Who we are
Vesuvian is a UK-based technology service operated by Vesuvian Limited, a company registered in England and Wales (Company No. 17314261). Our registered office is Suite RA01, 195-197 Wood Street, London, E17 3NU. We provide AI-powered business assistant software to small and medium businesses. In this policy, “Vesuvian”, “we”, “us” and “our” refer to Vesuvian Limited.
For data protection purposes, Vesuvian Limited is the Data Controller for personal data collected through our website and about our own contacts and website visitors. For personal data processed on behalf of our clients through the platform, Vesuvian Limited acts as a Data Processor and our clients are the Data Controllers.
Contact us regarding data protection: info@vesuvian.uk
What data we collect and why
Account and identity data: When you register, we collect your name, email address, and the name of your business. We use this to provide your account, send service communications, and identify you within the platform. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)).
Usage data: We record which AI tools are used, query counts, and token consumption per session. This data is used for billing, abuse prevention, and service improvement. Legal basis: legitimate interests (UK GDPR Article 6(1)(f)).
Conversation history: So that you and your team can return to previous conversations, we store the content of your chats with the assistant — your messages, the assistant’s responses, and which tools were used. Conversations are accessible only within your organisation, subject to its access controls, and you can delete any conversation at any time from within the platform. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)).
Audit log data: For accounts where the feature is enabled, we store a record of queries made by each user including a summary of the question asked, the tools used, and the timestamp. This is visible to the account owner and to Vesuvian administrators. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).
Technical data: IP addresses, browser type, and device identifiers collected through standard server logs and analytics. Retained for 90 days. Legal basis: legitimate interests (UK GDPR Article 6(1)(f)).
Communications: If you contact us by email, we retain that correspondence. Legal basis: legitimate interests.
Data we do not collect or store
We do not store the content of files you attach to conversations. Files are processed in memory and discarded immediately after your query is answered.
We do not use the content of your conversations for any purpose other than providing the service to you — not for advertising, not for profiling, and never for training AI models.
We do not sell your data to any third party. Ever.
How your business data is processed
When you connect your business systems (Gmail, Xero, Google Drive, etc.) to Vesuvian, queries about your data are processed as follows: your question is sent to Anthropic’s Claude API alongside the relevant data retrieved from your connected systems. Anthropic processes this under their API terms. Anthropic retains API inputs and outputs for up to 30 days for safety monitoring purposes and does not use this data to train AI models. We have signed Anthropic’s Data Processing Addendum. Your data is never used to train any AI model.
How we use AI
Our platform uses Anthropic’s Claude AI model to process your queries. When you submit a question, your query and any relevant data from your connected systems is sent to Anthropic’s API for processing. Anthropic retains API inputs and outputs for up to 30 days for safety monitoring and does not use this data to train AI models. We have signed Anthropic’s Data Processing Addendum. You can read Anthropic’s privacy policy at anthropic.com/privacy.
Third-party processors we use
| Processor | Purpose | Location |
|---|---|---|
| Anthropic PBC | AI query processing | USA (transfer safeguards in place) |
| Supabase Inc. | Database hosting | EU |
| Vercel Inc. | Application hosting | UK (London, lhr1 region) |
| Railway Corp. | Connector (MCP server) hosting | EU |
| Google LLC | OAuth sign-in, Gmail API email, and website analytics (analytics with consent) | USA (transfer safeguards in place) |
| Sentry | Error monitoring | EU |
Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, alongside a data processing agreement with each processor.
Your rights under UK GDPR
You have the right to: access your personal data, correct inaccurate data, request erasure, restrict processing, data portability, and object to processing. To exercise any right, email info@vesuvian.uk. We will respond within one calendar month. Where a request is complex, or where you make a number of requests, we may extend this by up to two further months — if so, we will tell you within the first month and explain why.
You also have the right to lodge a complaint with the ICO at ico.org.uk.
Data retention
- Account data is retained for the duration of your contract plus 12 months.
- Conversation history is retained until you delete it within the platform, or until your account is terminated (deleted within 30 days of termination).
- Audit logs are retained for 12 months.
- Usage records are retained for 24 months for billing dispute purposes.
- You may request earlier deletion.
Contact and complaints
To exercise your data rights, make a Subject Access Request, or raise a complaint about our data handling, contact us at: info@vesuvian.uk
You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
Changes to this policy
We will notify active users by email of material changes at least 14 days before they take effect.