First Effective: April 4, 2026 | Last Updated: October 7, 2026
PRAXIS AI LLC ("Vannus," "we," "us," or "our") is a Missouri limited liability company that operates the website vannus.co and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit or use the Platform, or when we hold your business contact details as described in Section 2.14.
By accessing or using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree with the practices described herein, please do not use the Platform.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Privacy Policy on the Platform with a revised "Last Updated" date. Your continued use of the Platform after such changes constitutes your acceptance of the updated Privacy Policy.
When you visit the Platform, we automatically collect certain information about your device and your interaction with the Platform, including:
This information is collected through our hosting provider's request logs (Section 4.1) and, for searches and feedback, through the events described in Section 4.2. Vannus sets no first-party cookies and runs no third-party analytics tool (it keeps only the page-view count described in Section 4.1), and it does not derive the order in which you visit pages or how long you spend on them.
We may collect information that you voluntarily provide to us, including:
If you interact with third-party tools or services through links on the Platform, those third parties may collect information about you subject to their own privacy policies. Vannus does not control and is not responsible for the privacy practices of third parties.
When you engage Vannus for a paid service (currently: the AI Subprocessor Jurisdiction Report, a one-time purchase; the Stack Jurisdiction Review, which is invoiced; and Concierge audit engagements), payment is processed exclusively through Stripe (stripe.com), our third-party payment processor. Payment card details are entered directly into Stripe-hosted pages or Stripe-issued invoices and are not transmitted to or stored on Vannus servers at any time. For the AI Subprocessor Jurisdiction Report, you pay on a Stripe-hosted page by card (including any card wallet Stripe offers) or with Link, and Vannus sends Stripe the email address you gave on our purchase page and a reference number for your report. Stripe's page normally also asks for your billing address and, where Stripe supports your location, a business tax ID; Stripe then keeps these, with your email address and name, on a customer record in Vannus's Stripe account and issues a paid invoice carrying your report's reference number. If Stripe cannot open its page with those fields, it opens without them and no invoice is issued. Stripe's notice to Vannus of each completed payment includes these details, but Vannus reads only the report reference and the payment status, and keeps no Stripe customer identifier, name, billing address or tax ID. What Vannus itself stores for a purchase is listed in Section 2.12. Stripe's privacy policy is available at stripe.com/privacy.
For full details on our refund policy and statutory rights of withdrawal, see Section 12 (Billing, Payments and Refunds) of our Terms of Service.
Vannus does not currently offer a chat workspace, and no prompt or conversation content is collected, stored, or transmitted to any third-party model provider. The free stack check Vannus offers and the AI Subprocessor Jurisdiction Report it sells are produced deterministically, by matching the tool names you submit against the Vannus catalog and its recorded findings; Concierge engagements are human analysis supported by internal tooling (Section 17). That processing runs entirely on Vannus infrastructure: your tool list is not sent to OpenAI, Anthropic, Google, or any other model provider, because no language model is involved in producing your result.
If Vannus later offers a chat workspace, this section will be replaced before that service is made available, the sub-processor list in Section 6 will be updated to name every model provider that would receive your prompts, and notice will be given as described in Section 6.
Regardless of product, do not submit regulated information (PHI under HIPAA, payment card data under PCI DSS, attorney-client privileged communications, or government identification numbers other than a business tax ID you give Stripe at checkout as Section 2.4 describes), or confidential information other than materials you send for a Concierge engagement or a Stack Jurisdiction Review, to Vannus. Vannus has no Business Associate Agreement, no PCI certification, and no regulated-data handling in place. Submitting such information is at your sole risk and violates Section 8 of the Terms of Service.
Vannus currently computes no device fingerprint.
When you submit your AI tool stack through the free stack check (at /static/rate-my-stack.html, or the same check on the home page), the tool names you enter are sent to our /api/stack/rate checking endpoint solely to generate your result. The endpoint also accepts optional cost and team-size fields, which no Vannus page sends; like the rest of the request, they are not stored. The request body is not persisted to any database, log file, or backup; the HTTP response carries Cache-Control: no-store, private, max-age=0 so that no intermediary cache retains it. Your IP address is held in server memory to limit request rates, as described in Section 7. By default, no email address, no account, no cookies, and no PII are required or set. Apart from the aggregate counters described below, each check is stateless: the response is the entire artifact you take with you.
