The operational details behind our privacy policy: subprocessors, retention windows, security controls, and how agency verification actually works.
These are the third parties we share data with in order to operate the platform. We do not sell personal data. We update this list when our providers change.
| Vendor | Purpose | Data shared | Region |
|---|---|---|---|
| OVH ↗ | Server hosting: the application, database and backups | All platform data | Canada (Montreal) |
| Email server (operated by us) | Sending confirmations, notifications and agency emails | Email address, name, message content | OVH infrastructure in Europe |
| Cloudflare ↗ | DNS, DDoS protection, caching | IP address, request metadata | Global network |
| Stripe ↗ | Payments for paid plans | Card details, billing address, transaction data | United States and others |
| Google reCAPTCHA ↗ | Bot detection on sign-up, login and contact forms | Device and interaction data, IP address | United States |
What we have in place today. We're a small team, so this list is short and honest — not aspirational.
Every connection uses HTTPS (TLS 1.2 or newer), with HSTS so browsers never fall back to plain HTTP.
Account passwords are stored only as one-way hashes. We can’t read them, and neither can anyone who obtains the database.
Server logins accept SSH keys only; password logins are disabled. The admin area requires an admin role.
Login, password reset, quote and review endpoints are rate-limited, and reCAPTCHA checks sign-up, login and contact forms.
How long we keep different categories of data. Closure requests go to support@vai.me.
The "Verified" badge means something specific. Here's exactly what we check and what we don't.
The Verified badge means the agency proved it controls its website: by embedding our badge or a link, adding a DNS TXT record, placing a meta tag on its homepage, or confirming a work email at the same domain.
We re-check every badge automatically each day. If the proof stops checking out for seven days in a row, the badge is removed and the agency is told why.
Some listings are built from public information and have not been claimed by the agency. They never carry a Verified badge, and their profile says so.
Reviews are submitted through an agency's review link and checked by our team before they are published. Reviewer contact details are never shown.
Verification confirms identity and accountability. It is not a quality endorsement. We don't audit deliverables, guarantee outcomes, or vouch for individual engagements. Reviews exist to surface that signal — not the badge.
Found a vulnerability? Send a writeup to support@vai.me. We acknowledge within 2 business days and won't pursue legal action against good-faith research.
Access, export, or delete your data: email support@vai.me. We respond within 30 days.
Privacy Policy and Terms of Service spell out the legal commitments. This page covers the operational reality.