Data Handling Practices

1.1 Broker PII (Personally Identifiable Information)

Collected at account creation and stored in Firebase Firestore under broker-scoped documents. Includes: name, brokerage, email, phone, profile photo, and license attestation.

Access: Broker (read/write own data only). Vesli team (read-only for support). No other parties.

1.2 Client PII (Buyer Information Entered by Broker)

Brokers may optionally enter client or prospective seller names, email addresses, and phone numbers when creating client collections or Market Analysis reports. This data is stored in Firestore under the broker's document scope.

Access: Broker only. Vesli does not read, use, or process this data for any internal purpose.

Retention: Until broker deletes the collection or closes their account. On account closure, this data is deleted from active systems.

1.3 Buyer Engagement Data

Automatically generated when a Buyer interacts with a client collection. Includes: reactions per listing, notes, time spent per listing, view counts, showing requests, and session timestamps.

This data is associated with the broker's client collection in Firestore. It is used to power the broker's real-time dashboard and, in aggregated, anonymized form, to generate platform benchmarks.

Access: Broker (real-time dashboard). Vesli (aggregated analytics only; individual collection data is not reviewed by Vesli staff in normal operations).

1.4 Listing Content

Vessel listings input by brokers via PDF upload (Boatwizard exports), listing links, manual entry, the browser extension, or Sonar searches. This content is stored in the broker's own client collections, reports, or boat folders in Firestore.

Vesli does not run background or bulk collection of listing data. Every retrieval starts with a broker action, such as a search, an import, or a click on the extension. Brokers attest at signup that they have the right to share content they input.

1.5 Market Analysis Reports and Boat Folders

Reports contain vessel details, comparable listings, brokerage branding, notes, and optionally a seller name. Boat folders contain saved listings (details and links to photos). Both are stored under the broker's account. Reports are readable by anyone holding the report's unguessable share link, and by no one else except the broker.

Access: Broker. Vesli team (read-only for support, on request). Report link holders (that report only).

1.6 Browser Extension Data

When a broker clicks a Vesli button on a page, the extension reads that one page's visible text, title, address, structured listing data, and photo links, and sends them to Vesli over HTTPS. On Facebook Marketplace this can include the seller name and listing details shown on the page. On HubSpot this is the text of the one contact record on screen, which is organized by an AI service and shown to the broker to review before anything is saved. Page contents are processed to extract vessel details and are not stored as raw page text. Only the extracted details and photo links are saved.

The extension does not read pages in the background, does not collect browsing history, and does not read passwords, payment details, messages, or form entries. It does not contact sellers or post on the broker's behalf.

Stored in the browser: a sign-in token and the last folder chosen, in the browser's extension storage. These are removed when the broker disconnects the extension or uninstalls it.

1.7 Platform Usage Metadata

Standard technical logs including IP addresses, session duration, device type, and feature usage. Used for debugging, product improvement, and security monitoring. Retained for 90 days.

2.1 Database

Primary data store: Firebase Firestore (Google Cloud). Data is organized in a broker-scoped document hierarchy. Firebase security rules enforce that each authenticated broker can only read and write their own documents. Cross-broker data access is not permitted at the database level.

2.2 Authentication

Broker authentication: Firebase Auth (email/password or SSO). Buyers do not authenticate, collection access is via unique link. Collection links are long-form UUIDs that are not guessable.

2.3 File Storage

PDF uploads are processed in-memory using PDF.js for binary extraction and OpenAI Vision API for text and spec parsing. Uploaded PDFs are not permanently stored by Vesli after processing is complete. Extracted vessel data is stored in Firestore.

2.4 Browser Extension Access

The extension signs in with a Firebase refresh token issued when the broker connects it from their Vesli account. The token is exchanged for a short-lived ID token for each request, and Firebase security rules treat extension requests exactly like requests from the broker's own session, so a broker can only read and write their own folders and reports. Extension requests are accepted only with a valid token.

