The short version
- We collect what is needed to run your account and show your documents to the people you choose.
- We do not sell data, show ads, or use your content to train AI models.
- No tracking cookies. Analytics are cookieless and respect Do Not Track and Global Privacy Control.
- Your data is stored in the United Kingdom, with a few service providers listed below.
What we collect
Account
Your email address and a securely hashed password, or, if you sign in with Google, your Google account email, name and profile picture link. We also keep when you signed up and last signed in, and your workspace and project memberships and roles.
Your content
Documents, prototypes and files you or your assistants publish, their versions, titles, folders and messages; comments and replies; invitations you send (including the invitee’s email address); public links you create; and preview images we render of your documents.
Connections
Assistants you connect and the access you approved, and API tokens you create. We store tokens only as hashes.
Activity and security records
A record of significant actions (for example publishing, sharing, comment status changes and access changes) with the account that took them; usage counters that enforce service limits; and, for a few minutes, which signed-in people are viewing a document, so viewers can see each other. Our hosting providers process IP addresses, browser details and request times in their logs to deliver the service and protect it from abuse.
Analytics
Cookieless page analytics from Vercel: the page visited (with document and private link addresses removed), referrer, campaign tags, country, and browser and device type. For signed-in pages we also sample performance timings in coarse categories, without document contents or addresses. Neither runs if your browser sends Do Not Track or Global Privacy Control.
Email to us
Whatever you send to hello@vitrines.dev, kept as long as needed to deal with it.
Why we use it
| Purpose | Legal basis |
|---|---|
| Running your account, storing and showing your content, sending account emails | Performing our contract with you (the Terms) |
| Security, abuse prevention, service limits, enforcing the Terms | Our legitimate interest in a safe, reliable service |
| Cookieless analytics and performance measurement | Our legitimate interest in understanding and improving the service; you can opt out with Do Not Track or Global Privacy Control |
| Answering requests and legal obligations | Legal obligation, or our legitimate interest in responding |
Who can see it
People you share with. Members of your workspace and projects, invitees and anyone with a public link you created see the content you share with them, along with your name or email as its author and on your comments.
Service providers. These companies process data for us under data processing terms and only to provide their service:
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts and sign-in, database, file storage | United Kingdom (London) |
| Vercel | Hosting, request routing and security filtering, cookieless page analytics | Application in the United Kingdom (London); requests pass through Vercel’s global network |
| Resend (via Amazon Web Services) | Account emails: confirmation, password reset, invitations | Sent from Ireland (EU); Resend is a US company |
| Hetzner | Server that renders preview images of documents in an isolated sandbox | Germany (EU) |
| “Continue with Google” sign-in, only if you choose it; the mailbox that receives messages sent to us | Google’s global infrastructure | |
| Forward Email | Forwards messages sent to our contact address | United States |
Assistants you connect read and write content within the access you approve. Their providers handle that data under their own terms.
Authorities, only where the law requires it.
International transfers
Data is stored in the United Kingdom, which the EU recognises as providing adequate protection. Some providers (Vercel, Resend, Google, Forward Email) are US companies or operate globally; transfers to them rely on the safeguards in their data processing terms, such as the EU Standard Contractual Clauses and the UK addendum or the EU-US Data Privacy Framework.
How long we keep it
- Account and content: while your account exists. Documents you move to the trash can still be restored and stay until your account is deleted.
- Viewing presence: a few minutes.
- Activity records and usage counters: while your account exists. After deletion, records that remain in other people’s workspaces no longer identify you.
- Provider logs: per each provider’s retention, typically days to weeks.
- Backups: encrypted backups of the database and files are kept for up to 90 days, then deleted.
Deleting your account
Delete your account yourself from Account, or write to hello@vitrines.dev from the address you use with vitrines and we will do it within one month. Deletion removes, immediately:
- your sign-in account, email address and name;
- workspaces where you are the only member, with all their projects, documents, versions, files, previews, comments and public links;
- your tokens, assistant connections and pending invitations.
In workspaces you share with others, the documents belong to that workspace and stay; your membership is removed and your comments and activity are shown as “Deleted user”. Author labels on versions you published there may remain as part of that workspace’s history. If you are the owner of a workspace with other members, remove them or tell us who should take it over first. Stored files are removed from storage shortly after, and deleted data leaves our backups within 90 days.
Your rights
Depending on where you live, including under the UK and EU GDPR, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or give it to you in a portable format. You can download any document version yourself. Write to hello@vitrines.dev; we answer within one month and may ask you to confirm the request from your account email. You can also complain to your data protection authority, for example the UK Information Commissioner’s Office or the authority in your EU country.
Other people’s data in your documents
If you publish documents that contain information about other people, such as clients or colleagues, you decide what is in them and who sees them; for that data we act on your behalf. People who want their information removed from such a document should contact its publisher, or write to us and we will forward the request.
Cookies and browser storage
We only use what is strictly necessary or that you choose, so there is no cookie banner:
- Sign-in cookies keep you signed in. They are removed when you sign out.
- Local storage remembers display preferences such as theme, only on your device.
We do not use advertising or cross-site tracking cookies. Analytics are cookieless.
Children
vitrines is not intended for anyone under 16, and they must not create an account. If you believe a child has given us personal data, contact us and we will delete it.
Security
Connections are encrypted, passwords and tokens are stored only as hashes, projects are private by default, published HTML runs in a restricted sandbox, and backups are encrypted. No system is perfectly secure; report concerns as described on the Contact page.
Changes to this policy
We will post updates here with a new date and, for material changes, tell account holders by email or in the product before they take effect.