Optional email delivery. If you choose to enter an email address into the optional “Email me a copy” field, Vannus sends that address and a copy of your result through our transactional email provider (Resend, see Section 6), once. The copy lists the catalog tools of yours we matched and up to ten names we could not match. The email address is not stored in any Vannus database or log and is not added to any mailing list or marketing audience. To allow at most one copy per address per hour, Vannus keeps a shortened hash of the address in server memory; it is cleared at the next send attempt after that hour, or when the server restarts. Resend retains the message, including the address, subject to Resend's own retention and privacy policies. Providing an email is entirely optional; the result is fully visible in your browser without it.
Global aggregate counters. The free check keeps one set of running totals shared by all callers, and it holds exactly five items: (1) the total number of submissions that matched at least one catalog tool; (2) for each catalog tool, how many submissions have included it; (3) for each pair of catalog tools that meets the rule below, how many submissions have included both; (4) the date and time the totals were last changed, which is the time of the most recent counted submission (each counted submission overwrites it); and (5) a single yes/no marker showing that a one-time cleanup, which deletes any pair count in which either tool has fewer than five submissions, has run. Tools are counted under the catalog’s name; a name that matches no catalog tool is not recorded. None of these items records who submitted: no IP address, email address, cost figure, team size or per-submission record is stored with them, and nothing links a count back to the visit that changed it. A co-occurrence pair is only counted once both tools have already been submitted at least five times by earlier callers, so your own submission can never be what makes a pair eligible; and a pair is only ever published once at least five separate submissions contain it. Rarely-submitted tools are counted individually but never paired. Apart from the in-memory rate-limit state described above and in Section 7, these totals are the only record the free check keeps of what was submitted, and they are what let us publish which tools are most used together.
The fit-check form (/api/concierge/fit-check) asks four multiple-choice questions and, optionally, for your email address and a note. If your answers indicate a possible or strong fit, they are emailed, with your email address and note, to Vannus's support mailbox through our transactional email provider (Resend), and held in that mailbox for the purpose of evaluating fit and scheduling the intake call; otherwise nothing is emailed. Our server log records each submission's result, whether an email address was given, and your IP address (its first 15 characters, which for an IPv4 address is the whole address); a rejected answer is logged with its value and your IP address; and when the notice is sent, the first three characters of your email address are logged. Materials for a Concierge engagement (which may include your name, email address, company, AI tool list, cost figures, and other documents and notes) reach us by email to support@vannus.co, where they are held in Vannus's support mailbox, or by another channel agreed for the engagement. Intake materials are received in confidence and used solely to perform your engagement. They are not published, sold, or licensed, and are not disclosed to third parties except to service providers strictly necessary to deliver the engagement (such as the transactional email provider named above), each acting under its own published terms, or where you direct disclosure in writing or disclosure is compelled by law. Any external case-study use requires your prior written consent. These commitments apply unless the engagement letter for your engagement says otherwise. See Terms of Service §9.5.1 for the full commitment, including deletion on request; retention follows Section 7 (Concierge engagement records: the longer of 3 years or as required by applicable tax/accounting law).
Stack Jurisdiction Review. A Stack Jurisdiction Review is requested by email to support@vannus.co. That email, and anything else you send us by email for the Review (such as the vendors on your list and the question you are about to answer), is held in Vannus's support mailbox. See Terms of Service §9.5.1 for the full commitment.
