vTilt, Inc. ("vTilt", "we", "us", or "our") provides a conversion intelligence platform that helps businesses understand visitor behavior on their own websites and applications and act on it in real time. This Privacy Policy explains what personal data we collect, how we use and share it, and the choices and rights available to you.
This policy covers three groups of people:
- Visitors to our own websites (vtilt.com and app.vtilt.com).
- Customers — businesses and individuals who create a vTilt account and use the platform.
- End Users — visitors and users of our Customers' websites and applications, whose data we process on our Customers' behalf.
#The two roles we play
vTilt handles personal data in two distinct legal roles. Which sections of this policy apply to you depends on which group you are in.
| Role | Whose data | What it covers |
|---|---|---|
| Data controller | Visitors and Customers | Data we collect for our own purposes: your vTilt account, our websites, billing, support, and marketing. |
| Data processor (service provider) | End Users | Data collected through the vTilt SDK and related features installed on a Customer's website or app. The Customer is the controller and decides what is collected and why; we process it on their documented instructions. |
If you are an End User of a website that uses vTilt, the site operator — not vTilt — controls that data. Please direct privacy questions and requests (access, deletion, objection) to the operator of the website you visited. We support our Customers in fulfilling such requests.
#Information we collect as a controller
#Account and workspace information
When you create an account we collect your name, email address, and authentication credentials, along with workspace details such as your organization name, your role, and the members you invite.
#Product usage on our own sites
We use vTilt on our own websites (we use our own product). This collects the same categories of behavioral data described in the End User section below — pages viewed, interactions, device and browser information, and approximate location derived from IP address — and is used to operate, secure, and improve our sites and to personalize your experience on them.
#Communications
When you contact us for support or sales, we keep the correspondence and any information you choose to provide.
#Billing information
vTilt offers a free plan. If you purchase a paid plan, payments are handled by a third-party payment processor; we receive transaction confirmations and billing contact details but do not store full payment card numbers.
#Information we process on behalf of Customers
When a Customer installs the vTilt SDK on their website or app, we process the following categories of End User data on the Customer's behalf and under their configuration:
- Events and interactions — page views, clicks, form interactions, scrolls, custom events the Customer defines, and web performance metrics.
- Device and technical data — browser type, operating system, screen size, language, referring page, and IP address (also used to derive approximate location).
- Identifiers — a pseudonymous visitor identifier, and, where the Customer chooses to identify users, attributes such as name or email address.
- Session replays — reconstructions of page interactions, where the Customer enables session recording. Text inputs are masked by default; masking behavior is controlled by the Customer's configuration.
- Conversations and messages — chat messages exchanged with the Customer's site and interactions with campaign emails sent through vTilt (such as opens, clicks, and replies).
- Advertising attribution data — campaign parameters and ad click identifiers (for example UTM parameters and platform click IDs) present on the pages an End User visits.
- AI-generated summaries — behavioral summaries and derived signals that vTilt's AI features produce from the data above.
We process this data only to provide the service to the Customer, in accordance with our agreement with them. We do not use End User data to build advertising profiles, and we do not sell it.
#How we use information
We use personal data to:
- provide, operate, secure, and maintain the vTilt platform;
- power product features, including analytics, session replay, chat, campaigns, and AI-driven summaries and personalization;
- authenticate users and prevent fraud and abuse;
- respond to support requests and communicate about the service;
- send administrative and, with your consent where required, marketing communications;
- monitor and improve performance and develop new features; and
- comply with legal obligations and enforce our agreements.
#AI features
vTilt uses large language models to summarize behavior, answer questions about your data, and generate personalized content. Data sent to AI model providers is transmitted through their business APIs under terms that prohibit the providers from using it to train their models. AI output is generated automatically and may be inaccurate; Customers are responsible for reviewing AI-assisted content before relying on it.
#How we share information
We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. We share data only with:
- Service providers (subprocessors) that host and operate the platform under our instructions — including cloud hosting and content delivery (such as Vercel), cloud storage (such as Amazon Web Services), managed database and caching providers, AI model providers (such as OpenAI), transactional email delivery (such as Resend), and realtime messaging infrastructure (such as Ably). A current list of subprocessors is available on request.
- Third-party platforms you connect — such as advertising or email platforms — only at the direction of the Customer who connects them (see the next section).
- Legal and safety recipients, where required by law or necessary to protect the rights, safety, or property of vTilt, our Customers, or others.
- Successors in connection with a merger, acquisition, or sale of assets, subject to this policy.
#Advertising platform integrations
Customers may connect third-party advertising accounts (for example Google Ads or Meta Ads) to vTilt. When you do:
- vTilt accesses the connected account only at your direction, to provide the features you use — such as reading campaign performance or making changes you initiate.
- Authorization tokens are stored encrypted, and account changes made through vTilt are logged.
- Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Our use of information received from Meta platforms adheres to the Meta Platform Terms.
You can disconnect an integration at any time from your project settings, which deletes the stored authorization tokens.
#Cookies and similar technologies
Our own websites use strictly necessary cookies for authentication and session management, preference cookies, and our own vTilt analytics as described above. The vTilt SDK on Customer sites uses cookies or local storage to maintain the pseudonymous visitor identifier; its behavior — including consent handling — is configured by the Customer.
#Data retention
We retain Customer account data for as long as the account is active and as needed to comply with legal obligations. End User data processed on behalf of a Customer is retained according to the Customer's configuration and our agreement with them, and is deleted or returned when the Customer's account is terminated, typically within 90 days. We may retain aggregated or de-identified information that no longer identifies any person.
#Security
We protect personal data with technical and organizational measures, including encryption in transit (TLS) and at rest, encrypted storage of integration credentials, role-based access controls, and audit logging of sensitive operations. No system is perfectly secure; we encourage you to use a strong, unique password and to report any suspected vulnerability to us.
#International data transfers
vTilt is operated from the United States, and data may be processed in the United States and other countries where our subprocessors operate. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission's Standard Contractual Clauses.
#Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent where processing is based on consent.
- EEA, UK, and Switzerland (GDPR) — you may exercise the rights above and lodge a complaint with your local supervisory authority.
- California (CCPA/CPRA) — you have the right to know, correct, and delete personal information, and the right to non-discrimination for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA.
To exercise your rights, contact us at legal@vtilt.com. If your data was collected by a website that uses vTilt, contact the operator of that website; we will support them in responding.
#Children
vTilt is a business tool and is not directed to children. We do not knowingly collect personal data from children under 16 for our own purposes, and Customers are prohibited from using vTilt on services directed to children. If you believe a child's data has been collected, contact us and we will delete it.
#Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify Customers by email or through the dashboard before the changes take effect. The date at the top of this page shows when the policy was last revised.
#Contact us
For privacy questions or requests, contact us at legal@vtilt.com. For general inquiries, contact hello@vtilt.com.