These are the third parties we share data with in order to operate the platform. We do not sell personal data. We will notify customers of material changes to this list at least 30 days before adding a new subprocessor that handles personal data.
| Vendor | Purpose | Data shared | Region |
|---|---|---|---|
| Stripe ↗ | Payment processing and subscription billing | Card details, billing address, transaction metadata | United States, EU |
| Postal | Transactional and lifecycle email delivery | Email address, name, message content | Self-hosted, EU infrastructure |
| Cloudflare ↗ | DNS, DDoS protection, edge caching | IP address, request metadata | Global edge network |
| Hetzner / DigitalOcean ↗ | Application and database hosting | All platform data at rest | EU (Germany) primary |
| Google reCAPTCHA Enterprise ↗ | Bot and abuse detection on auth and forms | Device fingerprint, IP address, interaction signals | United States |
| Google Analytics ↗ | Aggregate usage analytics | Pseudonymous visitor IDs, page views, referrers | United States |
What we have in place today. We're a small team, so this list is short and honest — not aspirational.
TLS 1.3 enforced on every connection. HSTS preload-eligible.
Database volumes and object storage use AES-256 at the disk layer.
Production access is SSH key + 2FA. Admin panel requires the `admin` role; sensitive routes also require email verification.
No secrets in source. Environment variables loaded from a permission-restricted .env file outside the web root.
Auth, password reset, and review submission endpoints are throttled. reCAPTCHA Enterprise gates signup, login, and contact forms.
Admin actions, billing events, and authentication events are written to an append-only audit trail.
How long we keep different categories of data. Closure requests go to [email protected].
The "Verified" badge means something specific. Here's exactly what we check and what we don't.
Every claimed agency profile must verify control of the agency's primary domain via a meta-tag, DNS TXT record, or HTML file.
Verified agencies link back to their VAI.me profile. We re-verify the backlink daily — if it disappears, the verified badge is suspended.
For Premium tier: registered business name and country are matched against the domain WHOIS or a verifiable corporate registry.
Reviews require a confirmed email address and are tied to a specific lead or engagement record. We do not allow anonymous reviews and we do not buy or seed reviews.
Verification confirms identity and accountability. It is not a quality endorsement. We don't audit deliverables, guarantee outcomes, or vouch for individual engagements. Reviews exist to surface that signal — not the badge.
Found a vulnerability? Send a writeup to [email protected]. We acknowledge within 2 business days and won't pursue legal action against good-faith research.
Access, export, or delete your data: email [email protected]. We respond within 30 days as required by GDPR.
Privacy Policy and Terms of Service spell out the legal commitments. This page covers the operational reality.