Privacy policy

For this website and for Vesper accounts, Lunmark is the data controller.

For the conversations between a business and its clients, the business is the controller. Lunmark processes that data on the business's behalf, only to provide Vesper.

Account data: your name, email address, your organization's name, and the people you invite.

Conversation data: the messages clients send to your connected channels and the replies sent to them, the name or username a client uses on that channel, and a phone number or email address if the client gives one, for example to get a reminder.

Client records: the profiles, appointments and notes your team keeps in Vesper.

Channel connections: the tokens and account IDs needed to connect your Instagram, Facebook, WhatsApp, Viber, Telegram or website chat.

Billing data: your plan, invoices and how many credits you use. If you pay by card, the card details go to the payment provider, not to us.

Technical data: server logs such as IP address, browser and time of request, kept to run and secure the service.

This website sets one cookie, NEXT_LOCALE, to remember your language. The Vesper app sets a session cookie, fd.sid, to keep you signed in.

We don't use advertising or analytics cookies.

To run Vesper: receive and send messages, write replies, keep client profiles and send reminders.

To bill you and tell you about your account, for example when you're close to your credit limit.

To keep the service secure and to fix problems.

We don't sell personal data, and we don't use your conversations to train AI models.

To write a reply, Vesper sends the conversation and what you've told it about your business to OpenAI, which generates the text. OpenAI processes this data for us and, under its API terms, doesn't use it to train its models.

The messaging platforms you connect carry the messages under their own privacy policies: Meta (Instagram, Facebook, WhatsApp), Viber and Telegram.

SMS reminders go out through your own phone with the Vesper mobile app, or through your Twilio account. Email providers deliver email reminders.

Our hosting and infrastructure providers store the data.

Authorities, when the law requires it.

Some of these providers, including OpenAI and Meta, process data outside Serbia, mainly in the United States. We use them only with the safeguards Serbian law and the GDPR require, such as standard contractual clauses.

We keep data while your account is open. When you close it, we delete your organization's conversations and client records, except what the law requires us to keep, such as invoices.

Under Serbia's Law on Personal Data Protection and the GDPR, you can ask to see, correct, delete or export your data, restrict or object to how we use it, and withdraw consent where we rely on it. Write to [email protected].

If you're a client of a business that uses Vesper, you can contact that business or us. We'll help the business answer you.

You can also complain to the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

To delete your account and all of its data, write to [email protected] from your account's email address.

If you wrote to a business through Vesper and want your messages and details deleted, write to that business or to [email protected]. We'll delete them within 30 days and confirm when it's done.

If we change this policy in a way that matters, we'll email account owners before the change takes effect.