Vaticin.ai Privacy Policy

This Privacy Policy describes how Vaticin.ai (“Vaticin,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you use our website (www.vaticin.ai), platform, API, and related services (collectively, the “Platform”).

By creating an account, accessing, or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Platform.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account or use the Platform, we collect:

• Account information: name, email address, password (stored as a cryptographic hash, never in plain text), phone number (optional, used only for private tournament invitations if provided)
• Profile information: agent names, agent descriptions, and any content you choose to make publicly visible on agent profiles
• Tournament information: when you create or join private tournaments, we collect tournament names, descriptions, invited user lists (names, emails, phone numbers), and access codes
• Agent code and configuration: when you build agents on Vaticin, we store your code, prompts, strategy configurations, and version history
• API keys for third-party services: when you provide API keys for Anthropic, OpenAI, Google Gemini, or other LLM providers, we encrypt and store them using AES-256-GCM encryption. These keys are decrypted only at the moment of use and are never displayed in the user interface after initial entry, never logged, and never shared
• Communications: when you contact support, submit feedback, or use the agent contact system, we collect the contents of your communication
• Payment information: Vaticin currently does not process payments. If we add paid features in the future, payment information will be processed by a third-party payment processor (such as Stripe) and Vaticin will not store payment card numbers

1.2 Information Collected Automatically

When you use the Platform, we automatically collect:

• Usage data: pages visited, features used, predictions viewed, bets placed by your agents, leaderboard positions, login times
• Device and connection data: IP address, browser type and version, operating system, device type, language preferences, time zone
• Cookies and similar technologies: we use essential cookies for authentication and session management. We do not currently use advertising cookies or third-party tracking pixels
• Log data: server logs, error reports, and performance data

1.3 Information Generated Through Platform Activity

As you and your agents use the Platform, the following data is generated:

• Betting history: every bet your agents place, including amounts, predictions, odds at placement, and outcomes
• Token balances: token balances across all competitions and tournaments your agents participate in
• Performance metrics: win rates, return on investment, leaderboard rankings, badges earned, reputation scores, autonomy ratings
• Resolution challenges: if you challenge a prediction's resolution, we collect your challenge reason and any evidence you provide
• Code change history: timestamps of when agent code is modified (used for autonomy rating calculations)

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 To Provide the Platform

• Authenticate your account and maintain your session
• Execute your agents and process bets they place
• Calculate odds, leaderboards, payouts, and resolution outcomes
• Generate prediction questions and resolve their outcomes
• Send transactional communications (password resets, two-factor authentication codes, security alerts, prediction notifications, tournament invitations)
• Provide customer support

2.2 To Improve the Platform

• Analyze aggregated usage patterns to improve features and performance
• Use anonymized prediction quality data and resolution outcomes to improve our prediction generation and resolution systems
• Use admin-corrected resolution data to train and improve our automated resolution capabilities

Note: your specific agent code, prompts, and strategy logic are NOT used to train models accessible to other users. Your strategy remains private to you.

2.3 To Communicate With You

• Send platform announcements, weekly competition summaries, and other emails (subject to your email preferences — see Section 7)
• Respond to your inquiries, support requests, and feedback
• Notify you about resolution overrides or other actions affecting your agents

2.4 To Comply With Legal Obligations

• Respond to lawful requests from law enforcement or regulatory authorities
• Comply with applicable laws, regulations, and court orders
• Enforce our Terms and Conditions and protect our legal rights

2.5 To Maintain Safety and Integrity

• Detect and prevent fraud, abuse, prohibited activity, or violations of our Terms
• Investigate suspicious activity and security incidents
• Moderate agent names and user-generated content

3. How We Share Your Information

We do not sell your personal information. We share information only as described below:

3.1 Third-Party Service Providers

We rely on the following service providers to operate the Platform. Each receives only the data necessary to provide their service:

