Vysto Privacy Policy

Document: Privacy Policy Version: 1.0 Effective date: 23 October 2026 Status: Published Related documents: Terms of Service, Refund and Cancellation Policy, Cookie & Tracking Notice

This policy explains how Vysto LLC (“Vysto,” “we,” “us”) handles personal data on vysto.ai, in the Vysto platform, and in sites Customers publish on the platform.

1. The short version of the roles

Two different relationships matter.

When we deal with a Customer. If you create an account, start a trial, pay an invoice, or email us about the product, Vysto is the controller of that account, billing, and support data.

When a Visitor uses a Customer’s site. The Customer decides why that site exists and what it asks people. The Customer is the controller of Visitor personal data. Vysto is the processor. We host the site, run the conversation, store Nuggets, and handle speech and text on the Customer’s instructions. We do not sell that data, and we do not use it to advertise our own products to Visitors.

If you are a Visitor and you want to exercise a privacy right about a conversation on a business’s Vysto site, start with that business. They control the data. We help them respond. If you cannot reach them, contact privacy@vysto.ai and we will either pass the request on or handle it if we are the controller for that data.

A Customer’s own privacy notice governs the Customer’s Visitors. Customers must publish one. This policy is Vysto’s, not a notice a Customer can copy into its site and leave at that.

2. Who this covers

• Customers and Authorized Users: people who administer a workspace, sign in to the admin, or connect an assistant through Vysto MCP.
• Visitors: people who open a site a Customer publishes, whether they type, speak, submit a form, or only load a page.
• Channel partner applicants: people who apply to the channel partner program, including through the application form that links to this policy. Vysto is the controller of what they submit. This policy covers that form.
• Other contacts: people who email us, apply to work with us in any other role, or appear in a support thread.

The platform is for businesses. We do not intend to collect personal data from children under 13. Customers must not direct a site at children under 13 or submit a child’s personal data unless we have agreed in a signed writing.

3. Personal data we collect

3.1 From Customers and Authorized Users

• Identity and account data: name, email, company, role, workspace name, and the record of Terms acceptance (who accepted, when, and which version).
• Billing data: plan, invoices, tax details, and payment status. Card numbers are entered into Stripe. We do not store full card numbers.
• Workspace data: Nuggets, pages, branding, uploaded media, imported website content, domain settings, form definitions, and MCP credentials (stored so they can be checked, and shown only in limited form after creation).
• Product usage: feature use, plan limits, timestamps, and security logs of administrative access.
• Support and sales correspondence.

3.2 From Visitors

• Conversation data: what a Visitor types, the transcript of what a Visitor says, the replies, the language chosen, and related session context.
• Voice data: the audio of an utterance, processed as Section 4 describes.
• Technical data: IP address, user agent, coarse device and browser data, timestamps, and a session identifier used to count the visit. The Cookie & Tracking Notice explains that identifier.
• Form and commerce data the Customer chooses to collect, such as a name, email, or message submitted through a form the Customer configured.
• Referral data such as the page address, only as needed to operate and secure the site.

3.3 From channel partner applicants

The channel partner application form collects what the applicant submits: name, business, contact details, and the answers on the form. We use that information to review the application, decide whether to accept the applicant, and contact them about the partner program. The form is covered by this policy. Applicants can ask us to delete an application that we are not required to keep, by writing to privacy@vysto.ai.

3.4 From other sources

We receive payment confirmation and limited billing identity from Stripe. We may receive data from an assistant the Customer connects (for example an instruction sent through MCP). On the channel partner landing page, LinkedIn, Meta, and Google receive the identifiers their tags collect when those tags are allowed to run, as the Cookie & Tracking Notice describes. We do not buy personal data from data brokers.

4. Voice processing

Conversational plans can accept speech and speak back, in the languages the product supports.