When you submit a bug report through the public form at /static/report-bug.html (or directly via /api/bug-report), Vannus emails its support mailbox (support@vannus.co) through our transactional email provider (Resend, see Section 6), for the sole purpose of letting our team reproduce and respond to the report, with: the description you write; your email address, if you give one; the page URL (the one you enter or, if you leave it blank, the page your browser says you came from); your browser’s User-Agent string; and your IP address (its first 15 characters, which for an IPv4 address is the whole address). The message is kept in that mailbox. For each report, our server log records the page URL (up to 80 characters), your IP address (its first 15 characters) and whether you gave an email address; when the notice is sent, it also records the first three characters of your email address; and a submission refused by the rate limit is logged with your IP address. Nothing you submit through this form is written to a Vannus database. To limit submissions, your IP address is held in server memory until the server next restarts. If you provide an email address, it is set as the Reply-To header on the operator notification so our team can reply directly; it is not added to any mailing list or marketing audience, and Resend retains it subject to Resend’s own retention and privacy policies. Providing an email is entirely optional; without one we have no way to reply to you.
2.10 Free audits. A free audit requested through /api/audit is not the same thing as the free stack check in Section 2.7, and it is not stateless. To generate the audit and keep its link working we store the list of AI tool names you submit, the email address you provide if you provide one, any answers the request carries about your company or about how you bought each tool (such as where your company is incorporated or located), whether the request asked for zero retention, and a one-way keyed hash of your IP address used solely to enforce the hourly free-tier cap. The key is held in deployment configuration and never stored alongside the hash. A free audit's link stops working at the first run of our daily retention clean-up after seven (7) days from your request, up to about a day after the seven days. The record itself (the audit, the tool list, any email address, any such answers and the keyed IP hash) is not deleted then: it is kept until the first run of that clean-up after 730 days (about twenty-four months) from the request, which deletes it. If the request asked for zero retention and the audit is produced and opened, the record is instead erased at the first run of that clean-up after seventy-two (72) hours from when it is first opened, which can be up to a day later; if the audit is not opened within thirty (30) days of the request (its link stops working after seven), the record is erased at the first run of that clean-up after those thirty days, which can be up to a day later. Your browser's User-Agent string and referring page are read from the request to detect abuse and are not written to any database, log file, or backup. You may ask us to delete a free audit sooner by emailing support@vannus.co.
Note the distinction from the free stack check described in Section 2.7: the free check does not save the list you submit; it adds to the anonymous running totals described there (which include a total submission count, a count per catalog tool, a count per eligible pair of tools, and the time the totals last changed), none of which records who submitted. A paid AI Subprocessor Jurisdiction Report necessarily persists your submitted tool list, because the report is generated from it and must remain retrievable at its link.
2.11 Stack Watch (withdrawn). Stack Watch, a monthly subscription, was withdrawn on 9 August 2026 and cannot be purchased. No one ever subscribed: Stripe, our payment processor, records no Stack Watch subscription in any status, so Vannus holds no Stack Watch subscriber information.
2.12 AI Subprocessor Jurisdiction Report purchases. When you order an AI Subprocessor Jurisdiction Report on our purchase page, Vannus stores, before you pay: the list of AI tool names you submit; the email address you provide for delivery; the organization name you optionally provide; your answers to the two required questions, where your company is incorporated and where it is located or billed, each stored as you typed it; and, for each vendor the page asks you about, your answer on how you bought it (personal subscriptions, a company plan bought on the vendor’s website, a signed or negotiated agreement, or not sure). A plan, a specific product line or one order-form answer for the whole list is stored only where a request to our checkout supplies it; the purchase page does not ask for them. It also stores a timestamp of the order (an order cannot be placed without ticking the box accepting the Terms of Service and this Privacy Policy), which version of the Terms of Service was then served (its Last Updated date and a digest of its text), your zero-retention choice, and, if Stripe reports a delayed payment as pending or failed, when it said so. Your email address and the order’s reference number are also passed to Stripe when you submit the order, whether or not you go on to pay (Section 2.4). To show you what the report will cover before you pay, the purchase page also sends Vannus your tool list and any country answers you have typed. Once a tool list is filled in, it sends them when you leave the tool-list field or either country field, when the page is shown, and, if it has not already done so for those entries, when you submit the order; the first two can happen before you tick the box