Privacy
This page describes what Vaani actually collects, in plain terms — not a template. If a section doesn't apply to how this instance is actually run, it isn't listed as if it did.
Early-access sign-up (the "Join early access" form)
When you submit the early-access form, we store:
- The email address you typed.
- Whether you agreed to be contacted, and which version of this notice you agreed to.
- Which page/section the form was submitted from, your browser's language setting, and any
utm_*campaign parameters present in the page URL.
We do not store your IP address or full browser user-agent string as part of this submission, and the submission is never linked to anything you do on the site before or after it.
Purpose: to email you when early access opens up, and nothing else. We do not sell or share this list with anyone outside the team operating this instance.
Where it's stored
The authoritative record is a PostgreSQL database this instance controls. A copy of successfully recorded sign-ups is also synchronized to a Google Sheet used internally by the team for day-to-day tracking — that spreadsheet is never the source of truth and is never written to directly by your browser; it only ever receives a copy of what's already in the database, after the fact, on a retry schedule.
Account data (signup / login)
Creating a Vaani account stores your email, name (if provided), business name (if provided), and a securely hashed password — never the password itself in plain text. If you sign in via Google or Apple through Clerk, Vaani stores your verified email and an opaque identifier for that sign-in — never your password on either provider, since Vaani never sees it.
Deletion requests
To have your early-access sign-up or account data deleted, contact the team operating this instance through the channel they've published for that purpose. This is a self-hosted product — the operator of the specific instance you signed up on is who holds and can delete your data, not a central Vaani company.
What we don't claim
We do not claim GDPR, ISO 27001, SOC 2, or any other formal certification for this instance unless the operator running it has separately obtained and documented one. Absence of a certification claim here means exactly that — it hasn't been claimed, not that a standard has been met informally.