Third Vector Privacy Policy

Account data: name, email address, credentials, profile image, and session information, collected through our authentication provider when you create an account.

Workspace data: the content you and your team put into your workspace, including records, agent configurations (roles, schedules, budgets, trust levels), approvals, and connected-tool data that agents read and write on your instruction.

Agent memory: what an agent learns in your workspace (formats, rules, exceptions) is stored as memory scoped to that workspace.

Audit data: logs of agent runs, tool calls, approvals, and credit spend, with timestamps.

Design partner applications: name, firm name, firm type, email, and the work description you submit through our design partner form.

Correspondence: anything you send to hello@thirdvector.ai.

Technical data: IP addresses, request paths, and similar log data generated when you use the site or Service.

We do not collect sensitive data as defined by state privacy laws (such as racial or ethnic origin, health diagnoses, or biometric data), and we ask that you not submit it outside a customer workspace governed by the Data Processing Addendum. We do not use analytics trackers, advertising pixels, or session recording on our website.

To provide and operate the Service, including running agents you configure; to enforce budget caps and maintain the audit log; to secure the Service and prevent abuse, including rate limiting; to communicate with you about your account, the design partner program, or your inquiries; to comply with law. We do not sell personal data, we do not process personal data for targeted advertising, and we do not profile you in ways that produce legal or similarly significant effects. Because we do none of those things, browser opt-out signals such as Global Privacy Control have nothing to opt out of on this site; if that ever changes, we will honor them.

Agent work is performed using third-party model providers. Content that agents process reaches the provider's API to perform the work you configured. Under our agreement with our model provider, data submitted through the API is not used to train their models. If you bring your own provider key, that provider processes your data under your agreement with them.

With the subprocessors listed at thirdvector.ai/legal/subprocessors, which provide hosting, database, authentication, model inference, rate limiting, and email infrastructure; with professional advisers where necessary; with authorities where required by law; in connection with a merger, acquisition, or sale of assets, with notice. No other sharing. The categories of third parties we share with, and the categories of data each receives, are listed on the subprocessors page.

Account and workspace data are retained while your account is active and for up to thirty days after termination for export, then deleted subject to legal obligations and backup cycles. Audit logs are retained per your plan: seven days on Free, ninety days on Starter, one year on Pro. Design partner applications are retained while the program is active or until you ask us to delete yours. Email correspondence is retained as long as needed for the matter.

Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the founders. Budget enforcement, approvals, and audit logging are structural features of the Service. No system is perfectly secure; notify us at hello@thirdvector.ai of any suspected vulnerability.

Depending on where you live, you may have the right to confirm whether we process your personal data, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, or profiling (we do none of those three). To exercise any right, email hello@thirdvector.ai from the address associated with your data; we may need to verify your identity. We will respond within forty-five days. Where reasonably necessary we may extend once by a further forty-five days and will tell you why within the first period. Responses are free up to twice per year per person.

If we decline your request, we will tell you why and how to appeal. To appeal, reply to our decision with the word "appeal". We will respond in writing within sixty days with the action taken or the reasons for inaction. If we deny your appeal and you are a Virginia resident, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint. Residents of other states may contact their state attorney general.

If your data is in a customer's workspace, direct your request to that customer; we will assist them as their processor.

If you are in Canada, we handle your personal information consistent with applicable Canadian privacy law, including obtaining appropriate consent and honoring access and correction requests through the process in Section 7. Our processing takes place in the United States, which means your information is subject to United States law while stored there.

The Service is for business use and not directed to anyone under eighteen. We do not knowingly collect data from children.

We may update this policy. For material changes we will give notice, by email or in the product, before the change takes effect.