accepting the Terms. Vannus uses them only to answer the page (which of your tools it can assess, how it reads each country answer, and which vendors to ask how you bought) and does not store them. After payment, Vannus adds the generated report, so that its link continues to work, and the time the report was first opened. The report is written from your country answers and your answers on how you bought each vendor, and shows each answer only where a vendor’s contracting entity turns on it: for a vendor whose entity depends on where the customer is incorporated, located or billed, it names the entity the vendor’s clause selects for your answers, or says why it could not, and may quote your answer as you typed it; for a vendor the page asked you about, it repeats your answer on how you bought it. The report is headed with your organization name or, if you left it blank, a name derived from your email domain. Anyone who has the report’s link can open it and see all of this (Section 12.12.4 of the Terms). If you do not complete payment, Vannus deletes the order record at the next run of its retention clean-up after thirty (30) days. Each order the page sends to checkout that passes our checks is saved as a separate record, so an attempt you backed out of at Stripe is deleted in the same way, even if you then paid on another. What was already passed to Stripe is held by Stripe under its own retention. No IP address or IP hash is stored for a purchase made through the purchase page and Stripe Checkout. A report issued by support against an access token is requested through /api/audit instead; its record holds the tool list, the email address, any answers sent with the request (such as the country answers, how each tool was bought or a zero-retention choice), the generated report and a keyed hash of the IP address the request came from, as described in Section 2.10, but no organization name you give (its report is headed with a name derived from the email domain, where there is one) and no record of accepting the Terms. We do not collect payment card details at any point — those go directly to Stripe.
2.13 What we never do with your report’s tool list. We do not sell your submitted tool list, share it with the vendors named in it, share it with any third party for their own purposes, or use it to target advertising at you. Your stack is commercially sensitive and we treat it that way.
2.14 Business contacts for outreach. Vannus keeps a list of business contacts: people at companies whom it has considered writing to, or has written to, about its services, whether or not they have used the Platform. The details it holds about each person come only from published pages: in most cases the company’s own pages (such as its website and its privacy or contact pages) and, for some entries, another published page that names the person in that role, such as a press release, another company’s case study, podcast or about page, an event page, an organization-chart directory or the person’s own public professional profile. For each entry the list holds the person’s role and, where published, their name; the company; the business contact details the company publishes for the person or their function, in most cases an email address (usually a role mailbox, such as a privacy contact, rather than a personal one) and, for some entries, a postal address; the web address of each page these details came from; where published pages indicate it, the person’s country or location; and Vannus’s own notes on how the entry was checked. Vannus uses the list only for business-to-business outreach: to decide whom to write to about its services, and to write to them. The list and Vannus’s working notes on it are held by Vannus in its private code repository and are not published on the Platform. An entry stays on the list until the person asks to be removed or the outreach ends. To be removed, reply to any message from us or write to support@vannus.co, and your entry is removed from the list.
We use the information we collect for the following purposes:
Vannus does not set first-party cookies on your device for any purpose. Requests to the Platform are logged by our hosting provider, Railway, in the ordinary course of serving them; those platform logs contain the usual request metadata, including page path, referrer URL, user-agent string, IP address, and timestamp, and their retention is Railway's, described in Section 7. They are used for monitoring Platform performance and detecting abuse. No persistent user identifier is associated with them.
Vannus itself does not keep a per-request log. A request-level recorder that stored the referrer and user-agent in our own database was removed, because it did not match the aggregate described in the next paragraph. What Vannus retains from page traffic is that aggregate and nothing else.
From these requests the Platform also keeps an aggregate page-view count — how many times each page path was viewed, by date. This retained aggregate stores only the page path, the date, and a count; it does not store or derive any IP address, user-agent, cookie, session, referrer, or per-visitor identifier, and cannot be used to reconstruct an individual visitor. It is a count, not visitor tracking.
When you search the Platform, or interact with feedback features (such as rating a search result or flagging a tool), the Platform generates an ephemeral UUID-style session identifier in your browser's memory to group your interactions within a single browsing session. This identifier is not stored as a cookie, in localStorage, or in any persistent client-side storage; it is regenerated every time you reload the page and is never associated with personally identifiable information.
