Privacy Policy

Account information

When you subscribe to VPods, we collect:

• Name and email address
• Company name and size
• Billing address
• Payment information (processed by Stripe, not stored by us)

Agent execution data

To operate agents, we collect:

• Code you ask agents to write (temporarily, during execution)
• GitHub commits (stored in your repository, not ours)
• Task assignments and specifications
• Kanban and project board updates
• Teams meeting transcripts (to understand context)

System data

Automatically collected:

• IP address and device information
• Log files (errors, performance metrics)
• Account activity (logins, subscription changes)
• Usage analytics (which agents you use, and how often)

Communication data

If you contact us:

• Email messages
• Support tickets
• Chat conversations
• Feedback and feature requests

Provide the VPods service

• Operate agents on your behalf
• Execute code and deployments
• Integrate with GitHub, AWS, and Microsoft Teams
• Track task progress and metrics
• Send billing invoices

Improve VPods

• Understand which features work best
• Identify bugs and errors
• Optimize agent performance
• Develop new capabilities
• Train Claude models only as described in the Amazon Bedrock section below

Security and compliance

• Detect and prevent fraud
• Comply with legal requirements
• Audit system access
• Enforce the Terms of Service
• Respond to security incidents

Communication

• Send billing notifications
• Notify you of service updates
• Respond to your support requests
• Announce new features (with opt-out)

Where your data lives:

Your data is never:

• Moved out of your GitHub repository by VPods as a system of record
• Moved out of your AWS account as a system of record
• Shared with third parties for marketing
• Used for model training without the notice in this policy
• Sold or licensed to others

VPods uses Amazon Bedrock to access Claude.

Bedrock’s data policy, as we apply it here:

• Input and output to Claude may be used to improve the model under the provider’s then-current terms
• That handling is governed by Amazon Bedrock and Anthropic, not by a VPods-only setting
• Data is handled according to those providers’ anonymization and retention rules
• You cannot opt out of provider-level Bedrock processing while using this model path

If you cannot accept this:

• Contact us about alternatives
• We may support other model options in future
• VPods still treats your product data as described in the rest of this policy

We connect to services you choose.

GitHub

• We read and write your repository
• GitHub retains data per their privacy policy
• We do not control GitHub’s data handling

Amazon AWS

• Agents deploy to your AWS account
• AWS retains logs per their privacy policy
• You control what agents access

Microsoft Teams

• Agents join meetings and read transcripts
• Microsoft retains meeting data
• We store transcripts only while agents are active

Stripe

• Processes payments
• Handles PCI compliance
• Card numbers are not stored by VPods

Amazon Bedrock

• Hosts the Claude model
• May process inputs under Bedrock’s privacy terms
• See Amazon’s Bedrock privacy documentation

Review each service’s privacy policy before you connect it.

When you cancel

• Immediate: access is terminated
• 30 days: you can export everything
• 90 days: execution logs are deleted
• 1 year: remaining VPods data is deleted, except backups, which are then held 30 more days

Encryption

• Data in transit: TLS 1.2+
• Data at rest: AES-256
• Database: encrypted
• Backups: encrypted

Access controls

• Role-based access (least privilege)
• Multi-factor authentication required where the identity provider supports it
• Access is logged
• Regular audits

Infrastructure

• AWS security practices
• VPC isolation
• No unnecessary public internet exposure
• SOC 2 audit scheduled (2026)

What we do not do:

• Store passwords in VPods (you authenticate through the identity provider we configure, such as Cognito, GitHub, or AWS)
• Store payment card details (Stripe handles this)
• Share your credentials with agents as a standing secret store
• Intentionally log API keys or other secrets

You have the right to:

Access your data

• Request what we hold about you
• Email privacy@vpods.ca with “Data Request”
• We respond within 30 days

Correct inaccurate data

• Update your account information
• Request corrections to records
• Email privacy@vpods.ca to request changes

Delete your data

• Cancel your subscription
• VPods-held data is deleted on the schedule in Data retention
• GitHub and AWS data remains under your control

Export your data

• Download your information
• Available after account closure for 30 days
• Export format: JSON or CSV

Opt out of marketing

• Unsubscribe from promotional emails
• A link is included in every marketing email
• The preference is saved immediately

Data portability

• Request your data in a machine-readable format
• Use it to move to another service
• Email privacy@vpods.ca to request an export

If you are in the EU or EEA

VPods complies with GDPR.

• You have data subject rights described above
• Data transfers are safeguarded
• We use Standard Contractual Clauses where required
• Privacy by design is our approach

For GDPR requests, email gdpr@vpods.ca.

If you are in Canada

VPods complies with PIPEDA.

• You have privacy rights under applicable Canadian law
• Personal information is handled for identified purposes
• You may request access to your information

For PIPEDA requests, email privacy@vpods.ca.

Other jurisdictions

We comply with applicable laws including CCPA (California), LGPD (Brazil), and other regional privacy laws that apply to us.

VPods is not intended for anyone under 18.

If we learn a child under 18 is using VPods, we will delete that account. Parents concerned about a child’s use should email privacy@vpods.ca immediately.

We may update this policy.

• Material changes: 30 days’ notice by email when we have an address
• Minor changes: posted immediately on this page
• Continued use after the effective date is acceptance of the revised policy

Questions about privacy?

• Email: privacy@vpods.ca
• Mailing address: VPods Inc., Montreal, Quebec, Canada
• GDPR data protection officer: gdpr@vpods.ca
• Canada privacy officer: privacy@vpods.ca
• Response time: 30 days maximum

• Your code is yours (stored in GitHub)
• Your infrastructure data is yours (stored in your AWS account)
• We only see what agents need to execute
• We do not sell your data
• Claude processing follows Amazon Bedrock’s terms
• You can access, delete, or export VPods-held data as described above
• We comply with GDPR, PIPEDA, and CCPA where they apply
• Encryption and access control are standard practice

We take privacy seriously. Questions? Email privacy@vpods.ca.