, City, Country (placeholder). We are the controller of the personal data described here. Questions or requests: hello@vectoad.com.

• Account data: your name, email address, a hash of your password, and the identifiers GitHub or Google give us if you sign in with them.
• Session data: when you sign in we record the IP address and browser (user agent) of the session.
• Workspace data: workspaces, members and their roles, and invitations (including the invited person's email address).
• Content you add: SVG files, icon names, tags, proposal notes and review comments.
• API tokens: a hash of each token plus its name, scopes and last-used time. We never store a token in readable form.
• Connected services: credentials for services you connect, such as Figma, stored encrypted.
• Activity records: an audit trail of who changed what in a workspace.
• Billing identifiers once paid plans start. Card details are handled by Stripe and never reach our servers.
• Waitlist entries: your email address, role, and optionally team size and company, plus where you came from (a ref or UTM tag in the link, or the website that referred you). We don't store your IP address with your waitlist entry; it does appear in the server logs described below.
• Server logs: our application logs the request id, method, path, response status and timing, with passwords, tokens, cookies and other secrets redacted. Our web server also logs each request's IP address, browser (user agent) and full address, including any query string. Logs rotate automatically and are kept only briefly.

• To provide Vectoad (accounts, workspaces, releases, delivery): needed to perform our contract with you.
• To keep the service secure (sessions, rate limits, logs, abuse prevention): our legitimate interest in running a safe service.
• To email you about your account (verification, password reset, invitations): needed to perform our contract with you.
• To contact you about early access (the waitlist): you asked us to, and you can withdraw at any time with the unsubscribe link in every email.
• To understand where interest comes from (waitlist sources): our legitimate interest in knowing which channels work.
• To meet legal obligations, such as tax and accounting once we charge for plans.

Icons in a public set are readable by anyone once released: on our CDN and through our npm registry. Private sets are served only to people with access. Released icon names and a workspace's web address are kept permanently, even after deletion, so that packages other people have installed keep working and nobody else can take over a released address.

We use these providers to run Vectoad. Each handles data only on our instructions.

• Hetzner: servers that run Vectoad.
• Cloudflare: DNS, proxying and attack protection (it sees every request, including IP addresses), and R2 storage for SVG files and release builds.
• Neon: the database that holds your account and workspace data.
• Resend: sends our emails, so it sees recipient addresses and message contents.
• Stripe: payments, once paid plans start.
• Sentry: error reports, when enabled.
• GitHub and Google: only if you choose to sign in with them.
• Figma: only if you connect it.

Our servers and data are located in regions to be confirmed (placeholder).

Some providers above may process data outside the country where you live. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.

• Account and workspace data: for as long as your account exists.
• Deleting a workspace removes its records and purges its files from our storage, apart from the permanent public items described under "Public content".
• Waitlist entries: until you ask us to delete them. If you unsubscribe we keep your address marked as unsubscribed so we don't email you again; ask us if you want it erased entirely.
• Server logs: kept briefly for security and debugging.

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email hello@vectoad.com and we'll reply within a month. You can also complain to your local data protection authority.

We keep this to the minimum needed to run the site:

• A session cookie that keeps you signed in. It is strictly necessary.
• vectoad-theme in your browser's local storage remembers light or dark mode.
• vectoad-waitlist-source in session storage remembers where you came from until you join the waitlist or close the tab.

We use no analytics or advertising cookies, so there is no cookie banner.

Vectoad is not meant for anyone under 16, and we don't knowingly collect their data.

If we change this policy in a way that matters, we'll update the date above and tell account holders by email.