Privacy Policy

This Policy explains how VetEval, operated by viggoVet, handles personal data. The viggoVet group entity responsible for your region is identified in our Legal Entities document. It supplements our Terms of Service. VetEval is a business service: we hold very little personal data, and almost none of it is sensitive.

1. Who this applies to

This Policy covers visitors to veteval.ai, people who create an account or are invited to an organisation, and people who submit or manage models. Data about your organisation's models and runs is business data, not personal data, but is described here where it is useful.

2. What we collect

• Account and organisation data: your business email address, name, organisation, role, and authentication data including two-factor enrolment. Two-factor authentication is required on every account.
• Submission data: the model descriptors, provenance declarations, and model-card content you provide, and the endpoint you connect.
• Endpoint credentials: the API key you supply. It is encrypted on arrival, is never displayed after entry, cannot be read back, and is used only to run your evaluations.
• Run and result data: evaluation runs, scores, intervals, verification tier, attempt counts, and transcripts generated during evaluation.
• Billing data: for paid plans, billing contact and invoice details. Card payments are handled by our payment processor; we do not store full card numbers.
• Technical and security data: IP address, device and browser information, and operational and audit logs used for security, abuse prevention, and reliability.
• Communications: messages you send us through our contact forms or support channels.

3. Why we use it, and our legal bases

We use this data to provide and secure the Service, authenticate you, run and publish evaluations, bill paid plans, prevent abuse and protect benchmark integrity, respond to you, and comply with law. Where a legal basis is required, we rely on performance of a contract, our legitimate interests in operating and securing a trustworthy benchmark, compliance with legal obligations, and consent where we ask for it.

4. What we publish

The public leaderboard and model cards contain model and organisation information, scores, verification tiers, and attempt disclosures. Results published on a Community plan are permanent and are not removed on request, as set out in the Terms of Service and the Publication, Corrections & Independence Policy. Where an individual's name appears (for example a listed contact on a model card), you control whether to provide it. We do not publish personal contact details of account holders.

5. What we do not do

• We do not sell personal data and we do not share it for advertising.
• We do not train AI models on your data. viggoVet does not train, fine-tune, or otherwise incorporate VetEval evaluation data, held-out items, gold answers, run transcripts, or your model's outputs into any viggoVet model. This data firewall is a platform commitment, not just a policy statement.
• We do not use your credentials for anything other than running your evaluations.
• We do not place personal or sensitive data in URLs.

6. Zero data retention at model providers

Every request we send to your endpoint carries enforced zero-retention parameters with provider fallback disabled. If a provider will not accept those terms, the run is refused before any item is sent. Your provider's own handling of requests is governed by your agreement with them.

7. Sharing and sub-processors

We share data only with service providers that help us operate the Service, under written data-protection terms: cloud hosting and object storage, our payment processor for paid plans, transactional email and authentication services, and error monitoring and analytics. We also share with other viggoVet group entities where needed to operate and support the Service, and where required by law or to protect rights, safety, and the integrity of the benchmark. A current sub-processor list is available on request.

8. International transfers

Your data may be processed in the countries where viggoVet group entities and our service providers operate. Where personal data is transferred across borders without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK Addendum, and Swiss amendments. You can request details of the safeguards we use.

9. Retention

• Verification codes and invitations: short-lived and swept on a retention schedule.
• Account and organisation data: kept while the account is active and for a limited period afterwards.
• Credentials: deleted when you remove them or when the associated model or account is deleted.
• Published results: retained indefinitely as part of the permanent public record.
• Audit, security, and billing records: retained as required for security, accounting, and legal-claim purposes.

10. Your rights

Depending on where you are, you may have rights to access, correct, delete, restrict, port, or object to processing of your personal data, and to withdraw consent. These apply to your personal data, not to published benchmark results, which are business records we retain for the integrity of the public record and which we may keep on the basis of our legitimate interest and the establishment or defence of legal claims.

• EEA, UK, Switzerland: GDPR, UK GDPR, and the Swiss FADP rights, including the right to complain to your supervisory authority.
• United States (including California): rights to know, access, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined.
• UAE, Saudi Arabia, Australia, Canada: the equivalent rights available under the UAE PDPL, the Saudi PDPL, the Australian Privacy Principles, and PIPEDA respectively.

To exercise a right, use our contact form. We will verify your identity and respond within the time the applicable law allows.

11. Cookies

We use cookies and similar technologies that are strictly necessary to sign you in, keep your session secure, and operate the Service, and, where applicable, a limited set of analytics cookies. Where consent is required, non-essential cookies are set only after you accept them, and you can change your choice at any time through the cookie controls on the site.

12. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, envelope encryption of endpoint credentials, mandatory two-factor authentication, role-based access control, audit logging, and monitoring. No system is perfectly secure; if a personal-data breach occurs that is likely to affect you, we will notify the relevant authorities and, where required, affected users without undue delay.

13. Children

VetEval is a business service and is not directed to children. We do not knowingly collect personal data from anyone under 18.

14. Changes and contact

We may update this Policy and will post the new version with an updated date, giving notice of material changes. Questions, requests, or complaints: our contact form.