Privacy Policy

Last updated: October 28, 2026

This Privacy Policy explains how Vigor Gems ("Vigor", "we", "us") collects, uses and shares information when you use the VgemsAI app and its widgets, the Vigor Gems website, and your account, which works in both (together, "our services").

Our services are made for jewelry and gemstone businesses, such as retailers, designers, manufacturers and online sellers. If you have questions, write to us at [email protected]

Summary

• We collect what you give us when you sign up or contact us (your name, email and company details), the questions you ask our AI assistant, and basic information about your device for sign-in security.
• Your signup becomes a business lead for our sales team, who can read your chats with the assistant in the app to understand what you are looking for and follow up with you.
• Questions you ask the assistant are sent to an AI provider (Anthropic or OpenAI) to write the answers.
• On the website, Google Analytics runs only if you accept it in the cookie banner.
• We don't sell your personal information, we don't show ads, and we don't track you across other companies' apps or websites.
• Chats in the app are deleted automatically after 90 days. You can delete your account and its data at any time.

Information you give us

• Account details: your name, email address and password. We never store your password itself, only a one-way hash of it that can't be turned back into the password.
• Company details: the company you work for, your job title, business type, industry, phone number, website and business address (street, city, state or province, postal code and country). You give these at signup and can change them later in your account, in the app or on the website.
• Chats with the AI assistant: the questions you type and the answers you receive. In the app, we save them with your account. On the website, the conversation stays in your browser, and we don't save it.
• Contact form: your name, email address, company, phone number and message when you send us a request on the website, such as a quote or meeting request. It is emailed to our sales team.
• Messages to us: what you send us when you contact us by email.

Information collected automatically

• Device information (app): a random identifier that the app creates the first time you use it (it isn't your device's hardware identifier and changes if you erase or replace your device), your device model, iOS version and app version. We use it to keep your account secure, for example to recognize sign-ins from a new device.
• Device key (app): a random secret the app creates and keeps in your device's Keychain. We keep only a hash of it, which lets us recognize a device that has already signed in to your account.
• Push notification token (app): the address Apple gives your device for notifications, only while notifications are turned on in the app's Settings. Turning them off there deletes it from our servers.
• Sign-in information: when you sign in, from which of your devices, and the sign-in sessions that keep you signed in.
• Usage information about chats (app): when each question was asked, which AI model answered, the length of the answer and how long it took.
• Server logs: like most online services, our servers record the IP address, time and address of each request they receive. We use these logs for security, to limit abuse (for example, repeated failed sign-ins or contact form messages) and to fix problems.
• Website analytics: if you accept it in the cookie banner, Google Analytics collects which pages you visit, how you got there, and your browser, device and approximate location (based on your IP address). It helps us understand how the website is used. We don't use it for advertising.

Cookies and other data in your browser

The website uses:

• Sign-in cookies: when you log in on the website, two cookies keep you signed in. They are needed for your account to work, and the website's scripts can't read them.
• Your choices: your language and your answer to the cookie banner, kept in your browser's storage.
• Google Analytics cookies (names starting with _ga): only if you accept analytics. You can change your choice at any time with Cookie settings at the bottom of every page. Declining removes these cookies.

The website also loads fonts from Google Fonts and event maps from Apple Maps or Google Maps. To show them, your browser connects to Google or Apple, which receive your IP address and information about your browser.

What stays on your device

Some information never leaves your device: in the app, your cart, your wishlist, your price predictions, your appearance setting, map locations the app has looked up, and the information your widgets show.

Face ID, Touch ID and passkeys: we never receive your face, fingerprint or any other biometric data. When you turn on Face ID or Touch ID sign-in, your device creates a key that only works after it recognizes you; we receive only the public half of that key, which can check a sign-in but not create one. Passkeys work the same way and are kept by Apple in your iCloud Keychain.

The app doesn't access your location, contacts, photos, camera, microphone or your device's advertising identifier.

How we use your information

• To provide our services: to create your account, sign you in, keep you signed in, email you sign-in codes and password reset codes, answer your questions in the chat, answer your requests, and show events and other content.
• For our business relationship with you: when you sign up, your name, email and company details are saved in our customer records as a business lead. Our sales team uses them, together with your chats in the app and short summaries and topics of those conversations written by the AI, to understand what you are looking for, answer your requests and contact you about wholesale accounts, quotes, products and events.
• To keep our services secure: to recognize new devices, ask for an emailed code before a password sign-in on a device that hasn't signed in to your account before, limit the number of sign-in attempts, questions and messages, and prevent fraud and misuse.
• To send notifications: if you allow them in the app.
• To improve our services: to fix problems, understand how the website is used (with your consent) and improve the app, the website and the assistant's instructions.
• To comply with the law: to meet legal, tax and accounting obligations, and to protect our rights and the rights and safety of others.

The AI assistant

When you ask the assistant a question, the question and the earlier messages of the same conversation are sent to our AI provider to write the answer. In the app, our provider is currently Anthropic (Claude), and we may use OpenAI instead; on the website, it is Anthropic. They process your chats for us, and under the business terms we use them on, they don't use your chats to train their AI models. We also use the same provider to write the summaries of your app conversations for our sales team.

Please don't share sensitive personal information in the chat, such as financial account numbers, government ID numbers, health information, or personal information about other people. AI answers can be wrong; please confirm important details with your account manager.

Who we share information with

We don't sell your personal information, and we don't share it for advertising based on your activity across other companies' apps or websites ("cross-context behavioral advertising").

