This policy explains what personal data Clumie Services SpA collects when you use Vinte, why, who we share it with, how long we keep it and the rights you have over it. It is written to meet Chile's Ley 19.628 on the protection of private life and Ley 21.719, which substantially amends it from December 1, 2026. A Spanish version is available; if you are in Chile and the two versions differ, the Spanish one prevails.
What this policy covers
It covers vinte.app and its subdomains (including platform.vinte.app and docs.vinte.app) and every product we run under the Vinte name:
- The public website.
- Vinte Chat, our AI assistant, which is in private development.
- Vinte Code, a terminal coding tool with Cloud Agents, and the developer API with its billing.
- Aequor, our Git hosting service at aequor.dev.
- Agent, an assistant you talk to over iMessage.
Accounts are not open to the public yet, and several of these products are not available yet. The parts of this policy about a product apply to it when it becomes available to you.
Who is responsible for your data
The controller (in Chilean law, the "responsable de datos") is Clumie Services SpA, a sociedad por acciones incorporated in Chile. Its RUT is 78.319.264-0. For anything about your data, including the requests described below, write to vicente@vinte.app.
The legal bases we rely on
We only process personal data when the law allows it. For each use below we name one of these bases:
- Contract: the processing is needed to give you the service you signed up for, or to take steps you asked for before signing up.
- Legitimate interest: we have a real interest, such as keeping the service secure, and it does not override your rights. You can always ask us which interest we rely on and object to it.
- Legal obligation: a law requires it, for example keeping tax records.
- Consent: you agreed to it. You can withdraw consent at any time; that does not affect what we did before you withdrew it.
- Legal claims: we need it to establish, exercise or defend a right before courts or public bodies.
What we collect and why
When you visit the site. Every request carries your IP address, browser user agent, the page you asked for and the time. We use it to serve the page, block attacks and abuse, limit how often a single address can try sensitive actions, and show prices in your local currency (we read only your approximate country from the IP and do not store it). Base: legitimate interest in running a secure, working service. We do not store your IP address in our database. Our hosting provider, Cloudflare, processes it and keeps short-lived request logs.
Your account. Your email address and the name you choose. If you sign in with Google, we receive your name, email and profile picture from Google. If you use a password, we store only a hash of it. If you add a passkey, we store its public key and a device name; if you turn on two-step verification, we store its secret and hashed backup codes. We also keep your sign-in sessions with a device label built from your browser (for example "Chrome on Mac"), which we use to show your active sessions and email you when a new device signs in, and an optional secondary contact email. Base: contract, and legitimate interest in protecting your account.
Vinte Chat. Your messages, the files and images you attach, the replies, chat titles, projects, pins, the model and settings you pick, and any thumbs up or down you give. We store them so you can come back to your chats, and send them to the AI model provider that generates the reply. If you use web tools, your search queries go to our search provider and the pages you ask about are fetched for you. Base: contract.
Vinte Code and the developer API. Your API keys (we store only a hash and a short prefix), the name of the tool you connect when you sign in from a terminal, usage records (model, amount used, time) and your API credit balance and transactions. The prompts, code and files you send are passed to the AI model provider to produce a response. Cloud Agents run tasks in cloud environments on your behalf, and the code and instructions you give them are processed there. Base: contract.
Aequor. Aequor uses your Vinte account. It stores your handle and display name, the repositories you push and their content, issues, pull requests, comments, stars, organization and team membership, your SSH public keys, hashed access tokens, and the webhook addresses you configure (we send repository events to them). Anything you put in a public repository is visible to everyone. Base: contract.
Agent. Your phone number or iMessage address, the messages and attachments you send and Agent's replies, and the notes, reminders, scheduled tasks and website watches you set up. If you connect your Google account, Agent reads and manages your Gmail, Google Calendar and Google Drive to do what you ask. It always asks before sending email, creating or answering events, or deleting mail. Places you ask about are sent to a weather service. Base: contract, and your consent for the Google connection, which you can withdraw by disconnecting it in your Google account. Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Payments. Stripe processes payments. Card details go straight to Stripe and never reach us. We keep your Stripe customer and subscription IDs, plan, billing period and status, purchase amounts, and, for gifts and team plans, the recipient's or invitee's email and any name you add. Base: contract, and legal obligation for tax and accounting records.
