Privacy Policy

Effective as of September 4, 2026

Last updated September 30, 2026

Vestdoor ("Vestdoor," "we," "us" or "our") provides economic indicators, international trade, foreign exchange, and commodity data through a developer API, related application console, and integrations. This Privacy Policy describes how we process personal information collected through our website at vestdoor.com, our API, our application console, and our integrations (collectively, the "Service").

Personal information we collect

Information you provide. When you create an account we collect your name, email address, and password. When you contact us, we collect the contents of your message and your contact details.

Payment information. Purchases are processed by our payment processor, Stripe. We receive billing contact details and the last four digits of your payment card; we never store full payment card numbers.

API requests. We process your API key and query parameters, such as countries, indicators, products, instrument identifiers, and date ranges, to authenticate your request and return the requested data. Do not submit personal information in data-query parameters.

Usage data. We collect log data about requests to the Service: IP address, request timestamps, endpoint called, response status, and latency. This is used for metering, billing, rate limiting, abuse prevention, and security.

Cookies. We use a small number of cookies for authentication (session cookies) and, if accepted, analytics. See our Cookie Notice for details.

How we use personal information

We use personal information to:

  • provide, operate, and secure the Service;
  • create and manage your account and API keys;
  • meter usage and bill for the Service;
  • respond to support requests;
  • comply with law and enforce our Terms of Use.

We do not sell personal information, and we do not use API-submitted data to train generalized AI/ML models.

Legal bases (EEA/UK)

Where the GDPR applies, we process personal information on the following bases: performance of a contract (providing the Service), legitimate interests (security, abuse prevention, service improvement), and consent where required (e.g., optional analytics cookies).

Sharing

We share personal information only with:

  • Service providers bound by contract to process data on our behalf (hosting, email delivery, payment processing, analytics);
  • Professional advisers and counterparties in connection with a merger, acquisition, or sale of assets, under confidentiality protections;
  • Authorities where required by applicable law.

Google Sheets integration

The Google Sheets add-on runs through Google Apps Script. It uses access to the current spreadsheet to insert the results you request into a new sheet and display its sidebar. It sends your Vestdoor key and selected query parameters to our API over HTTPS. It does not upload spreadsheet contents to Vestdoor or request access to unrelated Drive files.

Your API key is stored in Google's Apps Script UserProperties for the account and script that save it. It is not written into spreadsheet cells. Google Sheets custom functions read the spreadsheet owner's user properties, so collaborators may use formulas that consume the owner's API allowance. Imported results are visible to people who can access the spreadsheet. If you use a spreadsheet-attached copy of the script, spreadsheet editors can edit that script. Share edit access only with people you trust.

Google hosts the spreadsheet, script, and stored script properties under its own privacy terms. We use Google user data only to provide the integration's user-facing features. We do not sell it, use it for advertising, or use it to train AI models. Vestdoor's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can uninstall the add-on and revoke its Google authorization through your Google Account's third-party connections settings. Uninstalling does not erase values already inserted into a spreadsheet. Revoke your Vestdoor key in the dashboard to prevent further API requests with it. Contact hello@vestdoor.com for help with deletion of Service account data.

ChatGPT and other MCP integrations

When you connect an AI client through OAuth, you authorize it to make Vestdoor data requests using your existing API key. We validate the key and store it encrypted with the authorization records needed to maintain the connection. Registered client identifiers and OAuth tokens let us authenticate subsequent requests. Authorization codes expire after five minutes, access tokens after 30 days, and refresh tokens after 60 days. We remove expired records when authorization state is updated.

The AI client sends the query parameters needed for the requested data, such as country, indicator, product, instrument, or date range. Vestdoor returns the requested data to that client. The integration does not request your full conversation history. The AI provider processes your conversation and the returned data under its own terms and privacy policy.

You can disconnect the integration in your AI client's settings. Revoke the associated Vestdoor API key in your dashboard to prevent further data requests using that key. Contact hello@vestdoor.com for help deleting authorization records.

International transfers

We are established in France. Where personal information is transferred out of the EEA or UK, we rely on an adequacy decision or Standard Contractual Clauses.

Retention

We retain account data for as long as your account is active and API logs for up to 12 months, after which data is deleted or anonymized, unless a longer period is required by law.

Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. EEA/UK users may lodge a complaint with their supervisory authority. To exercise any right, contact hello@vestdoor.com. We verify requests before responding and respond within the time required by law.

Security

We use encryption in transit (TLS) and at rest, access controls, and audit logging designed to protect personal information. No method of transmission or storage is completely secure.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes

We will post any changes to this Privacy Policy on this page and update the effective date above. If changes are material, we will provide more prominent notice (e.g., email for account holders).

Contact

Vestdoor, hello@vestdoor.com.