We share personal information only with:

• Service providers who work for us and may use it only to provide their services to us:
• • Amazon Web Services, which hosts our servers, databases and files;
  • Anthropic and OpenAI, which write the assistant's answers and the conversation summaries;
  • Twilio SendGrid, which sends our emails, such as sign-in codes, password reset codes and contact form messages;
  • Google, for website analytics if you accept it, and for the fonts and maps the website loads;
  • Apple, which delivers push notifications to your device, keeps your passkeys and provides maps.
• Our team, such as sales and customer care, who need it to work with you.
• Authorities and others when the law requires it, or when it's needed to protect our rights, our customers or the public, for example to prevent fraud.
• A buyer or successor if Vigor is involved in a merger, acquisition, reorganization or sale of assets, in which case this policy continues to apply to your information.
• Anyone else with your permission.

To show events on the map, the app may look up an event's venue and address in Apple Maps. That lookup contains information about the event, not about you.

How long we keep information

• Your account and company details: for as long as your account exists.
• Chats in the app: each message is deleted automatically 90 days after it was sent, and each conversation, with its summary, 90 days after its last message. We don't save chats on the website.
• Contact form messages: in our email, for as long as we need them to answer you and follow up on your request.
• Sign-in sessions: they end when you log out, or after 30 days without using them.
• Sign-in codes and password reset codes: deleted within a day after they expire.
• Customer records: if we work with you as a customer, for example once you open a wholesale account or place an order, we keep the records of our business relationship for as long as we need them for that relationship and as long as the law requires (for example, for tax and accounting).
• Website analytics: Google keeps it for the period set in our Google Analytics account, at most 14 months.
• Server logs: for a limited time, as needed for security and troubleshooting.

Deleting your account

You can delete your account at any time: in the app, open your profile and tap Delete Account; on the website, open My account and delete it there. You need your password. This deletes, right away and for good:

• your account, sign-in sessions, devices, Face ID or Touch ID sign-in keys and passkeys on our servers;
• all your chats with the assistant in the app;
• the company details from your signup, unless you are already a customer we work with. In that case, we keep the records of our business relationship, unlinked from your account, as described above. You can ask us to delete those records too, and we will, except for what the law requires us to keep.

A passkey you created also stays in your iCloud Keychain until you delete it in your device's Passwords app.

How we protect information

All information between the app or the website and our servers is encrypted in transit (HTTPS). Names, email addresses, push notification tokens and company details waiting to be saved in our customer records are also encrypted in our account database. Passwords and device keys are stored only as one-way hashes. A password sign-in on a new device needs a code sent to your email, and our team's access to our customer records requires two-factor authentication.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. If you think your account has been compromised, change your password and contact us.

Your choices and rights

• See and update your information: your name and company details are in your account, in the app or on the website. To change the email address of your account, contact us.
• Delete your account: in the app or on the website, as described above.
• Analytics: accept or decline it with Cookie settings at the bottom of every page of the website.
• Notifications: turn them off in the app's Settings, or in your device's Settings.
• Sales contact: you can ask us at any time to stop contacting you about our products and services.

Depending on where you live, you may also have the right to:

• know what personal information we have about you and how we use and share it, and get a copy of it;
• correct inaccurate information;
• delete your information;
• get your information in a portable format;
• withdraw your consent, where we rely on it;
• opt out of the sale or sharing of your personal information, targeted advertising, or profiling that has legal or similarly significant effects. We don't do any of these.

To use these rights, write to us at [email protected] from the email address of your account. We may need to confirm your identity before we act on a request, and we answer within the time the law requires, usually 30 to 45 days. You can also have an authorized agent make a request for you, in which case we may ask for proof that you authorized it. We won't treat you differently for using your privacy rights. If we decline your request, you can appeal by replying to our answer, and we will explain our decision on the appeal in writing.

United States residents

This section is for residents of California and other US states with consumer privacy laws.

In the past 12 months we have collected these categories of personal information, from you, from your device and from your browser, for the purposes described in "How we use your information":

• Identifiers: name, email address, device identifier, IP address and push notification token.
• Professional or employment-related information: company, job title, business type, industry, business phone number, website and address.
• Internet or other electronic network activity: your chats with the assistant, sign-in information, server logs and, if you accept it, website analytics.
• Approximate location: derived from your IP address by Google Analytics, if you accept it.
• Inferences: conversation summaries and topics, which help our sales team understand what you are interested in.
• Sensitive personal information: your account email and password, which we use only to provide and secure your account.

We disclose these categories to the service providers listed above for business purposes. We don't sell or share personal information, including that of people under 16, and we don't use sensitive personal information to infer characteristics about you.

Canadian residents

We handle your personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. Your information is stored and processed in the United States, and our service providers may process it in other countries. While it is there, it is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities.

You can ask to access and correct your personal information and withdraw your consent, subject to legal and contractual limits. Our privacy officer is responsible for this policy and can be reached at [email protected]. If you aren't satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

Users in other countries

Our services are mainly for customers in North America. If you use them from elsewhere, your information is transferred to and processed in the United States. Where the law requires a legal basis, we rely on our contract with you (to provide our services), our legitimate interests (to run our business, follow up with business customers and keep our services secure), your consent (for example, for website analytics and notifications) and our legal obligations. You may also have the right to object to our use of your information and to complain to your local data protection authority.

Children

Our services are for businesses and aren't directed to children. You must be at least 18 years old to create an account. We don't knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date at the top. If the changes are significant, we will also tell you in the app, on the website or by email before they take effect.

Contact us

For questions about this policy or your information, write to Vigor Gems at [email protected]