Effective date: 2026-07-09
This Privacy Policy explains how Letzgro, Inc. ("VitruAI", "we") collects, uses, and shares information when you use the VitruAI service at app.vitruai.com, the VitruAI desktop add-ins, and vitruai.com (the "Service"). VitruAI is an AI platform for architecture, engineering, and construction (AEC), providing AI agents that assist with QA/QC, documentation, code-compliance review, coordination, and other project workflows.
For personal data contained in the model data our customers submit, we act as a processor on the customer's behalf under our Data Processing Addendum; the customer (your firm) is the controller and its own privacy policy governs that data.
1. Information we collect
- Account data — name, email, firm/organization, role, password hash, and authentication data.
- Customer/model data — the BIM/model data, files, project information, and prompts you submit, plus the Output the agents generate.
- Billing data — subscription, seat count, and credit-pool usage. Card details are handled by Stripe; we do not store full card numbers.
- Usage & device data — log data, IP address, browser/OS, add-in version, feature usage, and diagnostic events, used to operate and secure the Service.
- Cookies — see the Cookie Policy.
2. How we use information
To provide, operate, secure, and support the Service; to run the AI agents you use; to bill and manage subscriptions; to communicate service, security, and account messages; to detect and prevent abuse and fraud; and to comply with law. We rely on performance of our contract with you, our legitimate interests in operating and securing the Service, and your consent where required.
3. AI processing, LLM providers, and model training
VitruAI runs a roster of AI agents. To generate Output, we transmit your prompts and the relevant model/project data to the large language model (LLM) provider configured for the agent you use. Different agents may use different providers — currently Anthropic and OpenAI, and other LLM providers as configured. You can view and choose which provider an agent uses in the application.
These providers process the data under enterprise/API terms that do not permit training their foundation models on your inputs or outputs, and we do not use Customer Data to train our own models.
4. Sub-processors and sharing
We share data with the service providers needed to run the Service. We do not sell personal data.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| LLM providers — Anthropic, OpenAI, and others as configured per agent | Model inference (the agent's reasoning/generation) | prompts, model/project data | US (others vary) |
| OpenAI | Embeddings / file-search (RAG) | document text/chunks | US |
| Stripe | Payments & billing | billing/contact data | US |
| Resend | Transactional email | email address, message | US |
| Hetzner Online GmbH | Cloud hosting / storage | all hosted data | US (Ashburn, VA) |
| Cloudflare | DNS, CDN, TLS, WAF | request metadata, IP | Global edge |
The specific LLM sub-processor(s) that receive your data depend on the agents you use and the provider you select for each. We may also disclose information to comply with law, enforce our Terms, or in a merger/acquisition (with notice). A current sub-processor list is maintained in the DPA.
5. Data location
The Service is hosted and Customer Data is processed in the United States. VitruAI is offered to US customers and is not directed to individuals in the EEA or UK. If you access the Service from outside the US, you consent to processing in the US.
6. Retention
We retain account and billing data for the life of the account and as required for legal/accounting purposes. Customer/model data is retained for the life of your firm's account; it is deleted on written request or after account closure (see §8). After account closure it is available for export for 30 days, then deleted. Backups are retained on a rolling basis (approximately 30 days) and then overwritten.
7. Security
We use tenant isolation, encryption in transit (TLS), access controls, credentialed databases, and encrypted off-site backups. No method is perfectly secure; we cannot guarantee absolute security.
8. Your rights
Depending on your jurisdiction you may have rights to access, correct, delete, port, or restrict your personal data, and to object or withdraw consent. For account data, email [email protected]. For model/Customer Data, direct requests to your firm (the controller); we will assist the firm per the DPA. Data export and deletion are currently handled manually on written request within 30 days.
9. Children
The Service is not directed to children under 18 and we do not knowingly collect their data.
10. Changes and contact
We may update this Policy; material changes will be notified in-app or by email. Contact: [email protected], Letzgro, Inc., 541 Jefferson Ave, Ste #100, Redwood City, CA 94063.