Veynto Privacy Policy

Effective date: July 17, 2026 Last updated: July 17, 2026

---

Summary (plain-language)

Veynto is a "project cockpit" that sits alongside AI coding tools (Claude Code and Codex) and keeps a software project organized — tracking features, tasks, reviews, architecture, and launch readiness. To do that we collect your account details and the project information you (or your connected AI tools) put into Veynto. We use a small number of trusted service providers to run the product — most importantly OpenAI, which processes your project content to generate AI suggestions. We do not sell or share your personal information, we do not run advertising or analytics trackers, and Veynto is intended only for users in the United States who are 18 or older.

• What we collect: your email address, display name, and the project content you create.
• Why: to provide the service, generate AI suggestions, secure your account, and comply with law.
• Who we share it with: Supabase (database/auth), Vercel (hosting), OpenAI (AI generation), Resend (transactional email), and Sentry (error monitoring). No one else, and never for sale.
• Your rights: you can access, correct, export, or delete your data by emailing lucas.sandoval.professional@gmail.com.

---

1. Who we are

Veynto (the "Service") is a product of Mekanico LLC, a California limited liability company ("Veynto," "we," "us," or "our"). For any privacy question or request, contact us at lucas.sandoval.professional@gmail.com.

The Service is intended for users located in the United States and is governed by the laws of the State of California. We do not target or market the Service to individuals in the European Union, the United Kingdom, or other regions with distinct data-protection regimes.

Age requirement. The Service is intended only for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete the associated account and data. See Section 11.

---

2. Information we collect

2.1 Information you provide directly

• Account information: your email address and a display name, created when you sign up.
• Authentication credentials: a password, managed through our authentication provider (we never store passwords in plaintext).
• Project content: the information you enter into Veynto, including project names and descriptions, features, tasks, goals, security/launch-readiness checklist entries, and any notes.
• Communications: the contents of messages you send us (e.g., support or privacy requests).

2.2 Information collected automatically

• Session/authentication cookies: a strictly-necessary cookie set by our authentication provider to keep you signed in.
• Local preferences: a theme preference stored in your browser's localStorage (this stays on your device and is not transmitted to us as a cookie).
• Operational/service logs: standard technical records generated by our hosting and infrastructure providers when you use the Service — such as timestamps, IP addresses, and request metadata — used for security and reliability and retained under those providers' standard schedules.
• Error reports: if something in the Service fails, our error-monitoring provider (Sentry) receives a technical report of the failure, which may include request metadata and an internal account identifier so we can fix the problem. We use this solely for debugging and reliability.

We do not use any analytics, advertising, or third-party tracking cookies (no Google Analytics, PostHog, Segment, or similar). Error monitoring is not used to track or profile you. If we ever add non-essential cookies or analytics, we will update this policy and add a cookie-consent mechanism before any non-essential cookie is set.

2.3 Information from connected AI tools (MCP integrations)

Veynto lets you connect external AI coding tools (such as Claude Code and Codex) to a project through a per-project connection secured by OAuth. When connected, those tools may send project information to Veynto (for example, architecture summaries and coding-session debriefs describing files changed, tests run, and risks) and pull project context from Veynto before coding. This exchanged content is stored as project content under Section 2.1. You control which tools you connect and can disconnect them at any time.

2.4 Information from third parties

We do not collect information about you from third parties, and we do not buy personal information from data brokers.

---

3. How we use information

We use the information described above to:

• Provide and operate the Service — create and manage your account, store your projects, and deliver the cockpit, architecture, history, and readiness features.
• Generate AI suggestions — send relevant project content to our AI provider (OpenAI) to produce feature suggestions, task generation, and the "Next Best Move" recommendation (see Section 5).
• Secure the Service — authenticate you, enforce project ownership, prevent fraud and abuse, and maintain reliability.
• Communicate with you — send transactional messages such as email confirmation, password resets, and responses to your requests. We do not currently send marketing or promotional email. If we introduce marketing email in the future, we will include an unsubscribe mechanism and honor opt-outs as required by the CAN-SPAM Act, and we will update this policy first.
• Comply with law — meet legal obligations and respond to lawful requests.