When someone speaks:

• the audio is sent to speech services we engage so we can transcribe the utterance and, if the experience replies out loud, synthesize speech;
• we use the transcript to answer and to operate the Customer’s site;
• we do not create a voiceprint;
• we do not enroll anyone’s voice;
• we do not use audio to identify who is speaking, or to infer sensitive characteristics from a voice.

Retention of raw audio (drafted position, not yet a confirmed product decision). Raw audio is used to produce the reply for that turn. We do not keep raw audio after that reply has been produced. We do not build a reusable voice profile. The text transcript may be kept with the conversation, as Section 8 describes, because the Customer’s site and history depend on it.

Customers who turn voice on must tell Visitors, before the microphone is used, that the conversation is processed as speech and must link the notice the Customer gives its Visitors. Customers must not configure Vysto to identify a person by voice.

If this retention position changes, we will update this policy and the version number before the change applies, and we will give Customers the notice Section 13 requires.

5. How we use personal data

As a controller (account, billing, our own site, and our own correspondence), we use personal data to:

• provide accounts, trials, billing, and support;
• authenticate users and keep MCP credentials safe;
• secure the platform, prevent abuse, and debug failures;
• understand product performance in aggregated or de-identified form;
• send service messages, including billing, security, and changes to these policies;
• send product messages a Customer can opt out of;
• review channel partner applications and contact applicants about the program;
• measure visits to the channel partner landing page, and retarget those visits, only where the Cookie & Tracking Notice allows the tags to run;
• comply with law and enforce the Terms.

As a processor of Visitor data, we use personal data only to provide, secure, and support the Customer’s site, on the Customer’s instructions, including the Terms and the settings the Customer chooses in the product. Instructions include hosting content, running conversations, counting visits against the plan, translating, generating speech, delivering form submissions to the Customer, and protecting the service from abuse.

We do not use Visitor conversations to advertise to Visitors. We do not use Customer Content or Visitor conversations to train foundation models for our own or a provider’s general model, except where a provider’s enterprise terms already forbid that and we have contracted on those terms, or where a Customer has opted in in writing. The drafted position is: no training on Customer Content or Visitor conversations. Confirm this against each provider contract before publication.

6. Legal bases

Where the GDPR or UK GDPR applies to Vysto as a controller, we rely on:

• contract, to provide the account and take payment;
• legitimate interests, to secure the platform, prevent fraud, understand aggregate product use, and communicate service changes, balanced against the person’s rights;
• legal obligation, for tax, accounting, and lawful requests;
• consent, where we ask for it, including optional marketing email and the advertising and analytics tags on the channel partner landing page.

Where we are a processor, the Customer is responsible for the legal basis for Visitor data. We rely on the Customer’s instructions.

Where the CCPA/CPRA applies, we do not sell personal information for money. On the channel partner landing page, the LinkedIn, Meta, and Google tags described in the Cookie & Tracking Notice may “share” personal information for cross-context behavioral advertising. Those tags do not run on Customer sites, and they do not use Customer Content or Visitor conversations. A visitor can opt out of that sharing as the Cookie & Tracking Notice describes, including by a Global Privacy Control signal.

7. Who we share data with

We share personal data with the following categories of recipients:

• Infrastructure. Amazon Web Services hosts the platform and stored assets, including in US East (N. Virginia) for production assets.
• Model providers. OpenAI and xAI (Grok) process prompts and completions when a conversation or generation feature calls those models.
• Speech. ElevenLabs processes audio and text for transcription and spoken replies.
• Payments. Stripe processes payment card data and subscription billing.
• Email. Amazon SES sends transactional email. Zoho is used for business email and related customer correspondence.
• Advertising on the channel partner landing page only. LinkedIn, Meta, and Google receive the technical data and identifiers their tags collect when those tags are allowed to run. They do not receive Customer Content or conversations from a Customer’s site.
• The Customer. Visitor submissions, transcripts, and form contents are available to the Customer that operates the site. Assistants the Customer connects through MCP receive the content the Customer’s credentials request.
• Professional advisers and authorities. Lawyers, accountants, and public authorities when the law requires it or when it is necessary to protect rights and safety.
• A successor. A buyer of the business, under a duty to honor this policy.

