VestAI LTD, a company incorporated under the laws of the Republic of Cyprus, with its registered office at Grigoriou Xenopoulou 4B, Agia Paraskevi, Germasogeia, 4049, Limmasol, is the entity responsible for processing your Personal Data as a controller (or equivalent concept under applicable law).

For EEA matters, our lead supervisory authority is: Office of the Commissioner for Personal Data Protection (Cyprus). You may also lodge a complaint with your local EEA authority, the UK Information Commissioner’s Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC), as applicable.

• Provide, maintain, and improve our Services.
• Process payments and manage subscriptions (where applicable).
• Communicate updates, support, and—where permitted—marketing.
• Prevent fraud and abuse, and protect security and integrity.
• Comply with legal obligations and establish, exercise, or defend legal claims.
• Aggregate or de-identify data for analytics and research.
• To train, fine-tune, and improve our AI models, where permitted by law and subject to your opt-out rights.

We retain Personal Data for no longer than is reasonably necessary for the purposes described in this Policy, unless a longer retention period is required by law (for example, for tax or accounting obligations).

Retention periods depend on data type, purpose, sensitivity, and legal obligations. Some data may be deleted or anonymized sooner per your settings or product behavior.

VestAI retains personal information only for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Certain operational data (such as logs or security records) may be retained for a limited period for auditing, security, and reliability purposes, unless deleted earlier upon a valid user request.

Our Services are not directed to children under 13 (or the minimum age required by law in your country), and we do not knowingly collect Personal Data from children.

If we become aware that we have collected Personal Data from a child in violation of this Policy, we will promptly delete it unless retention is legally required.

If you believe we have collected Personal Data from a child in violation of this section, please contact privacy@vestai.com and we will investigate and take appropriate action.

Some privacy laws require us to explain the “legal bases” (or similar concept) for processing. When applicable (including under the GDPR/UK GDPR and Swiss law), we rely on:

• Performance of a contract: to operate the Services and process your requests.
• Legitimate interests: improve Services, ensure security, prevent fraud, and conduct research (balanced against your rights).
• Legal obligations: compliance with laws and regulations.
• Consent: for certain marketing communications, cookies, or other processing where required.

In other jurisdictions, we process Personal Data consistent with the permissions and requirements of applicable law (for example, with your consent, to provide a requested service, for compliance, or for our legitimate business purposes such as security and product improvement).

We may process data on servers outside your country, including the United States and other jurisdictions. These countries may have different data protection laws.

Where required by law, we use appropriate safeguards for cross-border transfers, such as: adequacy decisions, Standard Contractual Clauses (SCCs), UK transfer mechanisms (e.g., IDTA/UK Addendum), and other lawful measures.

We may update this policy from time to time. Revised versions and effective dates will be posted here, unless another form of notice is required by law.