That identifier does not stay in your browser. It is sent to Vannus together with the event it describes and is stored server-side. In particular, when you run a search, the session identifier and the text of your search are recorded as a behavioral event. Section 2 lists search queries among the information we collect, and Section 7 states how long structured Platform logs are kept — without automatic expiry by default, reviewed at least annually, with rows older than 24 months deleted where they are no longer needed for active analysis.
This paragraph was added on 7 September 2026 because the section above it was accurate about where the identifier is not kept and quiet about where it is. Nothing about the collection changed; the description did.
IP addresses appear in our hosting provider's request logs (Section 4.1) and are held in server memory to limit request rates (Section 7). Vannus's own server log also records an IP address when one of the two site-wide limiters, the free stack check's limiter, or the bug-report or fit-check form refuses a request for exceeding a rate limit, and in the other cases described in Sections 2.8 and 2.9; a free audit, or a report issued against an access token, stores a keyed hash of the IP address the request came from (Sections 2.10 and 2.12). IP addresses are used solely for (a) abuse prevention and rate limiting, and (b) request-routing diagnostics. IP addresses are not used to identify you personally and are not used to derive your geographic location unless we expressly notify you and obtain consent before doing so.
If you click an affiliate link on the Platform (see Section 5), the destination third-party site may set cookies on your device. Those cookies are placed by the third-party site or its affiliate network at the moment you visit it; Vannus does not place them. Such cookies are governed by the privacy policies of the third party, not by Vannus.
Because Vannus does not set first-party cookies or use cross-site tracking, browser-level "Do Not Track" signals do not change how the Platform processes your request. We do honor Global Privacy Control (GPC) signals as described in Section 9.2 below.
The Platform contains affiliate links to selected third-party products. When you click an affiliate link, you are directed to the third-party vendor's site, where tracking may occur via a third-party affiliate network or directly via the vendor's own program. Every commission link appears only on our partners page (/static/partners.html), which lists every current affiliate partner with a disclosure on its card. Programs are run through partner networks such as PartnerStack and Impact.com, or directly by the vendor.
Vannus does not place affiliate-tracking cookies on your device directly. Any tracking cookies are placed by the destination site or its affiliate network at the moment you visit it. The information collected through affiliate tracking is used by the third party to attribute referrals and calculate any commission owed to Vannus. Vannus receives only anonymized or aggregated conversion data from these networks; we do not receive personally identifiable information about you from affiliate tracking.
We do not sell, rent, trade, or otherwise transfer your personally identifiable information to third parties except in the following limited circumstances:
Service Providers: We share information with third-party service providers who perform services on our behalf. Our current service providers are:
Each of these providers operates under its own privacy policy. Railway and Stripe each publish data-processing terms, and personal data is transferred to each of them under those terms. We will provide at least fourteen (14) days' notice of sub-processor additions, via email to purchasers (buyers of an AI Subprocessor Jurisdiction Report whose report is still on file, and Concierge audit and Stack Jurisdiction Review clients).
Affiliate Networks: As described in Section 5, affiliate tracking services may collect limited data through cookies set on third-party sites when you click affiliate links. This data is used solely for referral attribution.
Legal Requirements: We may disclose your information if required to do so by law, court order, or governmental regulation, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent fraud or other illegal activity; (d) protect the personal safety of users or the public; or (e) protect against legal liability.
Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.
With Your Consent: We may share your information with third parties when you have given us your explicit consent to do so.
We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:
When information is no longer needed for the purposes described above, we will securely delete or anonymize it. Anonymization means the removal or transformation of all direct and reasonably-linkable identifiers such that the remaining information cannot reasonably be associated with you.