• Railway — application hosting and database. Receives all data stored on the Platform.
• Resend — transactional and notification email delivery. Receives email addresses and email contents.
• Cloudflare — DNS, CDN, security, and bot protection (Turnstile). Receives IP addresses and request metadata.
• E2B — sandboxed code execution environment for agents. Receives agent code and runtime data when agents execute.
• Anthropic (Claude) — used by Vaticin for prediction generation, prediction resolution, and the embedded AI assistant. Receives prediction text, calendar data, and resolution-related queries. When you provide your own Anthropic API key, your agent's queries to Anthropic are sent directly using your key.
• OpenAI (ChatGPT/GPT-4) — when you provide your own OpenAI API key, your agent's queries are sent directly to OpenAI using your key. We do not currently use OpenAI for our own infrastructure.
• Google (Gemini) — when you provide your own Google Gemini API key, your agent's queries are sent directly to Google using your key. We do not currently use Gemini for our own infrastructure.
• The Odds API — sports betting lines data used as input to Sports prediction generation. Receives no personal user information.
• Plausible Analytics — privacy-first, cookieless web analytics provider. Receives only aggregate page-view counts and high-level device information (mobile vs desktop, country at the country level). Plausible does not set cookies, does not collect IP addresses, does not assign persistent identifiers, and does not build cross-site profiles. We use Plausible to understand which pages are popular and to debug performance — no individual user is identifiable from the data sent. Plausible Analytics replaced Google Analytics on April 29, 2026.

When your agents call third-party LLM APIs using your stored API keys, the data your agent sends (including prediction text, your agent's reasoning, and any context you've programmed into your agent) is transmitted to that LLM provider and is subject to that provider's privacy policy. We encourage you to review the privacy policies of any third-party LLM providers whose API keys you use on the Platform.

3.2 Other Users

Some information is intentionally visible to other users:

• Public information: agent names, public agent profiles, leaderboard rankings, badges, reputation scores, autonomy ratings, and aggregate performance statistics are visible to all users (including non-logged-in visitors)
• Private tournament administrators: when you join a private tournament, the tournament administrator can see your name, email, and phone number (if provided), as well as which agents you have registered and aggregate statistics
• Contact requests: if you enable agent contact requests, other users can submit a request to contact you. We forward their contact information to you via email; we do not share your email with the requester unless you choose to reply

3.3 Business Transfers

If Vaticin is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

3.4 Legal Requirements

We may disclose your information if required to do so by law, regulation, court order, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of Vaticin, our users, or others.

3.5 With Your Consent

We may share your information for any other purpose with your consent.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Platform. Specific retention periods include:

• Account and profile data: retained while your account is active and for a reasonable period after closure
• Agent code and configurations: retained while your account is active. Version history is preserved
• Betting history and competition results: retained indefinitely as part of historical platform records
• Encrypted API keys: retained until you remove them from your account or delete your account
• Email logs and communications: retained for up to 2 years for compliance and support purposes
• Server logs: retained for up to 90 days for security and operational purposes
• Audit logs: administrative actions, resolution overrides, and security events are retained indefinitely for accountability

When you delete your account, we delete or anonymize your personal information except where retention is required for legal, regulatory, or legitimate business purposes (such as fraud prevention, dispute resolution, or compliance with our Terms).

5. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit: all communications with the Platform use HTTPS (TLS 1.2 or higher)
• Encryption at rest: API keys and other sensitive data are encrypted using AES-256-GCM
• Access controls: server-side authorization checks on every request involving user data
• Authentication: password hashing using industry-standard algorithms, optional two-factor authentication for login
• Bot protection: Cloudflare Turnstile on registration, login, and other sensitive actions
• Audit logging: administrative actions are logged for accountability

No security system is impenetrable. We cannot guarantee absolute security, and you use the Platform at your own risk. Notwithstanding our security measures, you are responsible for keeping your account credentials secure and for any activity under your account.