The working subprocessor list for personal data is: AWS, OpenAI, xAI (Grok), ElevenLabs, Stripe, Zoho, and Amazon SES. Vysto will publish this list at its own stable URL, with a commitment to notify Customers before a material addition takes effect. Until that page exists, this Section 7 is the list. A Customer may object to a new subprocessor on reasonable data-protection grounds by writing to privacy@vysto.ai within the notice period. If we cannot reasonably accommodate the objection, the Customer may cancel the affected service.

We require subprocessors who handle personal data to protect it and to use it only for the services they provide to us. A standalone page does not change the obligation to keep this policy accurate.

8. Retention

We keep personal data only as long as the purpose requires, including legal, tax, and security needs.

Deletion from production means the workspace is no longer served and is not available to the Customer’s admins. It may persist in encrypted backups until the backup expires.

9. Security

We protect personal data with measures appropriate to the platform, including:

• encryption in transit (TLS) and encryption at rest through the hosting environment;
• logical isolation of tenant workspaces, so one Customer’s credentials do not grant access to another Customer’s content;
• access control for our personnel and administrative tools, limited to people who need access to operate the service;
• logging of administrative access;
• backups for disaster recovery;
• a process to investigate and notify a confirmed personal-data breach as Section 11 of the Terms describes.

Vysto has SOC 2 Type II readiness in progress. No attestation has been issued. This policy does not state that Vysto is SOC 2 compliant.

No method of transmission or storage is perfectly secure. Customers are responsible for protecting their own passwords, API keys, and MCP credentials, and for the access they grant to connected assistants.

10. International transfers

We are established in the United States and host on infrastructure in the United States. If you access the platform from another country, your personal data is processed in the United States. Where we transfer personal data from the EEA, the UK, or Switzerland to a country without an adequacy decision, we use an approved transfer mechanism, such as the European Commission’s standard contractual clauses and the UK addendum, including through our subprocessors’ terms.

Customers in those regions who need a signed transfer schedule should request the Data Processing Agreement. The standing DPA, once published, is incorporated into the Terms.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export personal data, to object to or restrict certain processing, to withdraw consent, and to appeal a decision, and the right not to be discriminated against for exercising a right.

Customers can access and correct most account data in the product, and can request export or deletion at privacy@vysto.ai. Deletion of a workspace follows the Refund and Cancellation Policy. We may refuse a request that we must keep for tax, security, or legal reasons, and we will say so.

Visitors should contact the Customer that operates the site. If you contact us, tell us the site address and what you are asking. We will forward the request to the Customer or, if we are the controller, handle it ourselves. We may need to verify the request.

California residents may request access to and deletion of personal information we hold as a controller, and may use an authorized agent where the law allows. We do not sell personal information for money. The only “sharing” for cross-context behavioral advertising is the channel partner landing page tags described above, and a visitor can opt out of it. We do not knowingly sell or share personal information of minors under 16.

You may lodge a complaint with a supervisory authority. We ask that you contact us first so we can try to resolve it.

12. Marketing

We send service email (billing, security, policy changes) because the account requires it. Product news is optional. You can unsubscribe from product news in the message. Service email continues while you have an account.

We do not use Visitor conversation data, or any data from a Customer’s site, for Vysto marketing. Advertising measurement on the channel partner landing page is limited to that page, as the Cookie & Tracking Notice describes.

13. Changes to this policy

We will post the new version with a version number and an effective date. If a change is material, we will notify Customers before it takes effect, with at least 15 days’ notice unless a shorter period is required for security or law. The notice goes to the account email or is shown in the product. The history of published versions will be available from the legal index once the pages are live.

14. Contact

Vysto LLC 1918 University Business Drive, Unit 513 McKinney, TX 75071 Privacy: privacy@vysto.ai Legal: legal@vysto.ai