Emails. We send sign-in codes, security alerts, receipts, gift and team invitations and other messages about your account (base: contract and legitimate interest in your account's security). We send the Newsroom newsletter and beta waitlist updates only if you sign up for them (base: consent); every such email has an unsubscribe link. If you write to us, we keep your message and our reply to handle your request (base: legitimate interest, or contract when it is about your account).
Security checks. Sign-up and some other forms use Cloudflare Turnstile, which receives your IP address to tell people from bots. We count attempts on sensitive actions (such as sign-in or two-step codes) to stop guessing; these counters are keyed to a hash, not to readable data, and expire within a day. Base: legitimate interest in preventing fraud and abuse.
Training our models
If you use Vinte with an individual account, we may use your chats, code, messages and feedback to train and improve our models. This is on by default and you can turn it off in your settings at any time; from then on, new content isn't used. The legal basis is our legitimate interest in improving the Service, and turning it off is how you exercise your right to object.
Team and Enterprise accounts are never used for training. The setting is off for them, and we don't train on their content.
What we don't do
- We don't sell or rent your personal data.
- We don't run advertising, ad trackers, fingerprinting or cross-site tracking pixels, and we don't build profiles of you for advertising.
- We don't use third-party analytics scripts on the site.
Who we share it with
We share personal data only with providers that process it for us under contract and only for the purposes above:
- Cloudflare: hosting, content delivery, security and bot protection (including Turnstile), file storage, Aequor repository storage, and sending our emails.
- Convex: our application database, file storage and sign-in backend.
- Google: Sign in with Google, and the Google APIs that Agent uses when you connect your account.
- AI model providers: Amazon Web Services (Bedrock), Anthropic, OpenAI, Google (Gemini API) and OpenRouter, which routes requests to the company that runs the chosen model. They receive the content needed to produce a response.
- Brave Search receives web search queries, and Browserbase may load a page you ask about when it needs a full browser.
- PostHog: technical logs from our model service (model, account ID, plan, timing and errors, not the content of your messages).
- Stripe: payments, subscriptions and invoices.
- For Agent: Photon (iMessage delivery), Anthropic (the AI model), Tavily (web search and page reading), Open-Meteo (weather for the places you ask about) and the provider of the private server it runs on.
We may also disclose data when a law or a court or authority order requires it, to protect people's safety or our rights, or to a successor if the business is reorganized or transferred (including to the US company we plan to form to run Vinte); we will tell you before your data becomes subject to a different policy.
International transfers
Most of these providers are based in the United States, and your data may be stored or processed there or in other countries where they operate. We rely on the safeguards each provider offers in its data processing terms and, where applicable, on the model contractual clauses approved in Chile, together with the need to perform our contract with you. You can ask us for details of the safeguards for a given provider.
How long we keep it
- Account data: while your account exists. Sign-ups that are never verified are deleted after about 24 hours.
- Sessions: they end after 30 days, or 7 days without use, or when you sign out.
- Chats, projects, repositories and Agent data: until you delete them or close your account.
- Security counters and verification records: from a few minutes up to about a day.
- Server and technical logs: a short period, generally no more than 30 days, unless we need them longer to investigate a specific incident.
- Payment and tax records: for as long as Chilean tax and accounting law requires.
- Emails you send us: until your request is resolved, plus a reasonable period in case it comes up again.
When you close your account, we delete or anonymize your personal data within 30 days, except what a law requires us to keep. Copies in backups are overwritten on the backup cycle.
Cookies and local storage
We use no advertising or analytics cookies. What we store on your device is first-party and needed to run the site or to remember a choice you made:
- Your sign-in session, kept in your browser's local storage so you stay signed in.
