Privacy Policy

1. Who We Are

Vettara Search ("Vettara", "we", "our", "us") is owned and operated by Vettara Technology FZ-LLC (RAKEZ Services Licence No. 47031944, E-Commerce Licence No. 45035757, Media Licence No. 17008618, registered at VUNE1937, Compass Building - Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates) and engineered by Waggle FZE (SPCFZ Business Licence No. 4432420.01, Sharjah, United Arab Emirates). We provide an AI-assisted B2B executive search workspace for commercial organisations. This Privacy Policy explains how we collect, use, disclose, protect, and delete personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (UAE PDPL), the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws.

Strict 18+ B2B Scope: Vettara is intended solely for business professionals aged 18 and older. We do not knowingly collect, index, or process personal data of minors under 18 years of age. For privacy questions, data subject rights, or immediate profile opt-out requests, contact support@vettarasearch.com or visit our Privacy Request Center.

2. Roles and Scope

For customer search projects, the customer generally decides what search brief, geography, role, company scope, uploaded documents, notes, and candidate workflow data should be processed. In that context, the customer is the controller or business responsible for the data, and Vettara Technology FZ-LLC acts as a processor or service provider under the customer's instructions pursuant to our Data Processing Agreement (DPA).

For our public website, account administration, security telemetry, billing, and service operations, Vettara Technology FZ-LLC acts as an independent data controller.

3. Data We Collect

Account and Authentication Data

We collect names, email addresses, organisation names, roles, account settings, access permissions, and authentication events. If you use Google sign-in, we receive basic Google account information such as your email address and provider identifier, plus a display name if Google returns one to us.

Google Connected Services Data

Google sign-in is separate from the optional Gmail, Google Calendar, Google Meet, and Google Drive permissions described below. Vettara requests those permissions only when an authorised user chooses to connect the related feature.

• Gmail: Vettara can send outreach messages on the user's behalf and read replies in Gmail threads created by Vettara-sent outreach. The normal reply-sync workflow retrieves only stored Vettara thread identifiers; it does not browse unrelated inbox threads. We process message and thread identifiers, sender details, subject lines, timestamps, and a reply snippet needed for reply tracking and campaign stop rules.
• Google Calendar: Vettara reads events from the connected user's primary calendar, including event title, time, organiser, attendees, location, conference link, provider identifiers, status, and attachments, so the user can sync meetings into the Vettara Meetings workspace.
• Google Meet: When the user enables transcript capture, Vettara reads meeting-space metadata and available Google Meet transcript entries for meetings linked to that connected calendar.
• Google Drive: Vettara requests access limited to files created or edited by Google Meet so it can import a Meet notes document attached to the relevant calendar event. Vettara does not use this connection to browse unrelated Drive files.

For connected Google services, we store the connected account email, granted scopes, token expiry information, encrypted access and refresh tokens, and the user-facing data imported into the Vettara workspace. Provider tokens are kept server-side and are not returned to the browser after the OAuth exchange.

Microsoft Connected Services Data

Microsoft sign-in is separate from optional Outlook and Microsoft Calendar connections. When an authorised user connects Outlook, Vettara can send user-directed outreach and read replies in the related mailbox for reply tracking and campaign stop rules. When the user connects Microsoft Calendar, Vettara reads calendar event metadata needed to show meetings in the workspace. We process connected account details, message or event identifiers, sender or attendee details, subject or title, timestamps, and the content needed for the feature the user selected. Provider tokens are encrypted and kept server-side.

Contact Intelligence and Outreach Data

When a customer enables contact intelligence or outreach, Vettara may process public professional pages, company domains, source-visible work contact details, customer-added contact details, outreach templates, recipients, delivery status, replies, suppression status, and campaign activity. Vettara may test a possible work email against public evidence or a limited mail-server response; an unsupported pattern guess is not returned as a verified contact. Customers control whether to contact a person and remain responsible for lawful outreach and suppression handling.

ChatGPT Connector and MCP Authorization Data

If you connect Vettara to ChatGPT, we process OAuth authorization details such as the requested scope, OAuth client information, access and refresh token metadata, the signed-in Vettara user, and security audit events. ChatGPT may call Vettara tools only after you authorize access through your Vettara account.

The Vettara ChatGPT connector can access Vettara projects, MCP or search sessions, run status, candidate result previews, and short-lived CSV exports available to the signed-in Vettara user. It may create or launch search sessions only when the user requests and confirms those actions. The connector does not make another user's workspace data public and does not bypass Vettara workspace permissions.

Customer Workspace Data

We process search briefs, target role and market criteria, company lists, uploaded files, notes, shortlists, rejected candidates, candidate evaluations, outreach metadata, exports, audit logs, and related workspace activity.

Candidate and Public Professional Data

Vettara may process publicly available or customer-provided professional information about candidates, including names, job titles, employers, career history, locations, professional profile URLs, public biographies, public announcements, and AI-generated summaries or verification signals. Candidate information can be incomplete, outdated, or inaccurate and must be reviewed by the customer before use. See the Candidate Privacy Notice.

