Legal
Privacy Policy.
Last updated: July 13, 2026
Vebble is an agent that connects to the tools your work already lives in, so it can answer questions about your business and have your decks, docs and research done before they're due.
To do that, it reads your data. This page explains exactly what we read, why, how long we keep it, and what we will never do with it. We've written it in plain English, because you shouldn't need a lawyer to work out what happens to your email.
Questions: vebbleai@gmail.com
1. Who we are
Vebble is operated by Vebble AI, a business registered in Ontario, Canada.
- Business Identification Number: 1001674589
- Address: 2375 The Collegeway, Mississauga, ON L5L 2E8, Canada
- Contact: vebbleai@gmail.com
We are the organisation responsible for the personal information described here. We're subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). If you're in the UK or EU, the GDPR sections below also apply to you; if you're in California, see §11.
2. What we collect
a) What you give us
- Early access / waitlist: your email address.
- Account: your name, email address, and the identifier from whichever provider you sign in with.
- Billing: handled entirely by Stripe. We never see or store your card number. We store your plan, subscription status, and Stripe customer ID.
- What you type into Vebble: chat messages, prompts, calendar event descriptions, and any files or references you attach.
b) What we read from the tools you connect
Only after you explicitly authorise each connection, and only within the permissions you grant:
| Source | What we read | Why |
|---|---|---|
| Granola | Meeting notes and transcripts | To know what was discussed, decided, and what you now owe |
| Slack | Messages and channels you grant access to | Business context and deadlines |
| Gmail | Email content and metadata | Business context; sending finished work at your request |
| Notion | Pages and documents you grant access to | Business context |
| Linear | Issues and project data | Business context |
| Google Calendar / Outlook Calendar | Events, titles, descriptions, times | Your calendar is the agent's schedule of work |
| Google Drive | Files you attach; files we export to | Delivering your finished work |
We read only what's needed to answer your questions and produce your deliverables. You can disconnect any source at any time, from settings.
c) What we collect automatically
- Basic usage data: features used, jobs run, errors encountered.
- Technical data: device type, browser, IP address.
- Essential cookies only — enough to keep you signed in. We do not currently use analytics, advertising, or tracking cookies. If that changes, we'll update this page and ask for consent where required.
3. Why we use it
- To run the service: generate slides, docs and research, and answer your questions in Ask Vebble.
- To schedule and run background jobs against your deadlines.
- To deliver finished work where you tell us to — only after you approve it. Vebble never sends anything on its own.
- To bill you, support you, and keep the service secure.
- To email you about the product. Every email has an unsubscribe link.
Consent (PIPEDA). Connecting a source is your express consent for us to process what's in it, for the purposes above. You may withdraw that consent at any time by disconnecting the source or deleting your account. Some features won't work without it — we'll tell you which.
Legal bases (UK/EU users). Performing our contract with you; your consent (each connection, and marketing email); and our legitimate interests in securing the service and preventing abuse.
4. What we do not do
- We do not sell your personal information. Not to anyone, ever.
- We do not use your connected content, or the work Vebble produces for you, to train AI models — ours or anyone else's.
- We do not use your data for advertising, and we don't share it with advertisers or data brokers.
- We do not read your content for any purpose other than delivering the service to you — with the narrow exceptions in §5.
5. When a human might see your data
Almost never. Only when:
- You ask us to — e.g. you email support about a broken deck and give us permission to look.
- Security requires it — investigating abuse, fraud, or a suspected breach.
- The law requires it — a valid legal order. We'll tell you unless we're legally barred from doing so.
Access to production systems is limited to the people who need it, protected by multi-factor authentication, and logged.
6. Google user data — Limited Use
Vebble's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use Gmail, Google Calendar and Google Drive data only to provide and improve the user-facing features that are prominent in Vebble: gathering context for your deliverables, scheduling background jobs, and delivering finished work you have approved.
- We do not transfer this data to others, except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you.
- We do not use this data for advertising.
- We do not allow humans to read this data, unless we have your explicit consent for a specific case, it is necessary for security purposes, it is required by law, or the data has been aggregated and anonymised.
- We do not use Google user data to develop, improve, or train generalised or non-personalised AI or ML models.
You can revoke Vebble's access to your Google account at any time at myaccount.google.com/permissions.
7. Who we share it with
We use a small number of vendors to run Vebble. Each receives only what it needs, and each is bound by contract to protect it.
| Vendor | What it does | Where |
|---|---|---|
| Google Cloud / Vertex AI | Hosting, database, and the AI models that generate your work | North America |
| Stripe | Payments | North America |
| Resend | Transactional and product email | North America |
Model providers do not train on your data. We use enterprise API terms under which your inputs and outputs are not used to train the underlying models.
We do not otherwise disclose your information, except where legally compelled, or where necessary to protect our rights or someone's safety.
8. Where your data lives
Your data is stored and processed in North America (Canada and/or the United States).
If you're outside North America, this means your information will be transferred here, and may be accessible to law enforcement or national security authorities under the laws of those countries. For UK/EU users, we rely on the appropriate safeguards (Standard Contractual Clauses / the UK IDTA) for that transfer.
9. How long we keep it
| Data | Retention |
|---|---|
| Content from connected sources | While the connection is active. Deleted within 30 days of disconnecting the source or deleting your account. |
| Deliverables (decks, docs, research) | Until you delete them, or 30 days after account deletion. |
| Chat history | Until you delete it, or 30 days after account deletion. |
| Account and billing records | While your account is open, then 7 years, as Canadian tax and accounting rules require. |
| Waitlist email addresses | Until you unsubscribe. |
10. Security
- Encrypted in transit (TLS) and at rest.
- OAuth tokens stored encrypted. We never ask for, and never store, your passwords to other tools.
- We request the narrowest permissions that make each feature work.
- Production access is restricted, MFA-protected, and logged.
No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, as PIPEDA requires — and any other regulator we're obliged to tell.
11. Your rights
You can, at any time:
- Access the personal information we hold about you.
- Correct anything inaccurate.
- Delete your account and its data.
- Export your deliverables.
- Disconnect any source.
- Withdraw consent to any processing.
- Unsubscribe from product email.
Email vebbleai@gmail.com and we'll respond within 30 days, as PIPEDA requires.
If we say no to a request, we'll tell you why, and you have the right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
UK/EU users additionally have the right to object to or restrict processing, the right to data portability, and the right to complain to your local supervisory authority.
California residents have the right to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We don't sell or share it, and we don't process it for cross-context behavioural advertising — so there's nothing to opt out of. The rest of your rights are exercised the same way, by emailing us. We won't discriminate against you for using them.
12. Other people's information
Vebble reads content that contains other people — colleagues, customers, and anyone in your meetings and inbox.
You are responsible for having the right to connect that content. Please make sure doing so is consistent with your employer's policies and your obligations to the people in it. We process that information only to serve you. We don't build profiles of those individuals, and we don't use their information for our own purposes.
13. AI and automated processing
Vebble uses AI to read your context and produce your work. It does not make decisions with legal or similarly significant effects about you. Everything it produces waits for your approval before it goes anywhere.
AI output can be wrong. Review it before you rely on it.
14. Children
Vebble is not intended for anyone under 16, and we don't knowingly collect their information.
15. Changes
If we make a material change to this policy, we'll email you before it takes effect. The date at the top is always the current version.