- A last_used cookie that remembers which sign-in method you used last (kept up to 2 years).
- Interface preferences such as the chat model and settings you picked, sidebar width and unsent drafts, kept in local or session storage.
- Security cookies Cloudflare may set to protect the site from bots and attacks.
You can clear these at any time in your browser; some features, like staying signed in, will stop working.
How we protect it
All traffic is encrypted in transit. Passwords, API keys, access tokens, backup codes and email codes are stored only as hashes. We offer passkeys and two-step verification, limit repeated attempts, use strict browser security headers and give staff access to personal data only when needed. No system is perfectly secure. If a security breach creates a reasonable risk to your rights, we will report it to the authority and, where the law requires, tell you in clear language what happened, what data was affected and what we are doing about it.
Your rights
You can ask us to:
- Access: confirm whether we process your data, get a copy, and learn where it came from, why we use it, who receives it and how long we keep it.
- Rectify: correct data that is inaccurate, out of date or incomplete.
- Delete (supresión): erase your data, including closing your account.
- Object (oposición): stop a use based on legitimate interest or used for direct marketing.
- Portability: receive the data you gave us in a structured, common, machine-readable format, or have it sent to another provider when technically possible.
- Block (bloqueo): temporarily suspend the processing of your data while we resolve a rectification, deletion or objection request.
- Not be subject to automated decisions that produce legal effects on you or significantly affect you (see below).
- Withdraw consent at any time for anything based on consent.
You can delete individual chats yourself in Vinte Chat. For anything else, email vicente@vinte.app from the address on your account, or tell us how to reach you and which data or right your request is about. We may ask you to confirm your identity. Exercising your rights is free.
Until November 30, 2026, Ley 19.628 applies and we answer within 2 business days. From December 1, 2026, under Ley 21.719, we acknowledge your request and answer in writing within 30 calendar days, which we may extend once by up to 30 more days. A request to block your data is answered within 2 business days. If we refuse all or part of a request, we will explain why.
If you are not satisfied, from December 1, 2026 you can file a complaint with Chile's Agencia de Protección de Datos Personales within 30 business days of our answer, or of the deadline if we didn't answer. Before that date, you can go to the civil court (juez de letras en lo civil) of our domicile, as Ley 19.628 provides.
Automated decisions
We don't make decisions about you that produce legal effects or similarly significant effects based only on automated processing, including profiling. Automated security checks, like bot detection or attempt limits, can temporarily block an action; if that happens and you think it is a mistake, write to us and a person will review it. Answers generated by AI models are content you asked for, not decisions about you.
Children and adolescents
Vinte is meant for adults. You must be at least 18 to create an account, and our products are not directed at children or adolescents. We don't knowingly collect data from anyone under 18. If you believe a minor has given us personal data, write to us and we will delete it.
Sensitive data
We don't ask for sensitive data, such as health, biometric, political, religious or sex life data. Please avoid including it in chats, files or messages. If you do, we process it only to give you the service you asked for.
If you are in the European Union or the United Kingdom
Vinte's AI products are not offered in the European Union or the European Economic Area, but the website can be reached from anywhere. If the GDPR or UK GDPR applies to our processing of your data, the legal bases above correspond to contract, legitimate interests, legal obligation and consent under Article 6 of those laws. You have the rights listed above, plus the right to restrict processing, and you can complain to your local data protection authority.
If you are in the United States
We don't sell your personal information or share it for cross-context behavioral advertising, as those terms are used in the California Consumer Privacy Act (CCPA/CPRA) and similar state laws, and we don't use sensitive personal information to infer characteristics about you. Depending on your state, you can ask to know, access, correct or delete your personal information, and we won't treat you differently for doing so. Use the contact above.
Changes to this policy
This is version 2.0 of this policy, in force from the date at the top of this page. We will update it when we add or remove a provider, launch a product or change how we handle data. If a change is material, we will tell account holders by email before it takes effect.
Contact
Clumie Services SpA, Chile. vicente@vinte.app