Legal

Privacy Policy

Effective 9 November 2026 · VE Ai, Inc.

This Privacy Policy explains how VE Ai, Inc. (a Delaware corporation, “Ve,” “we,” “our,” or “us”), together with our subsidiaries, collects, uses, discloses, and protects personal information when you use our macOS and iOS applications, the website at ve.ai, and our related services (collectively, the “Services”). It applies to individual end-users (“you”) and to individuals whose information is processed through our Services by a business customer.

This Privacy Policy supplements, and should be read together with, our Terms of Service.

Our Key Commitments

Ve does not sell your personal information.
Ve does not use your Inputs or Outputs to train foundation or generalized machine-learning models.
Ve does not use Google Workspace data for advertising.
Human access to your content is restricted and logged.
Where applicable law requires a lawful basis, specific consents, or data-subject rights, we honor them.

1. Who We Are and How to Contact Us

The controller of personal information processed under this Privacy Policy is VE Ai, Inc., 8 The Green, Suite R, Dover, DE 19901, United States.

For privacy inquiries, data-subject requests, and to reach our Grievance Officer under the Digital Personal Data Protection Act, 2023 (India):

Privacy inbox: Support@ve.ai
Postal address (U.S.): VE Ai, Inc., 8 The Green, Suite R, Dover, DE 19901, USA
Postal address (India operations): To be updated soon

2. The Information We Collect

We collect only the information we need to provide and improve the Services.

Account data Name, email address, account credentials, profile settings, organization affiliation.

Billing data Plan, subscription status, billing address, invoice history. Payment-card details are collected and stored by Stripe, Inc.; we receive only a tokenized reference.

Voice / Dictation data Audio captured from your microphone while dictation is active, and the resulting transcriptions.

Meeting data Audio, video, transcripts, prep notes, and summaries of meetings you choose to capture; participant names where available.

Email and calendar data Email contents, headers, attachments, and calendar events from accounts you connect (Google Workspace, Microsoft 365, etc.).

File data Files you upload to, store with, or share through the Files sub-product and their metadata.

Screen Recall data Screenshots and extracted text of on-screen content captured only when Screen Recall is enabled and for scopes you configure.

Usage and device data Device model, OS, application version, language, IP address, approximate location derived from IP, feature usage events, crash logs, and diagnostic data.

Support data Correspondence with our support team, including content you voluntarily share.

We do not intentionally collect: Social Security Numbers, taxpayer identification numbers beyond those required for billing, bank-account numbers, passport or driver-license images, health records, or other special-category information, except to the limited extent (for example, voice characteristics) that is inherent in features you choose to use.

3. How Each Sub-Product Handles Your Data

3.1 Dictation

When you hold to talk, audio is captured from your microphone and sent to Soniox, our speech-to-text sub-processor, which turns it into text. In most cases the audio goes straight from your device to Soniox and Ve receives only the text. Ve then cleans up the text with a model on Amazon Bedrock. Dictation is off by default and you control when it is on.

3.2 Meetings

You choose which meetings to capture. You are responsible for obtaining any consent from participants required by law. You may delete a meeting record at any time.

3.3 Intent Mails and Morning Brief

When you connect your email and calendar accounts, Ve reads messages, threads, and events to generate drafts, briefings, and the Morning Brief. We do not send email on your behalf except in response to your explicit instruction. Email contents are not used to train our models.

3.4 Files

Files you upload are stored in our cloud storage. We process file contents only to enable user-initiated features and to detect prohibited or abusive content consistent with our Acceptable Use Policy.

3.5 Screen Recall

Screen Recall is disabled by default. When enabled, Ve captures screenshots and derives text from them for scopes you configure. You can pause, disable, and bulk-delete Recall data at any time.

3.6 Routines and Simple Actions

These features orchestrate other sub-products on the schedules you configure. They do not collect new categories of information.

4. How We Use Personal Information

Provide, secure, and maintain the Services and your account;
Generate the Outputs you request;
Personalize your experience within your own account;
Prevent, detect, and respond to fraud, abuse, security incidents, and violations of our Terms;
Process payments, produce Invoices, and manage our business;
Communicate with you about the Services;
Improve the Services using de-identified or aggregated data;
Comply with our legal obligations.

Where GDPR applies, we rely on: performance of a contract with you; our legitimate interests; your explicit consent; and compliance with legal obligations. You may object to processing based on legitimate interests as described in Section 9.

5. AI Training, Model Providers, and What We Do Not Do

5.1 We Do Not Train on Your Data

We do not use your Inputs, Outputs, Customer Content, Google Workspace data, voice data, meeting data, screen-recall data, or email and calendar data to train foundation models, large language models, or other generalized machine-learning models. We do not permit our sub-processors to do so on our behalf.

