Privacy
Last updated: 31 August 2026
Who is responsible
The operating company's registration details will be published here as soon as registration completes; until then the operator is reachable through the contact channel below and remains fully responsible for the processing described on this page. For the conversations inside a customer's workspace, the customer is the controller and Vasta is the processor acting on their instructions.
What we store, and why
Chat visitors: the messages you send, files you attach, the page address the chat was opened from, your browser language, and - if the site identifies you - your name, email and attributes the site provides. Legal basis: the site owner's legitimate interest in running customer support (Art. 6(1)(f)). Workspace accounts: your email and password hash, for providing the service you signed up for (Art. 6(1)(b)). Billing: handled by Stripe; we store your plan and Stripe identifiers, not card numbers.
Browser storage
The widget stores two keys in localStorage on the site you visited: a conversation token (so your chat survives a page reload) and the widget's brand color. No advertising cookies, no cross-site tracking, no fingerprinting.
Where it lives - subprocessors
| Subprocessor | Role | Data location | Safeguard |
|---|---|---|---|
| Supabase Inc. | Database, file storage, realtime delivery | Frankfurt, Germany (AWS eu-central-1) | DPA + SCCs |
| Vercel Inc. | Application hosting and delivery | Functions in Frankfurt (fra1); global CDN for static assets | DPA + SCCs |
| Stripe Payments Europe | Payments (paid plans only) | EU | Own controller for payment data |
| Resend (Plus Five Five, Inc.) | Transactional email (notifications and invites) | Ireland (eu-west-1); company incorporated in the US | DPA + SCCs; only agent email addresses and message excerpts |
Conversation content and files never leave Frankfurt. We will update this list before adding any subprocessor.
How long
Each workspace sets its own retention period (default one year; 30 days on the Free plan). When it passes, conversations are deleted for real - database rows and uploaded files both, on a daily schedule. Agents can also permanently delete individual messages at any time. Account data lives as long as the account; deleting a workspace deletes its conversations and files.
Your rights
You can ask for access, correction, deletion or a copy of your data. If you wrote to a company through their Vasta widget, the fastest route is that company - they control the conversation - but you can also contact us directly and we will help or forward the request. You may lodge a complaint with the Estonian Data Protection Inspectorate (AKI).
Contact
Open the chat widget on this page - a human answers.