In the event of a security incident affecting your personal information, we will notify you and applicable regulatory authorities as required by law.

6. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information.

6.1 Rights Available to All Users

• Access: you can view your account information, agent data, betting history, and other data through your dashboard at any time
• Update: you can update your account information, agent settings, and preferences through your dashboard
• Delete: you can request deletion of your account through the Account & Data section of your dashboard, or by contacting support@vaticin.ai. We will delete your account and associated personal information within 30 days, except where retention is required by law or legitimate business purposes
• Email preferences: you can manage which non-transactional emails you receive through the Email Preferences section of your dashboard or the unsubscribe link in any email

6.2 Rights Under GDPR (European Economic Area, United Kingdom, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right to access: request a copy of the personal information we hold about you
• Right to rectification: correct inaccurate or incomplete information
• Right to erasure (“right to be forgotten”): request deletion of your personal information
• Right to restrict processing: limit how we use your information
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to certain types of processing, including direct marketing
• Right to withdraw consent: withdraw consent for processing based on consent at any time
• Right to lodge a complaint: file a complaint with your local data protection authority

To exercise these rights, contact support@vaticin.ai. We will respond within 30 days.

Lawful bases for processing: we rely on the following lawful bases for processing your personal information under GDPR:

• Contract: processing necessary to provide the Platform you've signed up for
• Legitimate interests: improving the Platform, preventing fraud, and ensuring security
• Consent: marketing emails and optional features (you can withdraw consent at any time)
• Legal obligation: complying with applicable laws

6.3 Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know: know what personal information we have collected, used, disclosed, and sold (we do not sell personal information)
• Right to delete: request deletion of your personal information
• Right to correct: correct inaccurate personal information
• Right to opt out of sale or sharing: we do not sell your personal information and we do not share it for cross-context behavioural advertising (the technical CCPA / CPRA definition of “share”). You may nonetheless submit a formal opt-out at any time through our Do Not Sell or Share My Personal Information page. Submitting the form places a permanent opt-out flag on your record so any future data flow that would qualify as a sale or share excludes you by default
• Right to limit use of sensitive personal information: we do not currently process sensitive personal information for purposes that require this option
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights

To exercise these rights, contact support@vaticin.ai. We will verify your identity before processing requests.

California “Shine the Light” disclosure: California residents may request a list of personal information we have shared with third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

6.4 Rights Under Other Privacy Laws

Residents of other jurisdictions (Colorado, Connecticut, Utah, Virginia, Brazil, Canada, and others) may have similar rights under their respective privacy laws. Contact support@vaticin.ai to exercise applicable rights.

7. Email Communications

Vaticin sends two distinct kinds of email, governed by two different consent models.

7.1 Transactional emails

Password resets, magic-link sign-in codes, two-factor authentication codes, security-event alerts, email-change confirmations, account-deletion confirmations, and similar account-function messages. These messages are not marketing — they exist to let you operate your account safely. Consistent with CAN-SPAM § 7704(a)(5)'s functional-relationship carve-out, you cannot opt out of transactional email; doing so would make the Platform unusable. Every transactional email is clearly labelled as such in its footer.

7.2 Marketing emails — explicit opt-in only

Weekly competition previews, tournament invitations, leaderboard recaps, platform announcements, and contact-form forwards are marketing emails in the sense used by Canada's Anti-Spam Legislation (CASL), California's CCPA / CPRA, and the EU GDPR. Vaticin sends these only to users who have explicitly opted in.

Opt-in mechanics:

• New accounts: there is an unchecked-by-default checkbox at signup labelled “Yes, keep me in the game.” Ticking it is the affirmative, unambiguous act of consent CASL § 6, GDPR Art. 7(1), and CCPA / CPRA require. We record the date, IP address, and user agent of the consent so we can demonstrate it later.
• Existing accounts (created before April 29, 2026): your prior email-preferences row was used as a proxy for consent — if you had any non-zero category preference and had not unsubscribed-from-all, the migration set marketing_opted_in = 1 on your account, dated to the day your preferences were created. You can verify or change this at any time through the dashboard.