If we ever need to use personal information for a materially new purpose, we will update this policy first and, where required, notify you.

---

4. Cookies and similar technologies

Veynto currently uses only:

Because we set no analytics, advertising, or other non-essential cookies, we do not display a cookie-consent banner. You can clear or block cookies through your browser settings, but doing so may sign you out or prevent the Service from working. If we add any non-essential cookie in the future, we will add a consent mechanism at that time.

---

5. How we share information (service providers / sub-processors)

We share personal information only with the service providers ("sub-processors") needed to run the Service, and only for the purposes below. We do not sell or share your personal information (see Section 8).

OpenAI — important disclosure. To power AI suggestions, Veynto sends relevant project content to OpenAI's API. OpenAI states that data submitted through its API is not used to train its models by default. This transfer is also a point at which your data may be processed on infrastructure outside your state; see Section 6.

Each sub-processor processes personal information under its published data-protection and security terms.

We may also disclose information (a) to comply with law, legal process, or lawful government requests; (b) to enforce our Terms of Service or protect the rights, safety, and security of Veynto, our users, or the public; or (c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or notify you of any material change.

---

6. Where your information is processed

Veynto and its sub-processors process and store information in the United States. Sending project content to OpenAI's API involves transferring that content to OpenAI's processing infrastructure. Because the Service is intended for US users and governed by California law, we do not rely on EU/UK transfer mechanisms.

---

7. Data retention and deletion

• Account and project data is retained for as long as your account is active.
• When you delete a project, it is first soft-deleted: it disappears from the product and remains recoverable by you for 30 days, after which it is no longer accessible in the product. Soft-deleted content is permanently removed when your account is deleted or upon request.
• When you ask us to close your account, we delete or de-identify your personal information within 30 days of verifying the request, except where we must retain certain records to comply with law, resolve disputes, or enforce our agreements.
• Service logs held by our infrastructure providers are retained per their standard schedules.

---

8. Your privacy rights

You may exercise the following rights by emailing lucas.sandoval.professional@gmail.com. We will respond within the timeframe required by applicable law.

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix inaccurate information (you can also edit much of it directly in the app).
• Deletion — ask us to delete your personal information.
• Portability — request an export of your data in a portable format.
• Opt-out of marketing — not applicable while we send no marketing email; if that changes, every marketing message will include an unsubscribe link.

8.1 California residents (CCPA/CPRA)

If you are a California resident, you have the rights to know, access, correct, delete, and to not receive discriminatory treatment for exercising these rights.

We do not sell or share your personal information, and we have not done so in the preceding 12 months. "Sell" and "share" have the meanings given under the California Consumer Privacy Act. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" opt-out.

You may submit a request via lucas.sandoval.professional@gmail.com, and you may use an authorized agent to submit requests on your behalf. We will verify your identity before fulfilling a request.

---

9. Security

We take reasonable measures to protect your information, including:

• Encryption of data in transit (HTTPS/TLS).
• Authentication and row-level access controls enforced at the database layer, so users can only access projects they own.
• State-changing operations routed through validated, permission-checked server functions rather than direct database writes.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

---

10. Third-party links and services

The Service may link to or integrate with third-party tools (for example, the AI coding tools you connect). This policy does not cover those third parties; their own privacy policies govern their handling of your information. We encourage you to review them.

---

11. Children's privacy

The Service is intended only for individuals 18 and older. We do not knowingly collect personal information from anyone under 18, and we do not direct the Service to children. If you believe a person under 18 has provided us personal information, contact lucas.sandoval.professional@gmail.com and we will delete it.

---

12. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and notify you by email and/or an in-app notice before the changes take effect, as required by law. Your continued use of the Service after an update means you accept the revised policy.

---

13. Contact us

Mekanico LLC Contra Costa County, California Privacy inquiries and requests: lucas.sandoval.professional@gmail.com