Usage, Device, and Security Data

We collect IP addresses, browser and device details, session identifiers, pages visited, features used, search activity, diagnostic logs, security events, and error reports.

Billing and Payment Data

If online billing is available and you purchase a subscription, Vettara processes plan, invoice, subscription status, payment status, customer identifiers, and limited billing contact information. Stripe processes payment-method, fraud-prevention, tax, and payment data under Stripe's own terms and privacy notices. Vettara does not receive full card numbers from Stripe Checkout.

4. How We Use Data

• To provide, secure, monitor, and improve the Vettara platform
• To authenticate users, manage sessions, and administer workspaces
• To run executive searches, parse briefs, source candidates, and generate results
• To send user-directed Gmail or Outlook outreach and track replies in related threads
• To sync connected Google or Microsoft calendar events and import user-enabled Google Meet transcripts or notes
• To support contact intelligence, suppression controls, and customer-directed outreach workflows
• To operate the ChatGPT connector, including OAuth authorization, status checks, result previews, confirmed search launches, and CSV exports
• To maintain candidate registries, exports, audit logs, and workflow history
• To diagnose errors, prevent abuse, and enforce our Terms of Service
• To send service, security, billing, and support communications
• To comply with legal obligations and respond to lawful requests

We do not sell personal data. We do not use customer candidate data to train public foundation models.

Vettara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used for advertising, sold to data brokers, or used to train general-purpose or public AI models. Human access is prohibited except with the user's affirmative permission for specific data, when necessary for security or support, or when required by law.

5. Legal Bases (UAE PDPL, EU/UK GDPR & Global Frameworks)

Where the UAE PDPL (Federal Decree-Law No. 45 of 2021), EU GDPR, or UK GDPR applies, we rely on the following lawful bases:

• Contractual Necessity: to provision your workspace, process subscriptions, and deliver requested search services.
• Legitimate Interests: to index publicly available B2B professional career information for executive recruitment, secure the platform, and prevent fraud (subject to every individual's unconditional right to opt out via /privacy-requests).
• Customer Instructions (Processor Role): to execute search briefs and manage candidate workflows on behalf of our B2B customers under the DPA.
• Consent: for optional connected OAuth integrations (Google, Microsoft, MCP) and optional analytics cookies where required.
• Legal Obligation: for UAE VAT/tax recordkeeping, security incident response, and compliance with lawful regulatory requests.

6. Sharing and Subprocessors

We share personal data only where needed to operate the service, comply with law, protect the platform, or follow customer instructions. Categories include hosting providers, managed databases, authentication providers, AI processing providers, search and retrieval providers, email providers, analytics tools, and error monitoring tools.

Current subprocessors are listed on our Subprocessors page. We do not share candidate data across customer workspaces except where a customer explicitly directs us to do so.

When you use the Vettara ChatGPT connector, your prompts, attached files, and ChatGPT conversation are handled by OpenAI under your ChatGPT account and OpenAI's applicable terms. Vettara returns only the tool responses needed for the requested Vettara workflow, such as status summaries, bounded candidate previews, or short-lived export links.

7. International Transfers

We may process data in countries other than where you are located. Where required, we use appropriate safeguards such as Standard Contractual Clauses, data processing agreements, and security controls designed to protect transferred personal data.

8. Retention and Deletion

Account data is retained while the account is active and for the period needed for legal, audit, billing, security, or dispute purposes. Customer search and candidate data is retained during the service term unless deleted earlier by the customer or required by law. See Data Retention and Deletion.

Customers can request export or deletion through the product where available or through support. Vettara verifies the request and removes or anonymises eligible production data; backups expire through the normal backup rotation. Legal holds, security records, billing records, and data we must retain by law may be kept longer.

Disconnecting Gmail or a calendar causes Vettara to clear its stored provider tokens and, where the provider supports it, attempt provider-side revocation. Imported outreach, calendar, transcript, or Meet-notes data remains part of the workspace until the customer deletes it, closes the account, or requests deletion, subject to the exceptions above. Users can also revoke Vettara directly from their Google Account's third-party access page.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, restrict, export, or object to processing of personal data. You may also have the right to withdraw consent and to complain to a data protection authority.

If your request concerns data controlled by a Vettara customer, we may direct the request to that customer. To exercise rights, contact support@vettarasearch.com or use the Privacy Request Center.

10. Security

We use technical and organisational safeguards including TLS encryption, access controls, audit logs, role-based permissions, tenant separation, secure secret handling, monitoring, and backup controls. No system is perfectly secure, and customers remain responsible for managing their own users, devices, exports, and downstream use of data. See our Security page for more information.

11. Cookies

We use essential cookies for authentication, security, and session management. Optional analytics cookies are used only when enabled and where legally permitted. See our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here and, where appropriate, notified to registered users. Continued use of the service after an update means the current policy applies to future use.