Zero-retention option. At checkout you may select zero retention. If you do, Vannus erases the whole order record described in Section 2.12 (including the report, the tool list you submitted, the organization name, your email address, your answers on where your company is incorporated and where it is located or billed and on how you bought each tool, and, where the record holds one, the keyed IP hash), together with any failed-send record that names the report, no sooner than seventy-two (72) hours after the report is first opened or, if we could not produce it, after the email telling you so is sent; erasure happens at the next run of an automated daily sweep, which can be up to a day later — not on request, and not subject to us remembering. If the report is not opened within thirty (30) days of when it was produced, or, if we could not produce it and the email telling you so was not sent, within thirty (30) days of our attempt, the whole record is instead erased at the next run of that sweep after those thirty days, which can be up to a day later. The share link stops resolving permanently when that sweep runs; the seventy-two hour window exists so you can save or print your own copy first. A checkout you started and did not pay for, such as one you backed out of at Stripe, is a separate record, even if you then paid on another attempt: zero retention does not erase it, and it is deleted at the next run of the retention clean-up after thirty (30) days (Section 2.12). Zero retention does not erase what Stripe holds in Vannus’s Stripe account: the customer record and invoice described in Section 2.4 (your email address, name, billing address, any tax ID, and the report’s reference number), none of which contains your tool list. The email that delivered your report link, including the report’s headline finding, stays with Resend under Resend’s retention. Server log lines about the order carry its reference number, but not your email address or tool list, and are kept as described for server log data above. Records Vannus is required to keep for tax and accounting purposes (the fact and amount of a payment, held by Stripe and in our accounting records) are retained as long as the law requires and contain no part of your tool list. A record erased under this option may remain in an operational backup made before its erasure, as the list above describes, until that backup is itself deleted. This option exists because Vannus is a United States company and the U.S. CLOUD Act reaches data in our possession, custody or control — the only complete answer to that is for us not to hold it.
AI Subprocessor Jurisdiction Reports. Unless you select zero retention, a purchased report and the rest of its order record described in Section 2.12 (including the tool list and email used to generate it) are retained for 730 days (about twenty-four months) from when the order was first saved, which is about the day of purchase, so that the link you were given continues to resolve and so we can honor the correction commitment in Section 12.12.5 of the Terms. The whole record is then deleted at the next run of the automated daily sweep, with any failed-send record that names the report. Vannus’s record of your acceptance of the Terms of Service and this Privacy Policy (the order’s timestamp and which version of the Terms was then served; Section 2.12) is part of that order record, is not kept apart from it, and is erased with it whenever the order record is erased: under zero retention, at the end of this period, after thirty (30) days if the order was not paid, or on request. You may ask us to delete a report and its order record at any time by emailing support@vannus.co; we will do so within thirty (30) days, after which the report link will stop working permanently. Records we are required to keep for tax and accounting purposes (the fact and amount of a payment, held by Stripe and in our accounting records) are retained as long as the law requires, and contain no part of your tool list.
Stack Watch subscriber records. None exist: Stack Watch was withdrawn on 9 August 2026 and no one ever subscribed (Section 2.11).
We implement reasonable administrative, technical, and physical security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include but are not limited to HTTPS encryption for all Platform communications, secure hosting infrastructure, and access controls limiting who can view user data.
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security. You use the Platform at your own risk.
Depending on your jurisdiction, you may have certain rights regarding your personal information, including the right to:
To exercise any of these rights, please contact us at support@vannus.co. We will respond to your request within thirty (30) days or as required by applicable law.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:
Vannus does not sell your personal information as defined under the CCPA/CPRA. We do not share your personal information for cross-context behavioral advertising.
Vannus does not collect "sensitive personal information" as defined by California Civil Code § 1798.140(ae), including but not limited to government-issued identifiers, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of mail/email/text messages other than as necessary to provide the goods or services requested, genetic data, biometric information processed for the purpose of uniquely identifying a consumer, health information, or information about sexual orientation. The personal information Vannus does collect (IP addresses and keyed hashes of them, browser metadata, email addresses, organization names and the company details you give at checkout, the tool lists and search text you submit, free text you send us, and billing data held for us by Stripe, and the business contact details described in Section 2.14) does not fall within this statutory category, and the right to limit sensitive-PI use is therefore inapplicable to Vannus's processing.