5.2 How AI Features Work

When you use an AI feature, only the content that feature needs is sent to the AI sub-processor named in Section 6.1, and it is processed only to provide that feature. For mail this can include the sender, recipients, subject, body, earlier messages in the thread, attachment names, and text extracted from attachments.

Amazon Web Services, OpenRouter, Google, Perplexity, and Soniox each state that they do not use the data they receive through their APIs to train their models. OpenRouter sends Kimi requests only to the model hosts it lists as zero data retention, which OpenRouter states do not store prompts or responses after processing. Amazon Bedrock may keep content flagged by its automated abuse filters for up to 30 days; AWS states that this content is not shared with the model provider.

If you add your own AI account for Ask (Anthropic, OpenAI, an OpenAI-compatible service, or Amazon Bedrock), your question and the mail needed to answer it go directly from your device to that provider under your own account and that provider’s terms.

5.3 Product Improvement

We may use de-identified, aggregated signals to evaluate product performance and make improvements. These signals do not identify you.

On the sign-in screen of the Ve iOS app, directly above the Google and Outlook buttons, the app states that Ve sends your email to trusted third-party AI providers to sort your inbox, draft replies, answer Ask, and turn your voice into text. Tapping a sign-in button is your consent, given before any mailbox is connected. Those providers are the ones named in Section 6.1. If your account was created with an earlier version of the app, it shows the same statement once, with Continue or Sign out; Sign out pauses mail processing for your mailboxes on our servers and signs you out. To stop later, disconnect the mailbox in Settings > Connectors, or delete your Ve account in Settings.

We share personal information only as necessary to provide the Services and run our business. We do not sell personal information, we do not use it for advertising, we do not share it for cross-context behavioral advertising, and we do not use it to track you across other companies’ apps or websites.

6.1 Sub-processors

Amazon Web Services, Inc. Hosting of Ve’s servers and databases. Amazon Bedrock runs OpenAI models that receive mail content to sort, label, and summarize your mail, and dictated text to clean it up. United States.

Stripe, Inc. Payment processing and subscription billing. United States.

OpenRouter, Inc. Receives mail content to write reply drafts and briefs. Requests use Moonshot AI’s Kimi model, with Google Gemini as a backup. OpenRouter passes Kimi requests to a model host it selects from those it lists as zero data retention, such as Moonshot AI or Novita. Those hosts may process the request outside the United States, and they are bound through OpenRouter’s terms, not a contract with Ve. Company based in the United States.

Perplexity AI, Inc. Receives the short web searches Ve writes while preparing a draft. These searches can mention people or companies named in your mail. Company based in the United States.

Soniox, Inc. Receives audio when you hold to talk, to turn your speech into text. Soniox may process this data outside your country.

Google LLC Sign-in with Google and access to the Gmail mailbox you choose to connect. When Gemini is used as the backup model, Google also receives mail content, through OpenRouter, to write drafts and briefs. United States.

Microsoft Corporation Sign-in with Microsoft and access to the Outlook mailbox you choose to connect. United States.

Apple, Inc. Application distribution (App Store), push notifications (APNs). United States.

Customer-support tooling To respond to support inquiries. United States.

6.2 Scope of Sub-processor Responsibility

Ve performs reasonable due diligence on the sub-processors it contracts with directly and imposes written contractual obligations at least as protective as those in this Privacy Policy. Model hosts that OpenRouter selects are bound through OpenRouter’s terms and its zero-data-retention listing, not a direct contract with Ve. However, Ve is not liable for the independent acts or omissions of third parties that are not sub-processors acting under Ve’s direction.

6.3 Other Recipients

We may share personal information with (a) our professional advisors under confidentiality obligations; (b) parties to a merger, acquisition, financing, reorganization, or sale of assets; (c) authorities where we believe disclosure is necessary to comply with applicable law; and (d) parties to whom you direct us to share.

7. International Data Transfers

Ve is headquartered in the United States and has operational teams in India. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses. Where we transfer personal data of Indian residents outside India, we do so in compliance with the DPDP Act, 2023.

8. How We Protect Personal Information; Limits of Our Responsibility

8.1 Our Safeguards

We implement encryption in transit (TLS) and at rest (AES-256 or equivalent), role-based access controls, multi-factor authentication for administrative access, a documented incident-response program, continuous monitoring and logging, periodic risk assessments, vendor due diligence, and mandatory employee security and privacy training.

8.2 No Guarantee of Absolute Security

No system, service, or transmission is perfectly secure. Ve does not warrant or guarantee that our safeguards will prevent all unauthorized access, acquisition, alteration, disclosure, loss, or other misuse of personal information. Any liability of Ve arising from a security or data-protection event is subject to the limitations set out in the Terms of Service.

