Legal
Privacy Notice
Effective September 23, 2026
This notice explains how Vestige handles information in customer workspaces.
1. Scope
This notice applies to information Vestige processes while providing its maintenance and vendor-spend intelligence service. In most cases, your organization is the controller of the records it uploads and Vestige processes those records on its instructions as a service provider.
2. Information we process
We process the account and workspace information needed to provide access, along with records your organization submits, such as property and unit details, maintenance and work-order history, invoice and vendor records, and source-row evidence attached to findings. We also process limited technical and security information needed to operate and protect the service.
3. How we use information
We use information to authenticate users, ingest and normalize records, generate and display evidence-linked findings, operate and secure the service, respond to support requests, and meet legal obligations. We do not sell customer workspace data or use it for advertising.
4. Redaction on ingest
Vestige redacts resident personal information during ingest. The service is built to minimize personal information in the records it processes and to keep the evidence used for a finding tied to the customer's operational records rather than to a resident profile.
5. Retention
Original uploaded records are retained for no more than 90 days. We retain other workspace information only for as long as needed to provide the service, satisfy our legal obligations, resolve disputes, and enforce agreements, unless your organization asks us to delete the workspace sooner.
6. Deletion and receipt
An authorized workspace representative may request total deletion of its workspace data through their Vestige contact. We will delete uploaded records, normalized records, findings, evidence, and associated workspace data, subject only to information we must keep by law. We will then provide a deletion receipt describing completion of the request and any legally required exception.
7. Sharing
We share workspace data only with the customer organization's authorized users, service providers that help us operate Vestige under appropriate confidentiality obligations, or when disclosure is required by law. The providers we currently rely on are Vercel for hosting, Neon for the database, and Clerk for sign-in. We will keep this list current as the service changes. We do not disclose one customer's workspace data to another customer.
8. Security
We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information we process. No system is completely secure, so please notify your Vestige contact promptly if you suspect unauthorized access to a workspace.
9. Your choices and questions
Contact your organization's Vestige workspace administrator to update account information, manage access, or request deletion. For questions about this notice, contact the Vestige representative responsible for your organization's workspace, or write to general@vestige.company. Use of the service is also governed by the Terms of Service.