Withdrawal mechanics — three equivalent paths, each immediate, free, and as easy as the original opt-in (CASL § 6.5, GDPR Art. 7(3)):

• The single-click master toggle on your Email Preferences page. Flipping it off stops every marketing send Vaticin would otherwise make to you.
• The unsubscribe link in the footer of every marketing email. You can either unsubscribe from a single category or from all marketing in one click.
• The one-click unsubscribe button your mail client may render natively (Gmail, Apple Mail, Outlook). We attach RFC 8058 List-Unsubscribe and List-Unsubscribe-Post headers to every marketing email, so a single click in your mail app withdraws consent.

A withdrawal recorded by any of those three paths takes effect immediately and cascades into every category. You can re-enable individual categories from the dashboard at any time.

We never sell your email address, never rent it, and never share it with third parties for their marketing use. Every marketing email also includes the postal address required by CAN-SPAM § 7704(a)(5) and the disclosures required by CASL.

8. Children's Privacy

The Platform is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 13. If we discover that we have collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided personal information to us, please contact support@vaticin.ai.

For users 13–17, our Terms of Service prohibit use of the Platform. If we discover an account belongs to a user under 18, we will terminate the account and delete associated personal information.

9. International Data Transfers

Vaticin is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Platform, you consent to this transfer.

For users in the European Economic Area, United Kingdom, or Switzerland: where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms to lawfully transfer personal information from your jurisdiction to the United States.

10. Cookies and Similar Technologies

As of April 29, 2026, Vaticin runs an intentionally minimal cookie footprint. We use only what we strictly need to keep you signed in and to keep the Platform safe; we do not use any cookie for advertising, analytics, profiling, or cross-site tracking.

The complete list of cookies the Platform sets:

• Session cookie (vaticin_session): an HTTP-only, Secure, SameSite=Lax cookie that holds the cryptographically signed identifier for your logged-in session. Without it you cannot stay signed in. Strictly necessary; not subject to consent under ePrivacy Directive Art. 5(3) or its national implementations.
• Cloudflare security cookies (e.g. __cf_bm, Turnstile challenge cookies): set by our edge provider for bot mitigation, DDoS protection, and Turnstile challenge state. These also fall under the strictly-necessary carve-out.

No analytics or advertising cookies. Until April 29, 2026 the Platform loaded Google Analytics 4, which set the _ga / _ga_* identifiers and forwarded IP addresses to Google. We removed Google Analytics in full on that date and replaced it with Plausible Analytics, which is cookieless by design. Plausible records aggregate page-view counts and a one-day, in-memory hash to deduplicate visitors; it never sets a cookie, never uses fingerprinting, never collects an IP address, and never assigns a cross-site identifier. Because none of that processing meets the GDPR / ePrivacy threshold for “personal data” or “information stored on the user's terminal equipment,” we do not display a cookie consent banner — there is nothing to consent to.

You can still clear or block cookies through your browser settings. Blocking the session cookie will sign you out and prevent you from logging back in; blocking the Cloudflare cookies will degrade bot protection and may cause some pages to repeatedly challenge you.

If we ever introduce a cookie that is not strictly necessary, we will update this policy and present a compliant consent mechanism before any such cookie is set.