2.5 Payments

Payment processing: Stripe. Vesli does not store credit card numbers, bank account details, or any raw payment instrument data. Vesli stores only the Stripe customer ID and subscription status for each broker account.

2.6 Email

Transactional email (collection emails to clients, client activity notifications to brokers, account updates): Resend. Broker and client email addresses are transmitted to Resend solely for the purpose of delivering these emails. A client is emailed only after their broker shares a collection with them by email, and every client email carries an unsubscribe link that is honored. Resend is contractually prohibited from using these addresses for its own marketing.

2.7 Maps

Market Analysis maps send listing location text (such as a city name) to OpenStreetMap's Nominatim geocoding service and load map tiles from Esri. No broker, client, or seller identity is sent with these requests.

3.1 Broker Data

Brokers own their client relationships and the client information they enter into the Platform. Vesli does not claim ownership of broker-entered client PII.

3.2 Engagement Data

Buyer engagement data generated through a broker's client collection is jointly owned by Vesli and the broker. Brokers have full access to their collection's engagement data. Vesli retains rights to use this data in aggregated, anonymized form for platform analytics and benchmarking.

3.3 Listing Content

Listing content entered or saved by brokers remains subject to the intellectual property rights of the original content owners (listing brokers, MLS platforms, photographers, etc.). Vesli's role is as a passive technology platform; brokers are responsible for their content rights.

Active Accounts

All broker and client data retained for the duration of account activity. No automatic expiration.

Collection Deletion

When a broker deletes a client collection (feature in development), all client PII and engagement data associated with that collection is deleted from Firestore. Brokers can remove boats and folders from My boats at any time, which deletes them from Firestore.

Account Closure

Client PII (name, email, phone) entered by the broker: deleted from active systems. Anonymized engagement data: may be retained for internal benchmarking. Platform usage logs: deleted after 90 days per standard log retention.

Legal Hold

Data subject to a valid legal hold or law enforcement request will be retained for the duration of the applicable requirement.

The following third-party services process Vesli user data:

• Firebase (Google): Database hosting, authentication. Google Cloud Terms + DPA apply.
• Stripe: Payment processing. PCI-DSS Level 1 certified. Vesli stores no raw payment data.
• Resend: Transactional email delivery. Broker and client emails used only for delivery.
• OpenAI: PDF and image parsing via Vision API, and extraction of vessel details from listing pages. Vessel specs and the text of a listing page the broker chooses to save are sent for extraction. That page text can include a seller's publicly shown name. Client information entered by the broker in the Platform is not sent. Vesli uses API settings that do not permit this data to be used for model training.
• Vercel: Platform hosting. Application traffic routed through Vercel infrastructure.
• OpenStreetMap (Nominatim) and Esri: Location lookup and map tiles for report maps. Location text only.
• A web retrieval provider: Fetches public listing pages when a broker runs a search or import. No client PII transmitted.

Vesli LLC is registered as a DMCA Safe Harbor agent under 17 U.S.C. § 512. Registration Number: DMCA-1072974. Registered agent: Joel Iglesias Gomes, Vesli LLC, 1000 Brickell Ave, Ste 715 PMB 2237, Miami, FL 33131. Email: info@vesli.app.

Until registration is complete, direct all copyright takedown requests to legal@vesli.app. Vesli will respond to valid requests within a commercially reasonable timeframe.

In the event of a confirmed data breach affecting broker or buyer information, Vesli will:

• Assess the scope and nature of the breach within 24 hours of discovery
• Notify affected brokers via email within 72 hours where required by law
• Take immediate steps to contain the breach and secure affected systems
• Cooperate with applicable regulatory bodies as required

Brokers who discover or suspect a security incident should report it immediately to security@vesli.app.

• Data and privacy questions: privacy@vesli.app
• Security issues: security@vesli.app
• Legal and compliance: legal@vesli.app
• General support: support@vesli.app
• Mailing Address: Vesli LLC, 1000 Brickell Ave, Ste 715 PMB 2237, Miami, FL 33131
• DMCA Agent Registration Number: DMCA-1072974