The Platform honors Global Privacy Control (GPC) signals as required by the California Consumer Privacy Act and the California Privacy Protection Agency regulations. If your browser transmits a GPC signal, we will treat it as a valid opt-out request.
To submit a CCPA/CPRA request, contact us at support@vannus.co. We will verify your identity before processing your request.
Vannus does not collect, capture, or otherwise obtain biometric identifiers or biometric information (as defined by the Illinois Biometric Information Privacy Act) through the Platform.
Residents of other states with comprehensive privacy laws (including but not limited to Virginia under the VCDPA, Colorado under the CPA, Connecticut under the CTDPA, Utah under the UCPA, Texas under the TDPSA, Oregon under the OCPA, Montana under the MCDPA, and Delaware under the DPDPA) may have additional rights, including the right to know, access, correct, delete, opt out of certain processing, and appeal a denied request. To exercise any such rights, please contact us at support@vannus.co with "Privacy Request" in the subject line. We will respond within the period required by your state's law (typically forty-five (45) days, extendable as permitted). If we deny your request, you may appeal by replying to our denial; we will respond to your appeal within the period required by your state's law (typically sixty (60) days).
Data-broker statutes — carve-out. Vannus does not meet the statutory definition of a "data broker" under California Civil Code § 1798.99.80, Vermont 9 V.S.A. § 2430, Texas Business & Commerce Code § 509.001, or Oregon Revised Statutes § 646A.804. Vannus does not knowingly collect and sell personal information of consumers with whom it has no direct relationship. The Platform's catalog records facts about business entities and software products — not consumer personal information — and is therefore outside the scope of these statutes. If you believe Vannus has been mischaracterized as a data broker by a third party, please contact us at support@vannus.co.
Vannus has designated the following point of contact for privacy and data protection inquiries: support@vannus.co (subject line: "Privacy Request"). As a small U.S.-based company that processes personal data of European Economic Area ("EEA"), United Kingdom, and Swiss residents only on an occasional basis within the meaning of GDPR Article 27(2) and the UK GDPR equivalent, Vannus has not appointed a separate Data Protection Officer or EU/UK Representative. If our processing of EEA or UK resident data becomes regular or large-scale, or otherwise falls outside the Article 27(2) exemption, we will appoint an EU Representative under GDPR Article 27 and a UK Representative under the UK GDPR and update this Privacy Policy accordingly.
Self-trigger. If EEA/UK personal-data processing volume crosses the threshold at which the "occasional" carve-out under Article 27(2) would no longer apply — including without limitation: signing a paying Concierge, Stack Jurisdiction Review or AI Subprocessor Jurisdiction Report customer based in the EEA or UK, or onboarding any sub-processor with primary EEA presence — Vannus will appoint an EU Representative under GDPR Article 27 and a UK Representative under the UK GDPR within thirty (30) days of the relevant trigger and update this Privacy Policy with the appointed Representative's contact details.
The Platform is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at support@vannus.co. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information.
Some web browsers transmit "Do Not Track" (DNT) signals. As Section 4.5 explains, the Platform sets no first-party cookies and does no cross-site tracking, so a DNT signal does not change how the Platform processes your request. We do honor Global Privacy Control (GPC) signals as described in Section 9.2.
The Platform is operated from the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Platform, you consent to the transfer of your information to the United States.
If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, the following terms apply to our processing of your personal data under the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK General Data Protection Regulation as retained in UK law ("UK GDPR"), and the Swiss Federal Act on Data Protection ("FADP"), respectively.
(a) Controller. PRAXIS AI LLC, trading as Vannus, a Missouri limited liability company, is the data controller for personal data we collect through the Platform. You may contact the controller at support@vannus.co.
(b) Lawful Basis for Processing. We process your personal data on the following lawful bases under GDPR Article 6:
We do not process special categories of personal data (Art. 9) intentionally. Section 9.4 of the Terms of Service prohibits submitting the regulated information it lists, including protected health information.