8.3 Your Responsibilities

You are responsible for safeguarding your credentials, configuring features appropriately, maintaining independent backups of Customer Content, and obtaining any consents from third parties required by law. Ve is not liable for losses caused by your failure to meet these responsibilities.

8.4 Breach Notification

If a personal-data breach affecting your personal information occurs, we will notify you and relevant authorities as required by applicable law.

9. Your Rights and Choices

9.1 Rights

Depending on where you live, you may have rights to:

Know what personal information we hold about you and obtain a copy;
Correct or update inaccurate or incomplete information;
Delete personal information in certain circumstances;
Restrict or object to certain processing;
Withdraw consent where processing is based on consent;
Data portability;
Opt out of “sale,” “sharing,” or “targeted advertising”;
Not receive discriminatory treatment for exercising your rights;
Lodge a complaint with a supervisory authority.

9.2 How to Exercise Your Rights

You can exercise these rights through your in-product settings or by emailing privacy@ve.ai. We will verify your identity before acting on your request and will respond within the time required by applicable law.

You can delete your Ve account and its data at any time in Settings.

9.3 Marketing Preferences

You can opt out of marketing emails by using the unsubscribe link or by emailing privacy@ve.ai. We will still send transactional and service-related messages.

9.4 Cookies and Tracking

Our website uses a limited set of cookies for essential site functions and anti-abuse. You can control cookies through your browser settings. Our products do not use cookies for advertising.

10. California Privacy Rights

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the “CCPA”). We do not “sell” personal information and do not “share” personal information for cross-context behavioral advertising. To exercise your CCPA rights, email privacy@ve.ai.

11. India: DPDP Act Notice

For individuals in India, Ve processes personal data as a “Data Fiduciary” under the Digital Personal Data Protection Act, 2023. Our Grievance Officer contact is given in Section 1. You may withdraw consent through in-product settings or by emailing privacy@ve.ai.

12. Children

The Services are not directed to children under 13 (or under 16 in the EEA and UK). We do not knowingly collect personal information from such children. If you believe a child has provided personal information to us, contact privacy@ve.ai.

13. Data Retention

We retain personal information only for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

Account data Life of the account, plus up to 30 days after closure.

Billing records Up to 8 years per tax and corporate-record requirements.

Mail from connected mailboxes (Gmail and Outlook) Ve syncs your mail to its servers and stores it there to provide the Services. Message content is kept for up to 30 days after Ve receives it, then deleted. Classifications, labels, and summaries made from it are kept for up to 90 days. Reply drafts Ve writes have their text removed 30 days after they are sent or discarded, and the draft record is deleted within 180 days. These limits apply whether or not the mailbox is still connected.

Voice, meeting, screen-recall, and file data Kept while the item exists in your account. Encrypted backup retention up to 90 days.

Diagnostic and log data Typically up to 90 days.

Support correspondence Up to 3 years from last interaction.

14. Automated Decision-Making and Profiling

We do not use personal information for solely automated decision-making that produces legal or similarly significant effects about you. AI features may generate suggestions, drafts, and summaries; you remain responsible for reviewing Outputs.

15. Third-Party Links and Integrations

The Services may link to or integrate with third-party services. Their privacy practices are governed by their own policies.

16. Google API Services User Data Policy

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only use Google user data to provide or improve user-facing features visible in the Services.
We do not transfer Google user data to third parties except as necessary to provide those features, comply with law, or in a merger/acquisition with notice.
We do not use Google user data for advertising.
We do not use Google user data to train generalized AI or machine-learning models.
We do not allow humans to read Google user data except: (a) with your explicit consent; (b) for security or compliance; (c) when required by law; or (d) where data is aggregated and anonymized for internal operations.

16.1 Use and Storage

Google user data, including the content of your Gmail messages, is synced to and stored on Ve’s servers on Amazon Web Services in the United States. It is stored only to provide the features you use and is kept for the periods in Section 13 (Data Retention). Ve sends it to the AI processors named in this policy only to provide those features. Storing Google user data to provide these features is consistent with the Google API Services User Data Policy, including the Limited Use requirements.

16.2 Disconnection and Deletion

You may disconnect your Google account from Ve at any time. Ve then stops reading your Google data, and the data already stored is deleted on the schedule in Section 13 (Data Retention). To have it deleted sooner, delete your Ve account or email privacy@ve.ai.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified at least 30 days in advance. The “Effective Date” at the top shows when the current version was published. The version effective 9 November 2026 corrects our description of our current practices, including how mail is stored and which processors receive it, and takes effect on publication. Future material changes will be notified at least 30 days in advance as described above.

18. Contact Us

If you have questions about this Privacy Policy, email Support@ve.ai or write to VE Ai, Inc., 8 The Green, Suite R, Dover, DE 19901, USA. For DPDP Act grievances, contact grievance@ve.ai.