Privacy Policy

1. Who We Are and What This Policy Covers

1.1 Bipath, LLC ("Bipath", "we", "us", "our") is a Delaware limited liability company whose principal place of business is 22 Walnut Park, Newton, Massachusetts 02458, USA. We operate Vector Data Loader, including vectordataloader.app, docs.vectordataloader.app and the Vector Data Loader application and APIs (the "Service").

1.2 Where we are the controller. This Policy explains how we handle personal information when we decide why and how it is processed. That covers: people who visit our websites; people who sign up for or use the Service ("Users"); billing contacts; people who contact us; and people who receive our emails.

1.3 Where we are a processor. The Service lets our business customers ("Customers") load documents and other content from their own systems into their own vector stores ("Customer Content"). Customer Content may contain personal information about our Customers' employees, clients or others. We process Customer Content on our Customer's behalf and on its instructions, under our Terms of Service and Data Processing Addendum. This Policy does not govern that processing; the Customer's own privacy notice does. If your personal information is in Customer Content, contact the relevant Customer. If you contact us instead, we will refer you to the Customer.

1.4 The Service is for business use only and is not intended for anyone under 18 (Section 13).

2. Personal Information We Collect

2.1 Information you give us

• Account and profile: name, email address, organization name, role, profile image, and settings. We sign you in with a one-time link sent to your email, or through Google or GitHub. We do not ask you to create a password.
• Sign-in through Google or GitHub: if you choose this, we receive your name, email address and profile image from that provider. We do not receive your password.
• Invitations: if a colleague invites you to an organization, they give us your email address.
• Billing: billing name, billing address, tax ID if any, and purchase history. Payment card details are collected and stored by our payment processor, Stripe. We receive only limited details, such as card brand, last four digits and expiry date.
• Connector credentials: OAuth tokens, API keys and other credentials you provide to connect your sources, AI providers and vector stores. We encrypt them at rest.
• Communications: messages you send us, such as support requests, feedback and legal or privacy requests.
• Terms acceptance: the version of our Terms you accepted, when you accepted it, the business capacity in which you accepted it, and the IP address and browser user agent used.

2.2 Information collected automatically

• Service logs and usage data: IP address, browser and device type, operating system, pages and features used, timestamps, request and error data, sync and job metadata (such as counts, sizes, durations and status), and credit usage.
• Location: approximate location (country or region) derived from your IP address, used to apply our Supported Countries and sanctions rules.
• Cookies and similar technologies: see Section 8 and our Cookie Policy.
• Marketing-site analytics and advertising tags (only with your consent): on our public marketing pages, and only if you accept them, Google Analytics and the Meta (Facebook and Instagram), TikTok and Reddit advertising tags collect information about your visit. That includes pages viewed, referring site, device and browser data, an online identifier, and events such as starting signup or completing a purchase. These tags are never loaded inside the signed-in application or on our documentation site.

2.3 Information from other sources

• Sign-in providers (Google, GitHub), as described above.
• Stripe, which tells us about payment status, chargebacks and fraud signals.
• Advertising and analytics providers, which give us aggregated reports about campaign performance.
• Your organization's owners and admins, who may add, change or remove your account and role.

3. How We Use Personal Information, and Our Legal Bases

The table below identifies our purposes and the legal bases we rely on where the EU or UK GDPR applies. We rely on contract only where the individual is a party to that contract and the processing is necessary for it. For employees and other representatives of a business Customer, our relevant legitimate interests generally include administering and supporting that business relationship. Swiss law has a distinct framework; where it applies, we comply with its processing principles and obtain any required consent or other justification.

Where we rely on legitimate interests, we have weighed them against your rights. You may ask us for details of that balancing and may object (Section 10).

Automated decisions. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

4. How We Share Personal Information

We do not sell personal information for money. We share it only as follows.

4.1 Providers that help us run the Service are listed below. Their role depends on the activity: some act as processors on our instructions and others act as independent controllers for their own legally specified purposes, including certain payment and fraud-prevention activities.

The current list of our subprocessors is at vectordataloader.app/legal/subprocessors.

4.2 Analytics and advertising partners (only with your consent): Google LLC (Google Analytics, Google Tag Manager), Meta Platforms, Inc. (Facebook and Instagram), TikTok, and Reddit, Inc. These partners may use the information their tags collect for their own purposes too, under their own privacy policies. In some US states, this may count as "sharing" or "targeted advertising" (Section 11). We never give these partners customer or user email lists or Customer Content.

4.3 Your organization. Your organization's owners and admins can see your account, role and activity in the organization.

4.4 Providers you configure. When your organization connects a source, AI provider or vector store, the Service transmits data according to that configuration. The applicable provider agreement, actual processing arrangement, law and Data Processing Addendum determine each provider's responsibilities; supplying a customer API key does not by itself establish its privacy role.

4.5 Sign-in and payment providers, as needed to authenticate you and process payments.

4.6 Legal and safety. We disclose information where we believe it is required by law, regulation, legal process or a governmental request, or is necessary to enforce our Terms, to protect the rights, property or safety of Bipath, our Customers or others, or to detect and prevent fraud, abuse or security incidents.

4.7 Business transfers. We may share information where necessary and legally permitted for a merger, acquisition, financing, reorganization or sale of assets, subject to appropriate confidentiality and data-protection safeguards. A successor remains subject to applicable law and restrictions on previously collected information. We will give any required notice and obtain any required consent before using information for a materially different purpose.