(c) Your GDPR / UK GDPR Rights. Subject to applicable conditions and exceptions, you have the right to:
To exercise any of these rights, contact support@vannus.co with "Privacy Request" in the subject line. We will respond within thirty (30) days, extendable by up to sixty (60) additional days where necessary, with notice to you. We may need to verify your identity before fulfilling certain requests.
(d) International Data Transfers. Personal data of EEA, UK, and Swiss residents is transferred to the United States for processing on Vannus's hosting and operational infrastructure. Transfers of personal data to Railway, which hosts the Platform, and to Stripe, which processes payments, are made under each provider's own published data-processing terms (Section 6). Vannus may also rely on other lawful transfer mechanisms, including the EU-U.S. Data Privacy Framework where applicable (Vannus is not currently certified under the DPF; if Vannus self-certifies in the future, this Privacy Policy will be updated).
(e) Right to Lodge a Complaint. If you believe our processing of your personal data infringes GDPR or other applicable data-protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement (GDPR Art. 77). In the UK, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch. We encourage you to first contact us at support@vannus.co so we may attempt to address your concern directly.
(f) EU / UK Representative. Vannus's processing of EEA and UK resident personal data is currently occasional within the meaning of GDPR Article 27(2) and the UK GDPR equivalent. Accordingly, Vannus has not appointed a dedicated EU Representative or UK Representative at this time. The data-protection contact in Section 9.5 above is the designated point of contact. If our processing becomes regular or large-scale, we will appoint a Representative and update this Privacy Policy.
The Platform may contain links to third-party websites, tools, or services that are not owned or controlled by Vannus. This Privacy Policy applies only to the Platform. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services. We encourage you to review the privacy policy of every site you visit.
Vannus does not use your personal information, search queries, or browsing behavior to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model. Vannus develops no such models. Your data is used solely to operate the Platform and provide the services described in this Privacy Policy. As described in Section 2.5 and Section 6, nothing you submit is transmitted to a third-party language-model provider, because no product Vannus currently sells uses one.
In the event of a data breach that affects your personal information, Vannus will notify affected users and applicable regulators as required by applicable federal, state, and international data-protection laws. Notification will be provided without unreasonable delay and within the specific timelines required by the laws applicable to you, including:
Notifications will be provided by email to the email address you gave us when you made a purchase or engaged Vannus, where we still hold it, by conspicuous notice on the Platform where required, and by such other means as required by applicable law. Notifications will include the categories of information affected, the date or estimated date of the breach, the steps Vannus has taken or will take in response, and steps you may take to protect yourself.
Notwithstanding the foregoing, PRAXIS AI LLC shall not be liable for any damages, losses, or costs arising from or related to any data breach, unauthorized access, or security incident, except to the extent such liability cannot be excluded under applicable law (including without limitation breach-related liability under GDPR Art. 82, where applicable). You acknowledge that no data transmission over the internet or electronic storage system is guaranteed to be 100% secure.
TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, PRAXIS AI LLC AND ITS MEMBERS, MANAGERS, OFFICERS, EMPLOYEES, AND AGENTS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATED TO OUR DATA PRACTICES, INCLUDING BUT NOT LIMITED TO THE COLLECTION, USE, STORAGE, DISCLOSURE, OR LOSS OF YOUR INFORMATION, REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Vannus does not engage in fully automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22 and analogous provisions of other applicable privacy laws. Specifically:
If, in the future, Vannus introduces any feature that involves fully automated decision-making within the meaning of GDPR Art. 22 or analogous law, we will update this Privacy Policy and, where required, provide the additional notices and rights (including opt-in consent, human-review rights, and the right to contest the decision) required by the applicable law.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
PRAXIS AI LLC, trading as Vannus
911 Washington Ave., Ste. 501
St. Louis, MO 63101
United States
Email: support@vannus.co
Website: vannus.co
For privacy-specific inquiries, please include "Privacy Request" in the subject line of your email.
This version of this Privacy Policy is effective as of its Last Updated date, shown above.
© 2026 PRAXIS AI LLC. All rights reserved.
Governed by the laws of the State of Missouri.