Trust Center
Vatdi handles your store's product catalog, conversation history, and customer messages. This page tells you exactly how that data is processed, who else touches it, and how to control or delete it.
Data ownership
Your knowledge base, product data, conversations, and customer contacts belong to you. Export or delete at any time from your dashboard or by writing to us.
Per-store isolation
Every store's data lives under a store_id foreign key across the database, the vector index, and log storage. One merchant never sees another merchant's data.
Encryption
HTTPS/TLS 1.2+ on every public endpoint. Secrets (API keys, store credentials) are encrypted at rest using Laravel's Encrypter with a rotating APP_KEY.
Least privilege
Support staff can view aggregate metrics and, when a merchant explicitly opts in for concierge setup, temporary store credentials — which are wiped after installation.
What data we process
- Account data — email, name, hashed password, billing details via Stripe (we never see raw card numbers).
- Store connection data — the domain, platform (Shopify / WooCommerce / OpenCart / custom), and an integration token you provide.
- Knowledge base — products, pages, PDFs, and FAQs you sync or upload. Used to generate answers via Retrieval Augmented Generation (RAG).
- Conversations — messages between your visitors and the AI, plus any human-agent replies. Retained for analytics unless you delete them.
- Widget metadata — page URL, referrer, and coarse timing so you can see where chats happen.
Subprocessors
Vatdi delegates specific processing to the vendors below. All are listed here — we do not add subprocessors quietly.
| Vendor | Purpose | Data shared | Region |
|---|---|---|---|
| OpenAI | Primary LLM for answers & embeddings | The user question + relevant knowledge snippets. Sent via API, not used for training per OpenAI's zero-retention API policy where enabled. | US |
| Google (Gemini) | Cross-provider fallback LLM | Same as OpenAI, only when the primary is unavailable | US |
| Stripe | Payment processing | Billing name, email, card token — we never see the card number | Global (Stripe-hosted) |
| Pusher | Realtime chat message delivery | Encrypted message payloads on per-conversation channels | US / EU |
| Qdrant | Vector database for knowledge retrieval | Embeddings of your knowledge items + a store_id filter | Self-managed |
| cPanel / Web host | Application hosting | All app data at rest, encrypted DB & file storage | US |
If you need a DPA or a specific subprocessor to be excluded, contact us — enterprise plans support this.
Your rights (GDPR / CCPA)
- Access & export — request a full copy of your data at any time.
- Correction — edit account, store, and knowledge fields yourself in the dashboard; contact us for anything else.
- Deletion — delete individual conversations or your entire account. Deletion cascades to the vector index and cached embeddings within 24 hours.
- Portability — knowledge items and conversation history export as JSON/CSV.
- Objection to processing — you can disable analytics or third-party embedding by contacting us.
Data retention
- Active accounts: conversations retained indefinitely so the dashboard remains useful — you can delete on demand.
- Cancelled accounts: data retained for 30 days for reactivation, then permanently deleted.
- LLM call logs (used for debugging + eval): 90 days, then purged.
- Backups: rolling 10 daily snapshots, then rotated out.
Compliance status
Vatdi is not currently SOC 2 or ISO 27001 certified. We follow the practices those frameworks describe — encrypted secrets, per-store isolation, least-privilege access, dependency scanning, audit logs — but do not claim certifications we don't hold. If your procurement process requires either, please contact us.
Trust & privacy FAQ
Is Vatdi SOC 2 or ISO 27001 certified?
No. Vatdi is not currently SOC 2 or ISO 27001 certified. We follow the practices those frameworks describe — encrypted secrets, per-store isolation, least-privilege access, dependency scanning, and audit logs — but we do not claim certifications we don't hold.
Who owns the data in a Vatdi account?
You do. Your knowledge base, product data, conversations, and customer contacts belong to you, and you can export or delete them at any time from your dashboard or by writing to us.
Which subprocessors does Vatdi use?
OpenAI (primary LLM and embeddings), Google Gemini (fallback LLM), Stripe (payments), Pusher (realtime message delivery), Qdrant (vector search), and our web host for application hosting. All are listed on this page — we do not add subprocessors quietly.
How long is my data retained?
Active accounts keep conversations until you delete them. Cancelled accounts are retained 30 days for reactivation, then permanently deleted. LLM call logs are purged after 90 days, and backups roll over after 10 daily snapshots.
Is my store data visible to other merchants?
No. Every store's data lives under a store_id foreign key across the database, the vector index, and log storage, so one merchant never sees another merchant's data.
How do I request data export or deletion?
Email privacy@vatdi.com for export, deletion, or a DPA. Deletion cascades to the vector index and cached embeddings within 24 hours.
Contact
Security & privacy questions: security@vatdi.com
Data requests (export, deletion, DPA): privacy@vatdi.com
General questions: contact form
Related pages: Privacy Policy · Terms of Service · Security
Last updated August 26, 2026