Who we are
Vesuvian is a UK-based technology service operated by Vesuvian Limited, a company registered in England and Wales (Company No. 17314261). Our registered office is Suite RA01, 195-197 Wood Street, London, E17 3NU. We provide AI-powered business assistant software to small and medium businesses. In this policy, “Vesuvian”, “we”, “us” and “our” refer to Vesuvian Limited.
For data protection purposes, Vesuvian Limited is the Data Controller for personal data collected through our website and about our own contacts and website visitors. For personal data processed on behalf of our clients through the platform, Vesuvian Limited acts as a Data Processor and our clients are the Data Controllers.
Vesuvian Limited is registered with the Information Commissioner’s Office (ICO), registration number ZC187854.
Contact us regarding data protection: support@vesuvian.uk
What data we collect and why
Account and identity data: When you register, we collect your name, email address, and the name of your business. We use this to provide your account, send service communications, and identify you within the platform. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)).
Usage data: We record which AI tools are used, query counts, and token consumption per session. This data is used for billing, abuse prevention, and service improvement. Legal basis: legitimate interests (UK GDPR Article 6(1)(f)).
Conversation history: So that you and your team can return to previous conversations, we store the content of your chats with the assistant — your messages, the assistant’s responses, and which tools were used. Conversations are accessible only within your organisation, subject to its access controls, and you can delete any conversation at any time from within the platform. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)).
Audit log data: For accounts where the feature is enabled, we store a record of queries made by each user including a summary of the question asked, the tools used, and the timestamp. This is visible to the account owner and to Vesuvian administrators. Legal basis: performance of a contract (UK GDPR Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).
Technical data: IP addresses, browser type, and device identifiers collected through standard server logs and analytics. Retained for 6 months. Legal basis: legitimate interests (UK GDPR Article 6(1)(f)).
Communications: If you contact us by email, we retain that correspondence. Legal basis: legitimate interests.
Business contacts and prospects: We contact people at businesses that we think may benefit from Vesuvian. For this we hold business contact details only — a name, job title, work email address or phone number, and the business they work for — taken from public sources: the Companies House register, the business’s own website, and professional networks such as LinkedIn. We use them to introduce our service and to follow up. We email work addresses at limited companies. We do not send unsolicited marketing messages to sole traders or partnerships, or to anyone’s personal social media account, without their agreement. Every message we send says who we are and gives a simple way to say no. You can object at any time by replying or by emailing support@vesuvian.uk, and we will stop. Legal basis: legitimate interests (UK GDPR Article 6(1)(f)).
Data we do not collect or store
We do not keep the files you attach to conversations. The text we extract is used to answer your question, and the original file is held briefly — for up to 24 hours — only so the assistant can act on it if you ask it to, for example to save the document to your Drive. After that it is deleted automatically. We do not keep a copy beyond that, and attachments are never used for anything other than the request you made.
We do not use the content of your conversations for any purpose other than providing the service to you — not for advertising, not for profiling, and never for training AI models.
We do not sell your data to any third party. Ever.
How your business data is processed
When you connect your business systems (Gmail, Xero, Google Drive, etc.) to Vesuvian, queries about your data are processed as follows: your question is sent to Anthropic’s Claude API alongside the relevant data retrieved from your connected systems. Anthropic processes this under their API terms. Anthropic retains API inputs and outputs for up to 30 days for safety monitoring purposes and does not use this data to train AI models. We have signed Anthropic’s Data Processing Addendum. Your data is never used to train any AI model.
How we use AI
Our platform uses Anthropic’s Claude AI model to process your queries. When you submit a question, your query and any relevant data from your connected systems is sent to Anthropic’s API for processing. Anthropic retains API inputs and outputs for up to 30 days for safety monitoring and does not use this data to train AI models. Where content is flagged for a suspected breach of Anthropic’s usage policy, they may retain it for longer — up to two years, and up to seven years for the classification scores themselves. We have signed Anthropic’s Data Processing Addendum. You can read Anthropic’s privacy policy at anthropic.com/privacy.
If you connect your own AI client. Vesuvian can also be connected to an AI assistant you already use — your own Claude or ChatGPT — so that it can reach your business systems through us. In that arrangement the questions you ask and the answers you receive stay inside that assistant and never reach Vesuvian: we see only which tool was called, by whom, and whether it worked. Your data is sent to whichever AI provider you have chosen, under your own agreement with them and their privacy policy, not ours. We record the tool activity so your account owner can review it, and that record is described under Audit log data above.
Third-party processors we use
| Processor | Purpose | Location |
|---|---|---|
| Anthropic PBC | AI query processing | USA (transfer safeguards in place) |
| Supabase Inc. | Database hosting | EU |
| Vercel Inc. | Application hosting | UK (London, lhr1 region) |
| Railway Corp. | Connector (MCP server) hosting | EU |
| Google LLC | OAuth sign-in, Gmail API email, and website analytics (analytics with consent) | USA (transfer safeguards in place) |
| Sentry | Error monitoring | EU |
Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, alongside a data processing agreement with each processor.
Your rights under UK GDPR
You have the right to: access your personal data, correct inaccurate data, request erasure, restrict processing, data portability, and object to processing. To exercise any right, email support@vesuvian.uk. We will respond within one calendar month. Where a request is complex, or where you make a number of requests, we may extend this by up to two further months — if so, we will tell you within the first month and explain why.
You also have the right to lodge a complaint with the ICO at ico.org.uk.
Data retention
- Account data is retained for the duration of your contract plus 12 months.
- Conversation history is retained until you delete it within the platform, or until your account is terminated (deleted within 30 days of termination).
- Attached files: the original is deleted automatically within 24 hours. The conversation it belonged to follows the line above.
- Audit records are kept for up to 2 years. The content within them — the question asked and the summary of the answer — is erased after 13 months, leaving only the record that a query happened, which tool was used and when.
- Sign-in records, including the IP address, are kept for 6 months. The fact of the sign-in is kept for 2 years; the address is erased.
- Usage records are retained for 2 years for billing dispute purposes.
- Business contacts and prospects are kept for up to 24 months after we were last in touch, unless you become a customer, when the account terms above apply. If you ask us not to contact you, we delete your details except your email address, which we keep on a do-not-contact list so that we can keep to your request.
- You may request earlier deletion.
Contact and complaints
To exercise your data rights, make a Subject Access Request, or raise a complaint about our data handling, contact us at: support@vesuvian.uk
How we handle a complaint. You can complain to us about anything to do with how we handle personal data. You do not need to use a particular form or wording, and you can raise it however you normally contact us — email is easiest, but we will treat any route as a complaint if that is what it is.
- We will acknowledge your complaint within 30 days of receiving it.
- We will look into it and respond without undue delay, and tell you the outcome and what, if anything, we have done as a result.
- If we need more information from you to investigate, we will ask for it and explain why.
- We keep a record of complaints and how they were resolved, so we can see whether the same problem is happening more than once.
Complaining to us first is not a precondition — you can go straight to the regulator if you prefer, and you can go to them at any point if you are unhappy with our response.
You also have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
Changes to this policy
We will notify active users by email of material changes at least 14 days before they take effect.