Privacy Policy

The Gateway: Zero Data Retention

Vachi is an LLM gateway. It sits between your coding agent and the model provider you have chosen. Your agent sends a request to Vachi over TLS, Vachi reshapes the payload and forwards it to the provider over TLS, and the provider's response streams back to you unchanged. That traffic is the sensitive material, and we treat it accordingly:

• We do not retain your prompts or the model's responses. They are processed in memory as they pass through and are not written to disk, and we do not build a searchable history of them.
• We do not train on your traffic. Your prompts, your code, and the model's responses are never used to train, fine-tune, or evaluate any model, ours or anyone else's.
• We do not log request or response bodies. What we do record for each call is operational metadata: timestamps, the model you selected, token counts, status codes, latency, and errors. We use it to bill accurately, show you your usage, and keep the service running.
• The distillation cache is ephemeral. To make the next likely request faster, the reshaped payload is held in an in-memory cache with a short lifetime, on the order of minutes, the same way provider-side prompt caching works. It expires on its own, it is scoped to your account, and it is never used for training.
• Credentials pass through. API keys and OAuth tokens pass through Vachi to authenticate the call to your provider. We never log them.
• Self-hosted deployments. If Vachi runs inside your own VPC, none of the traffic described above reaches our network in the first place. In that arrangement we receive no prompts, no responses, and no per-request metadata.

Note that the model provider you choose receives your request in order to answer it, and handles it under its own terms and privacy policy. Vachi does not change that relationship.

Information We Collect

We collect information about you in the following ways:

• Information you provide to us: We collect information that you provide directly to us, such as when you create an account, sign up for our waitlist, request information, or communicate with us. This information may include your name, email address, company name, and other information you choose to provide.
• Information we collect automatically: When you use the Site or Services, we automatically collect certain information about your device and usage, such as your IP address, browser type, operating system, referring URLs, pages visited, and other similar information. We may also collect information about your interactions with the Services, such as the features you use and the content you view. For traffic that passes through the gateway, this is limited to the operational metadata described above; it never includes the contents of your requests or the model's responses.
• Information we collect from third parties: We may collect information about you from third parties, such as our partners and service providers. This includes the visitor identification services described under "Advertising, Analytics, and Cookies," which can tell us the company or professional profile associated with a visit that you did not identify yourself on.

Advertising, Analytics, and Cookies

We advertise, we measure whether those ads work, and we study how the Site itself is used. All of this applies to the marketing website and your account, never to traffic passing through the gateway. In detail:

• Product analytics. We use PostHog to understand how the Site and dashboard are used: pages viewed, elements clicked, how far down a page you scroll, and which features you reach. Before you have an account this is tied to a pseudonymous identifier; after you sign up it is associated with your account.
• Google Analytics and Google Ads. We use Google Tag Manager to load Google Analytics 4 and Google Ads conversion tags, which use cookies and similar technologies to help us analyze how visitors use the Site and to measure our advertising. For more information on how Google uses the data it collects through our use of these services, see How Google uses information from sites or apps that use our services. You can prevent your data from being used by Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Meta and LinkedIn. We also load the Meta Pixel and the LinkedIn Insight Tag. These set cookies and similar identifiers, and share data collected on the Site with Meta and LinkedIn for conversion tracking, website analytics, retargeting, and ad personalization. You can control how each platform personalizes ads to you in your ad settings with them: see the Meta Privacy Policy and the LinkedIn Privacy Policy.
• Session recording and heatmaps. We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. Additionally, we use this information for site optimization, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.
• Visitor identification. We use Factors.ai and RB2B to identify the companies, and in some cases the individual professional profiles, behind visits to the Site. When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout. You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out. See also the Factors.ai Privacy Policy.
• Attribution. When you arrive from an ad, a referral, or a campaign link, we record the campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the ad click identifiers in the URL (such as gclid, fbclid, li_fat_id, and msclkid), the referring URL, and the page you landed on. We keep these in your browser's local storage and attach them to your account if you create one, so a click can be connected to what happens later.
• Conversion measurement. When you take an action we are measuring, such as creating an account or upgrading, we report that event to the advertising platforms above. Some of these reports are sent from our servers rather than your browser. They are matched to the original ad click using the click identifier and a one-way SHA-256 hash of your email address. We do not send the platforms your raw email address, though a hash is still a persistent identifier for you, and each platform handles what it receives under its own privacy policy.

You can limit all of this. Each service above links to its own opt-out or privacy controls, and Meta, LinkedIn, and Google each offer ad and data settings in your account with them. Most browsers also let you block or delete cookies and clear local storage, and tracker-blocking extensions stop these tags from loading at all. Whatever you cannot switch off yourself, write to us at privacy@vachiai.com and we will handle it. Blocking cookies may break parts of the Site.

How We Use Your Information

We use your information for the following purposes:

• To provide and improve the Services: We use your information to operate, maintain, and improve the Site and Services, and to provide you with the features and functionality you request.
• To communicate with you: We may use your information to communicate with you about the Services, such as to send you updates, newsletters, and other information.
• To personalize your experience: We may use your information to personalize your experience on the Site and Services, such as by providing you with relevant content and recommendations.
• For marketing purposes: With your consent, we may use your information to send you marketing communications about our products and services.
• To comply with legal obligations: We may use your information to comply with applicable laws and regulations.

How We Disclose Your Information

We may disclose your information in the following circumstances:

• With your consent: We may disclose your information with your consent.
• With service providers: We may disclose your information to third-party service providers who perform services on our behalf, such as hosting, data analysis, product analytics, session recording, and email delivery.
• With advertising platforms: As described under "Advertising, Analytics, and Cookies," we disclose campaign and conversion information, including ad click identifiers and a hashed version of your email address, to Meta, LinkedIn, and Google so we can measure our advertising. We never disclose the contents of your gateway traffic to anyone for this or any other marketing purpose.
• For legal reasons: We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, or protect the personal safety of users of the Site or Services or the public.
• In connection with a business transaction: We may disclose your information in connection with a merger, acquisition, or sale of all or a portion of our assets.

Data Security

We take reasonable measures to protect your information from unauthorized access, use, or disclosure. However, no method of transmission over the Internet or method of electronic storage is completely secure. Therefore, we cannot guarantee the absolute security of your information.

Your Choices

You have the following choices regarding your information:

• Access and correction: You can access and update your information by contacting us at the address below.
• Marketing communications: You can opt out of receiving marketing communications from us by contacting us at the address below.
• Cookies, local storage, and advertising: See "Advertising, Analytics, and Cookies" above for what we set and how to limit it. You can disable cookies in your browser settings, though some features of the Site and Services may not function properly if cookies are disabled.

Children's Privacy

The Site and Services are not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at the address below.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post any changes on the Site and notify you as required by law.

Contact Us

If you have any questions about this Privacy Policy, please contact us at: