Legal
Privacy Notice
Last updated: 2026-05-12 · Site: vbfactory.co
This is the privacy notice for the Operator (the sole tradership trading as VBFactory) in the operation of vbfactory.co.
What data the Operator collects
Account data. Your name, email, business name, NIF or other tax ID, payment details (collected via Stripe, not stored by the Operator), and a record of your communications with the Operator.
Platform telemetry. Logs of your activity on the platform: which features you used, when, from what IP address, errors that occurred, and similar operational data.
End Customer data, on behalf of you. When End Customers interact with your vertical's agent, the platform processes their conversations, the information they submit, and metadata about the session. You are the controller of this data. The Operator is your processor.
Why the Operator collects it
To provide the platform. The Operator needs your account data to give you an account. The Operator needs platform telemetry to keep the service running, to investigate problems, and to detect abuse.
To meet legal obligations. The Operator must keep certain records for tax, accounting, and consumer protection purposes.
To improve the service. The Operator analyses aggregated, anonymised data about how the platform is used. The Operator does not analyse individual End Customer conversations for product improvement without explicit consent.
Lawful basis (GDPR)
For account data and most telemetry: performance of a contract with you.
For limited operational telemetry and security logs: legitimate interests, balanced against your rights.
For any direct marketing: consent, which you can withdraw at any time.
For End Customer data: the lawful basis is the one you (the Vertical Owner) set as controller, typically the consent the End Customer gives to your vertical.
Who the Operator shares data with
Sub-processors used to run the platform:
| Sub-processor | What they do | Where |
|---|---|---|
| Anthropic | LLM API for the AI agents | US, with EU data residency options where available |
| Render | Application hosting and database | EU region preferred where available |
| Stripe | Payment processing | EU and US |
| Cloudflare R2 | File storage | Global, EU edge preferred |
| SendGrid | Transactional email | EU and US |
| Auth0 | Authentication | EU and US |
The Operator publishes the up-to-date sub-processor list and notifies you in advance of material changes.
The Operator may share data when legally required (court order, regulatory request) or to protect rights, property, or safety. The Operator does not sell your data.
How long the Operator keeps data
Account data: while your account is active, plus 7 years for tax and accounting purposes after closure.
Platform telemetry: 12 months, then anonymised or deleted.
End Customer data: per your retention policy as controller. Default is 12 months if you do not specify.
Your rights (GDPR)
You can:
- Ask for a copy of your data (access)
- Ask the Operator to correct mistakes (rectification)
- Ask the Operator to delete your data, subject to legal retention obligations (erasure)
- Ask the Operator to limit how it processes your data (restriction)
- Ask for your data in a portable format (portability)
- Object to processing based on legitimate interests
- Withdraw consent for processing based on consent
- Not be subject to solely automated decisions that significantly affect you
- Complain to the Portuguese data protection authority (CNPD) at www.cnpd.pt
The Operator responds within 30 days.
Cookies
The website uses essential cookies (to keep you logged in) and limited analytics cookies (to understand traffic patterns). The cookie banner on the site lets you choose what to allow.
Contact for privacy
legal@vbfactory.co. Mark privacy requests with "Privacy" in the subject line for fastest handling.
See also the full Terms of Service.