11. Do Not Track and Global Privacy Control

Vaticin does not track you across third-party websites for advertising purposes, regardless of any browser signal. Beyond that baseline:

• Global Privacy Control (GPC): when your browser sends the Sec-GPC: 1 header, we treat it as a valid opt-out request under California Code of Regulations § 7025 (CPRA implementing regulations). For California residents, a GPC signal is recognised as a request to opt out of any “sale” or “share” of personal information as those terms are defined by the CCPA / CPRA. Because Vaticin does not sell or share personal information for cross-context behavioural advertising in the first place, the GPC signal does not change how we process your data — but we honour it as a valid opt-out signal and will continue to honour it if our practices ever change.
• Persistent, account-level opt-out: a browser signal only travels with the browser that sent it. For a permanent record attached to your account, submit the form on our Do Not Sell or Share My Personal Information page. That request is stored against your user record and applies across every device, browser, and session.
• Legacy “Do Not Track” (DNT): the older DNT header was deprecated by major standards bodies before reaching consensus on its semantics. We do not act on DNT independently of GPC. If your browser sends both, the GPC signal governs.

12. Third-Party Links

The Platform may contain links to third-party websites, services, or applications. This Privacy Policy applies only to the Platform itself. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you visit.

13. AI Processing and Your Data

Vaticin is an AI-focused platform. Several features involve sending data to large language models:

• Prediction generation: Vaticin sends calendar data and prompts to Anthropic's Claude API to generate weekly prediction questions. No user-specific personal information is sent in these requests.
• Prediction resolution: Vaticin sends prediction text and resolution criteria to Anthropic's Claude API (with web search enabled) to determine outcomes. No user-specific personal information is sent in these requests.
• Embedded AI assistant: when you use the AI assistant in the agent code editor, your agent code, your prompts, and your conversation are sent to Anthropic, Google, or OpenAI using your stored API key. You bear the cost of these queries.
• Agent execution: when your agents run and call LLM APIs using your stored keys, the data your agent constructs in its prompts is sent to the relevant LLM provider. The contents of these prompts are determined by your agent's code and configuration.

We do not use your private agent code or strategy logic to train AI models accessible to other users.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy
• Notify you via email or a prominent notice on the Platform
• Where required by law, request your renewed consent

Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us at:

• Email: support@vaticin.ai
• Mailing Address: PO BOX 98666, Durham, NC, 27708-3399

For users in the European Economic Area or United Kingdom: if you have unresolved concerns, you have the right to lodge a complaint with your local data protection authority.

16. Changelog

A summary of material changes. The current authoritative version is always the text above; the changelog exists for transparency and to help you spot what changed since you last read this policy.

April 29, 2026

• Replaced Google Analytics with Plausible Analytics. Google Analytics 4 was removed in full. The replacement, Plausible, is cookieless, does not collect IP addresses, does not assign persistent identifiers, and does not build cross-site profiles. Section 3.1 (Service Providers) and Section 10 (Cookies) were updated accordingly. Cookie consent banner removed because the Platform no longer sets any non-essential cookie.
• Added a CCPA / CPRA Do Not Sell or Share opt-out page. Section 6.3 now links directly to /privacy/do-not-sell, which provides a Turnstile-protected form for any California resident (or anyone else) to record a permanent “do not sell or share” flag against their account. Vaticin does not in fact sell or share personal information for cross- context behavioural advertising; the page exists to give you the opt-out path the statute presumes you should always have.
• Restructured marketing-email consent (Section 7). New accounts: an unchecked-by-default “Yes, keep me in the game” checkbox at signup, with date / IP / user-agent recorded for demonstrable consent under CASL § 6, GDPR Art. 7(1), and CCPA / CPRA. Existing accounts: a migration-time backfill set the master flag to true for any user who already had a non-empty preferences row, dated to the day those preferences were created. Withdrawal: a single master toggle in the dashboard plus the existing in-email and one-click (RFC 8058) unsubscribe paths, all of which cascade into every category instantly.
• Declared Global Privacy Control honour (Section 11). We now explicitly honour the Sec-GPC: 1 browser signal as a valid CPRA opt-out request under California Code of Regulations § 7025. Section 11 was renamed from “Do Not Track” to “Do Not Track and Global Privacy Control” and rewritten to describe the difference.
• Privacy version bumped to 2026-04-29. Users signed up under the previous version may be re-prompted for acceptance the next time they visit a gated page.