Privacy Policy
Vestora Inc. (“Vestora”, “we”, “us”) builds and operates investor-relations websites, dashboards, and tools for public companies, digital-asset treasuries, and funds. This policy explains how we handle personal information on vestora.xyz (the “Site”) and across the Vestora platform.
01 Information we collect
Information you give us
- Contact & demo requests — when you book a call, request a demo, or email us, we collect your name, email address, company, and anything you choose to include in your message.
- Email updates — if you subscribe to updates, we collect your email address and confirm it via a double opt-in.
- Engagement correspondence — information exchanged while scoping or delivering a project.
Information collected automatically
- Usage & device data — IP address, browser and device type, pages viewed, referring page, and timestamps, collected through server logs and privacy-respecting analytics.
- Cookies & local storage — a small number of functional items (for example, your light/dark theme preference is stored locally in your browser). See §4.
Information we process for clients
When operating a client’s investor-relations platform, we may process investor and contact data (for example, holder, analyst, and press records, and engagement history) on that client’s behalf and under their instructions. We do not use that data for our own purposes.
02 How we use information
- Respond to your enquiries, schedule calls, and provide the information you request.
- Provide, operate, secure, and improve the Site and our services.
- Send updates you have asked to receive (you can unsubscribe at any time).
- Detect, prevent, and investigate fraud, abuse, and security incidents.
- Comply with legal obligations and enforce our agreements.
We do not sell your personal information, and we do not use it for unrelated advertising.
03 Legal bases
Where the GDPR or similar laws apply, we rely on: your consent (e.g. marketing emails); performance of a contract (e.g. responding to a request or delivering a project); our legitimate interests in operating, securing, and improving our business; and compliance with legal obligations. You may withdraw consent at any time without affecting prior processing.
06 Sub-processors
We use a small number of trusted providers to run the Site and our services. As of the date above these include:
- Vercel — website hosting and content delivery.
- Calendly — demo and meeting scheduling.
- Email delivery provider — transactional and subscription email.
- Infrastructure & database hosting — for the operated platform, on access-controlled, encrypted servers.
Providers may change as our stack evolves; we maintain confidentiality and data-protection terms with each.
07 Data retention
We keep personal information only as long as needed for the purposes above — to maintain our relationship with you, meet legal and accounting obligations, and resolve disputes — and then delete or anonymise it. Data processed on behalf of a client is retained per that client’s instructions and our agreement with them.
08 Security
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the data — including encryption in transit and at rest where appropriate, access controls, isolation of client investor data, audit logging, and encrypted backups. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify affected parties of material incidents as required by law.
09 Your rights
Depending on where you live (including under Canada’s PIPEDA, the GDPR, and the CCPA/CPRA), you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, contact us using §10 — we will respond within the timeframe required by applicable law. You also have the right to complain to your local data-protection authority.
Children
The Site and our services are intended for businesses and professionals and are not directed to children. We do not knowingly collect personal information from children.
International transfers
Vestora is based in Canada and our providers may process data in Canada, the United States, the EU, and elsewhere. Where required, we put appropriate safeguards in place for cross-border transfers.
Third-party links
The Site links to third-party sites (such as client platforms and scheduling tools) that have their own privacy policies. We are not responsible for their practices.
10 Contact & changes
Questions, requests, or concerns about this policy or your data can be sent to privacy@vestora.xyz. We are Vestora Inc., a company incorporated in Canada.
We may update this policy from time to time. Material changes will be reflected by the “last updated” date above and, where appropriate, by additional notice. Your continued use of the Site after an update constitutes acceptance of the revised policy.