Privacy policy

Last updated 24 October 2026

Vortops is operated by Christopher Ross from Fort Erie, Ontario. This policy explains what personal information Vortops collects when you use this website, create an account, set up a project, or run tasks that use credits. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). If you are in the European Economic Area or the United Kingdom, the section on international users applies too.

Who is responsible for your information

Christopher Ross, operating as Vortops is responsible for the personal information described here. Write to us through thecontact page or by mail at 210 Gilmore Road, Fort Erie, Ontario L2A 2M3, Canada. Privacy questions and requests go to the same place.

What we collect, and why

• Account details. Your email address and name. Used to create your account, sign you in (with Google, which gives us only your verified email address and name and never a password or access to your mail, files or contacts, or with a one-time emailed link), and send you messages about your account and purchases.
• Billing details. Payments are handled by Stripe. We never see or store your full card number. We keep your Stripe customer reference, plan, invoices, credit purchases and tax details we are required to record.
• Projects and keys. The name and address of each project, the name of the product that uses it, and a hashed form of each key. Used to authorise requests and to show you which projects are using your credits.
• Usage records. For each task: when it ran, which site, plugin, theme or app asked, which task and model, how many credits it used, how long it took and whether it succeeded. Used to charge you correctly, to prevent abuse, to show you your usage and to keep the service running.
• Content you send for processing. The text, images or audio a plugin, theme or the sandbox sends so a model can produce a result. We use it to produce that result. By default we do not store your prompts, uploads or results after the request completes. If a feature needs to keep content, for example a saved result you asked for, we say so where you use it.
• Security and server logs. IP address, browser details, requested pages and timestamps. Kept for up to 90 days to keep the service secure and investigate problems.
• Newsletter. If you subscribe, we keep your email address, the page you signed up on, the time and the wording you agreed to. Every email has an unsubscribe link.
• Messages to us. What you send through the contact form and our reply, kept so we can help you and keep a record.

The advisor

The dashboard has an advisor you can chat with. What you type is sent to an AI model, through Vortops, to write an answer. The advisor cannot see your website or account. Your chats (your questions and the answers) are saved on your account so you can come back to them, and are kept until you delete them from the Advisor page. We also record that you asked, when, and what it cost in credits, so your first free questions can be counted and your credits balance is right. Do not put passwords, card numbers or other secrets in a chat.

The playground

The playground sends the prompt you write to the model you pick and shows the answer. Prompts and answers are not saved. We record the model, the time and the credits used.

What we do not do

• We do not sell your personal information.
• We do not use your content to train AI models, and we do not give it to anyone for that purpose.
• We do not run advertising or cross-site tracking.

Why we are allowed to use it

Under PIPEDA we rely on your consent, which you give when you create an account and use the service, and on what is needed to deliver the service you asked for. Marketing email is sent only with your express consent under CASL, and every message has a working unsubscribe link. Account and billing messages are not marketing.

Who else processes your information

A small number of providers help run Vortops. They handle information only to provide their service to us. The current list is on the subprocessors page. In short: Cloudflare hosts the website, database, file storage and AI models, and Stripe handles payments.

Cloudflare states in its Workers AI documentation that it does not retain the inputs and outputs of standard requests once they are processed and does not use that content to train AI models. If we ever offer models from other providers, we will say so on the page where you choose the model, because those providers handle content under their own terms.

Some providers process information in the United States or other countries, where it may be accessible to courts and authorities under local law.

How long we keep it

• Account and connected-site details: while your account is open, and for a short period afterwards so you can come back.
• Usage records: while your account is open, so you can see your history.
• Invoices and payment records: six years, because Canadian tax law requires it.
• Security and server logs: up to 90 days. Our own record of refused or suspicious requests, which holds a one-way fingerprint of the connection and never the address itself, is kept for 28 days.
• Results saved in your dashboard history: until you delete them, or 180 days, whichever comes first.
• Sign-in links and expired sessions: removed within a day of expiring.
• Content you send for processing: not stored by default, as described above.

Your choices and rights

You can ask to see the personal information we hold about you, correct it, withdraw your consent, or have your account and the information tied to it deleted. You can download your data or delete your account yourself from the Your account page in the dashboard; deleting is immediate and cannot be undone, and we will not delete an account while a monthly plan is active. Or contact us as described above. We answer within 30 days. We may keep information we are legally required to keep, such as invoices. If you are not satisfied with our answer you can complain to the Office of the Privacy Commissioner of Canada.

Cookies

Vortops uses a small number of cookies needed to keep you signed in and keep the service secure. There are no advertising cookies. See the cookie notice.

International users

If you are in the European Economic Area or the United Kingdom, our legal bases are performing our contract with you (providing the service), our legitimate interests in security and preventing abuse, legal obligations such as tax records, and your consent where we ask for it. You also have the rights to object, to restrict processing and to data portability, and to complain to your local data protection authority. Information is transferred to Canada and the United States under the safeguards our providers offer.

Security and breaches

We protect information as described on the security page. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner as the law requires.

Children

Vortops is for adults. It is not directed at children, and we do not knowingly collect their information.

Changes to this policy

If we change this policy in a way that matters, we will update the date above and tell account holders by email before the change takes effect.