4.8 Professional advisers, such as lawyers, accountants and auditors, under confidentiality obligations.

4.9 With your consent, or at your direction.

5. International Transfers

We are based in the United States, and our Service is hosted there. If you are outside the United States, your personal information will be transferred to and processed in the United States and other countries where our providers operate, which may have different data-protection laws. For transfers from the EEA, UK and Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss equivalent, together with supplementary measures where needed. You can request a copy of the relevant safeguards at privacy@vectordataloader.app.

6. How Long We Keep Personal Information

We may keep information longer where the law requires it, or where it is needed to establish, exercise or defend legal claims (for example, under a legal hold). When retention ends, we delete or anonymize the information.

7. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (TLS), encryption of stored credentials, access controls, role-based permissions, and logging of staff access. No system is completely secure, and we cannot guarantee the security of your information. You are responsible for keeping your credentials safe.

8. Cookies and Similar Technologies

We use strictly necessary cookies to sign you in and keep the Service secure, and browser storage to remember your preferences. On our public marketing pages, and only if you consent, we use analytics and advertising cookies and tags. We honour the Global Privacy Control signal as a refusal of advertising cookies. You can change your choice at any time through "Cookie settings" in the website footer. Our Cookie Policy at vectordataloader.app/legal/cookies lists each cookie.

9. Your Marketing Choices

You can unsubscribe from marketing email through the link in any marketing email, or by writing to privacy@vectordataloader.app. You will still receive service and transactional messages, such as security alerts, billing notices and notices of changes to our Terms.

10. Your Rights (EEA, UK, Switzerland and Other Countries with Similar Laws)

10.1 Subject to the conditions and exceptions in applicable law, you may have the right to:

• access your personal information and receive a copy;
• correct inaccurate or incomplete information;
• erase your information;
• restrict our processing;
• receive your information in a portable format;
• object to processing based on legitimate interests. You may object to direct marketing at any time, and we will stop.
• withdraw consent at any time, without affecting processing that happened before;
• complain to a data-protection supervisory authority, in particular where you live or work or where an alleged breach occurred. For the UK this is the Information Commissioner's Office; for Switzerland, the Federal Data Protection and Information Commissioner.

10.2 How to exercise them: email privacy@vectordataloader.app. We may need to verify your identity before responding. We respond within one month, extendable where the law allows. If your request concerns Customer Content, we will refer it to the relevant Customer and support that Customer as its processor.

10.3 Managed accounts: if your account belongs to an organization, some requests, such as deleting an account the organization controls, may need your organization's involvement.

11. United States: State Privacy Rights

11.1 Scope. This Section applies to residents of California and other US states with consumer-privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others, to the extent those laws apply to us. Under California law it is our notice at collection.

11.2 Categories of personal information we collected in the last 12 months:

We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use under California law.

11.3 Sale, sharing and targeted advertising. We do not sell personal information for money. When you consent to advertising tags on our marketing site, the information those tags collect may count as "sharing" for cross-context behavioural advertising under California law, or as "targeted advertising" or a "sale" under other states' laws. You can opt out at any time by declining or withdrawing advertising cookies through "Cookie settings", by using the "Do Not Sell or Share My Personal Information" link in our website footer, or by enabling Global Privacy Control in your browser. We do not knowingly sell or share the personal information of anyone under 16.

11.4 Your rights. Depending on your state, you may have the right to: know what personal information we collect, use and disclose, and access a copy; correct inaccurate information; delete it; opt out of sale, sharing and targeted advertising; and not be discriminated against for exercising these rights.

11.5 Exercising your rights. Email privacy@vectordataloader.app. We will verify your request by matching information you give with information we hold. You may use an authorized agent, who must provide proof of authorization. We may also ask you to confirm your identity directly with us.

11.6 Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@vectordataloader.app with the subject "Privacy appeal". We will respond within the time the law requires. If you disagree with the outcome, you may contact your state attorney general.

11.7 Retention. See Section 6.

12. Other Regions

• Canada: we handle personal information under the Personal Information Protection and Electronic Documents Act and applicable provincial laws. You may contact us to access or correct your information, or to withdraw consent, subject to legal and contractual restrictions.
• Australia and New Zealand: we handle personal information under the Australian Privacy Principles and the New Zealand Information Privacy Principles. You may request access or correction, or complain to us, and then to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.
• United Kingdom and Switzerland: the EU GDPR, UK GDPR and Swiss Federal Act on Data Protection are distinct laws. The rights and duties described above apply to the extent provided by the law governing the relevant processing.

13. Age Restrictions

The Service is intended for business users aged 18 or over, and we do not knowingly allow children to register as Users. If you believe a child has registered or provided information to us directly, contact privacy@vectordataloader.app so we can investigate and take appropriate action. Personal information about minors may appear in Customer Content; we handle that information on the Customer's instructions under Section 1.3 and the Data Processing Addendum, subject to applicable law and the Acceptable Use Policy.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date. If a change materially affects how we use personal information we already hold, we will notify Users by email or in the Service before it takes effect.

15. Contact Us

• Privacy questions and requests: privacy@vectordataloader.app
• Postal: Bipath, LLC, Attn: Privacy, 22 Walnut Park, Newton, Massachusetts 02458, USA
• [EU representative under GDPR Art. 27: name and address, if appointed]
• [UK representative under UK GDPR Art. 27: name and address, if appointed]