Last updated: October 2026
When you join the VRITTI waitlist or create an account, we collect your email address and, optionally, your business name and province. When you use VRITTI, we collect transaction data you input, account information you connect, and usage analytics to improve the product.
If you sign in with Apple, we store an encrypted Apple sign-in token so we can revoke VRITTI's access when you delete your account; it is erased on deletion.
We use your information to:
AI features (Ask Vritti chat and voice replies, statement import, and automatic categorization suggestions) are powered by Anthropic (Claude Haiku 4.5): your message, an aggregated summary of your numbers, or the statement being imported is processed by Anthropic's commercial API, based on your consent, to generate the result. You can use VRITTI without these features, and you can stop using them at any time. Receipt scanning is different: the photo is read on your device (Apple's Vision framework on iPhone, Google ML Kit on Android) and is not sent to Anthropic. The receipt image is stored in a private folder tied to your account so you can find it later. Per Anthropic's commercial API terms, API inputs are not used to train models by default, and the receipt or statement is used for one-time extraction and not retained by the extraction service. We do not send your name, email, or account id to Anthropic. Conversations are stored encrypted on your device only. Voice input is transcribed by Apple or Google's speech recognition service (processed per your device settings) — VRITTI receives only the text, never the audio. Subscription billing is handled by Apple on iPhone and by Google Play on Android. We name any new processor before its data flow begins.
Your data is stored in Supabase, our managed Postgres backend, with row-level security (RLS) so you can only read your own rows — the server enforces this even if a query forgets to. All traffic is encrypted in transit over HTTPS; we never accept unencrypted connections. Connection tokens for any bank or platform you link are encrypted at rest in Supabase Vault — the values in our database are opaque references, and only the server can decrypt them. Your auth session lives in iOS Keychain or Android Keystore, not plain device storage. We never store your bank credentials directly; bank connections, when they ship, are handled through a secure read-only integration.
We do not sell, rent, or trade your personal information, and we never train AI models on your data or serve ads. We share data only with the service providers essential to running VRITTI, each of which sees only the minimum it needs:
Each provider is bound by its own privacy commitments and data-processing terms. We will not add a new sub-processor without updating this policy first.
You have the right to:
We honour these rights under PIPEDA (Canada) and similar laws. While your account is active we keep your data only as long as the app needs it to work. After you delete, we wipe everything immediately. We do not keep tax records for you: your exports are yours to keep, and Canadian tax records you are required to retain are your responsibility. Encrypted backups roll off within 30 days.
VRITTI uses minimal analytics to understand how the product is used. We do not use third-party advertising trackers. This website records first-party page events; the app sends product events to PostHog (US-hosted), tied to a random account id — never your amounts or transaction details. Like any internet service, PostHog receives your device's IP address when an event arrives and may derive an approximate location (GeoIP) from it. Crash reports sent to Sentry include your device model, operating system and app version. You can turn them off any time in the app under Settings → Privacy.
VRITTI is for self-employed adults. We do not knowingly collect data from anyone under 16, and VRITTI is not designed for children. If you believe a minor has signed up, email us and we'll delete the account.
Our person in charge of the protection of personal information can be reached at privacy@vritti.app. We may store and process your data outside Québec: Supabase, PostHog and Anthropic operate in the United States. We assess that a transfer will receive adequate protection before it takes place. You may ask for access, correction, deletion and portability of your data, and you may withdraw your consent at any time. We reply within 30 days. If a confidentiality incident poses a risk of serious injury, we report it to the Commission d'accès à l'information du Québec and to you. A French version of this policy is available on request at privacy@vritti.app.
We may update this policy as VRITTI evolves. For material changes — new sub-processors, new data categories, new retention rules — we'll notify you by email or through the app at least 14 days before the changes take effect.
For privacy questions or data requests, email us at hello@vritti.app, or privacy@vritti.app for Law 25 requests.