Privacy Policy

This Privacy Policy explains how the Veto merchant platform, operated by Investech Global LLC (“Veto,” “we,” “us”), handles personal data when you use our dashboard, APIs, SDKs, command-line tools, and related services (together, the “Service”). It forms part of, and should be read alongside, our Terms of Service and User Agreement.

Veto is non-custodial infrastructure that connects merchants to autonomous AI-agent buyers. We never hold, control, or take custody of your funds – payments settle on-chain in stablecoin (for example, USDC) directly to a receiving address you control. This Policy covers the data we process to run that Service; it does not cover how the blockchains, payment rails, or agents you choose to transact with handle data themselves.

We aim to collect only what we need to operate the Service for you. That typically includes:

• Account information – the email address you sign in with and basic profile details associated with your account;
• Business details – information about your business and your checkout and product configuration, including your public receiving address;
• Usage & metering – records of sales, transactions, and authorization decisions made through the Service, used to operate your checkout and meter platform fees;
• Support communications – messages you send us and the contents of any support correspondence; and
• Technical data – limited log and device information (such as IP address and browser type) generated as you use the dashboard, for security and reliability.

We do not take custody of your funds, and we do not sell your personal data.

Payments through the Service settle on public blockchains. Wallet and receiving addresses, settlement transactions, amounts, and timestamps are recorded on-chain and are inherently public, permanent, and visible to anyone. This is a property of the blockchains themselves, not a choice we make on your behalf.

Veto does not control, alter, reverse, or erase on-chain records, and we cannot do so on your behalf. Information you place on a public blockchain – including any address you configure as a receiving address – should be treated as public. Consider this before associating an address you wish to keep private with your account.

We use the information we collect to:

• provide and operate the Service – run your checkout, route transactions, and record signed authorization decisions;
• bill and meter – calculate and collect the platform fees described in our Terms;
• protect the Service – detect, investigate, and prevent fraud, abuse, and security incidents, and enforce our Terms; and
• support you – respond to your questions and provide account and technical support.

We may also use information as needed to comply with applicable law and to maintain and improve the reliability of the Service.

We use a single httpOnly session cookie to keep you signed in to the dashboard. It is strictly necessary for the Service to function – without it, we cannot recognize your authenticated session.

We do not use advertising cookies, cross-site trackers, or third-party ad-targeting pixels. We are not in the business of profiling you for advertising.

To run the Service we rely on a small number of service providers who process data on our behalf, under terms that require them to protect it and use it only to provide their service to us. These generally fall into the following categories:

• payment facilitators that help route or verify on-chain and stablecoin settlement between buyers and your wallet;
• blockchain RPC providers we query to read and broadcast on-chain transactions; and
• infrastructure and hosting providers that host the dashboard, databases, and supporting systems.

We do not sell your personal data, and we share it with these providers only to the extent needed to operate the Service or where required by law.

We keep personal data only for as long as we need it to provide the Service, to meet our legal, accounting, and fraud-prevention obligations, and to resolve disputes. When data is no longer needed for those purposes, we delete or anonymize it.

On-chain settlement records are an exception: because they live on public blockchains, they are permanent and outside our control, and they cannot be deleted by us or by you.

Depending on where you live, you may have rights to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. You can manage much of your account information directly in the dashboard, and you can contact us to exercise any of these rights.

Please note one limit: rights such as deletion apply to data we control. They do not extend to records already written to a public blockchain, which we cannot alter or erase.

We and our service providers may process and store data in countries other than the one where you are located. Where we transfer personal data across borders, we take steps intended to ensure it remains protected consistent with this Policy and applicable law.

The Service is intended for businesses and the people who run them, not for children. We do not knowingly collect personal data from anyone under the age of majority in their jurisdiction. If you believe a child has provided us personal data, contact us at legal@veto-ai.com and we will take appropriate steps to remove it.

We may update this Privacy Policy from time to time. When changes are material, we will update the “Last updated” date above and provide notice where appropriate. Continuing to use the Service after changes take effect means you accept the updated Policy.

Questions about this Policy or about how we handle your data? Email us at legal@veto-ai.com. We read every message.