Privacy Policy

1. Who we are

Vestari is operated by A&R Timepieces LLC (d/b/a Lumetrade), a Florida limited liability company based in West Palm Beach, Florida. We are the “business” and “controller” of the personal information described here. Contact us at hello@getvestari.com.

2. What we collect

We collect four categories of information:

• Account information — email, name, business name, hashed password, IP address, device and browser information.
• Billing information — plan, subscription status, billing history. Your card details are collected and stored by Stripe and never touch our servers.
• WhatsApp session data — the messages, media, and metadata from the WhatsApp groups you connect. Vestari extracts pricing signals for your private archive and uses aggregated, de-identified excerpts to power the dealer-network benchmark.
• Usage and product analytics — pages viewed, features used, errors, and system logs. We do not use third-party advertising trackers.

3. How we use it

• Operate, secure, and improve the service.
• Process subscriptions, receipts, and refunds through Stripe.
• Send transactional email (magic links, receipts, cancellation notices, price-change notices, annual auto-renewal reminders).
• Respond to support requests.
• Detect and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations.
• Compute aggregated, de-identified market benchmarks. We do not identify individual dealers in benchmark output.

We do not sell your personal information. We do not use it for cross-context behavioral advertising.

4. Who we share it with

We share personal information only with service providers who help us run the service under contract, including:

• Stripe, Inc. — payments and subscription management.
• Vercel Inc. — application hosting.
• Turso (ChiselStrike, Inc.) — database hosting.
• Fly.io, Inc. — WhatsApp session worker hosting.
• Resend, Inc. — transactional email delivery.
• Anthropic PBC — AI-assisted message parsing (data sent is not used to train Anthropic's models).

We may disclose information to comply with a valid legal process, protect our rights or property, protect the safety of users or the public, or in connection with a merger, acquisition, or sale of assets (in which case we will provide notice before your information becomes subject to a different privacy policy).

5. How long we keep it

Account and billing information is retained while your account is active and for up to 7 years after cancellation for tax and accounting purposes. WhatsApp comp data is retained per your subscription tier (90 days on Quarter, 6 months on Half, 12 months on Full) and deleted within 30 days of cancellation unless you request earlier deletion. Aggregated, de-identified benchmarks are retained indefinitely.

6. Security

We use TLS in transit, encryption at rest on managed infrastructure, bcrypt password hashing, HMAC-signed session cookies, and least-privilege access controls. No system is perfect. Report security issues to security@getvestari.com.

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your personal information (subject to legal retention).
• Port a copy of your information in a portable format.
• Opt out of any sale or sharing of personal information (we do not sell or share).
• Limit the use of sensitive personal information.
• Not be discriminated against for exercising these rights.

To exercise any of these rights, email privacy@getvestari.com. We will verify your identity and respond within 45 days (California residents) or as required by applicable law. Authorized agents may submit requests on your behalf with written authorization.

8. California residents (CCPA/CPRA)

In the 12 months before this policy's effective date, we collected the following categories of personal information as defined by the California Consumer Privacy Act: identifiers (email, IP), commercial information (subscription and billing history), internet or network activity (usage logs), and customer content (messages you route through the service).

We do not sell or share personal information as those terms are defined by California law. We do not use or disclose sensitive personal information for purposes that would require an opt-out right under the CPRA. California residents may exercise the rights described in Section 7 above.

9. Children

Vestari is a business-to-business tool. We do not knowingly collect personal information from anyone under 18. If you believe we have, email privacy@getvestari.com and we will delete it.

10. International users

Vestari is operated from the United States. If you access the service from outside the United States, your information will be transferred to and processed in the United States. We do not currently target or accept subscriptions from residents of the European Economic Area, the United Kingdom, or Switzerland.

11. Cookies and tracking

We use a single first-party session cookie (vestari_session) that keeps you signed in, plus short-lived cookies to remember your referral code and checkout tier. We do not use third-party analytics or advertising cookies.

12. Changes to this policy

If we make a material change, we will notify you by email at the address on file and update the “last updated” date. Continued use of the service after the effective date means you accept the updated policy.

13. Contact

A&R Timepieces LLC (d/b/a Lumetrade)
West Palm Beach, Florida
privacy@getvestari.com