This policy explains what we collect and why, how we handle it, and the rights you have over it. We never sell your data.
This policy applies to the websites and products built and maintained by Vesperion Gate Inc.: Thicket, LensCherry and vesperiongate.com (together, the “Services”). We are a Canadian company headquartered in Ontario. It covers site visitors, prospective customers, and customers and the people they authorize to use their accounts.
When an organization provides your account, it controls the workspace, who is in it and what is shared, and it decides why the content in it is processed. We process that content on its instructions under our Data Processing Addendum, which sets out our duties as a processor. If you have questions about how that organization handles your information, contact it first; if you write to us at [email protected], we will help or refer your request to it.
What we collect and why
We collect as little as the Services need. In practice:
Identity and access
Signing up asks for your name, your email address and sometimes an organization name, which set up your account and let us send you essential service information. A profile picture is optional. If you sign in with an external provider such as Google or Apple, we receive the identity information that sign-in supplies. We log sign-ins, sessions, IP addresses and device or browser details to keep accounts secure and to mitigate abusive signups, and we keep that access data while your account is active.
Billing information
If you buy a paid plan or credits, you give your payment details to our payment processor, Stripe; card numbers never reach our servers. We keep transaction records, with the card's last four digits and your billing address, for invoices, taxes, billing support and fraud prevention.
Product content
Everything you put in your accounts, or receive there, is stored so the products can do their job. In Thicket that is your projects, to-dos, messages, documents, comments, files, chat, schedules, assignments, notifications and activity. In LensCherry it is your prompts, reference photos, generated images, profiles and generation settings. It stays as long as the account does; deletion and closure are described below.
Product and website interactions
To run the products and investigate problems, we record usage and diagnostic information: account identifiers, which features were used and when, browser and operating-system details, performance information and error reports. Error reports can contain personal information. On Thicket’s public website and signup page we measure visits with Plausible, which receives the page address, the referring site and technical browser information, uses no cookies or persistent identifiers, and processes that data in the European Union. Private workspace pages, account identities and form contents are never sent to it.
Cookies
We use first-party cookies and similar browser storage to keep you signed in, protect against forgery and remember preferences. We run no advertising trackers and share no email hashes with ad networks; if we ever introduce optional analytics or advertising technologies that need consent, we will say so and ask first. You can clear or block cookies in your browser, though the products will not work without the essential ones.
Anti-bot assessments
Cloudflare Turnstile protects sign-up and selected forms from automated abuse. It evaluates technical browser and network information to tell a person from a program and gives us the result; we do not see the evaluated information.
Voluntary correspondence
If you write to us with a question or for help, we keep the exchange, address included, so that the history is there the next time you write. Information you volunteer, such as survey answers, is kept too, and we ask before recording a customer interview. Marketing email includes an unsubscribe link; essential service and security notices are separate.
Mobile app permissions
Our mobile apps ask before using the camera, photos, notifications or other sensitive features of your device. Consent is optional; a feature that needs a permission you decline will not work.
Access and disclosure
Running the products. Third-party providers help us run the Services: hosting, storage, backups, network protection, payments, email, support and diagnostics, and LensCherry’s image generation and safety screening. Our provider register lists each one, what it processes and where it is based.
Apps and services you connect. We share information with another service when you authorize a connection to Thicket, including through OAuth, an API token or the command-line tool. Its access is limited by the account and permissions you authorize, which may allow it to read, change or post content. You can revoke access in your account settings. Revoking access does not remove information the service already received or undo its actions. Its own terms and privacy policy govern the information it receives. Our connection help explains the access options and how to disconnect.
Sharing within and outside your workspace. Content is shared with the people and clients you give access to, through public links and exports you create, and in notifications the products send. Content posted by a connected app follows the same sharing rules.
Support, with your consent. A support case sometimes needs us to look inside your account, and we ask you first. Beyond that, nobody at Vesperion Gate reads your content except in the few situations below.
To fix errors. When an automated process stops partway, we get an alert. When we can fix it without looking at personal information, we do; in rare cases we have to look at the minimum needed.
Security and abuse. Logs and metadata are examined to keep accounts and the Services secure. Opening an account to investigate an abuse report is the last step, not the first. Where we find the Services put to a prohibited use, we take the action the situation calls for, which can include a report to the authorities.
Aggregated and de-identified data. We may use information that no longer identifies anyone for statistics, product decisions and marketing. Hashed or account-linked information is not treated as anonymous.
Legal requirements. We do not hand user data to a government on request. We disclose when legal process compels us, or when an emergency leaves no alternative, and then only the minimum, after telling the affected customers unless the law forbids it or the emergency makes prior notice inappropriate. Our infrastructure is in the United States, and our providers may face lawful requests in the countries they process in. If a tax authority audits us, we disclose only the billing information the audit needs.
If the company changes hands. If Vesperion Gate is acquired by or merges with another company, we will notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.
Artificial intelligence
Thicket does not have built-in AI features that process your content. We do not use your Thicket content for AI model training or allow providers processing it for us to do so. Our Data Processing Addendum sets out our obligations when we process customer content.
LensCherry is an AI product. It generates and edits images with providers we choose, Google’s Gemini API and, from October 14, 2026, OpenAI’s API, and screens images for safety with Google Cloud Vision. For each request those providers receive the prompt, the reference and generated images and technical request information, and keep them only as their terms describe; the provider register links to each one’s data handling and retention. A LensCherry profile is a set of reference images that guide generation, not a model trained on you. We keep your generation results and moderation outcomes in your account, and authorized staff may review reported or flagged images to investigate abuse.
Our own staff use assistants from Anthropic and OpenAI while building the products, for writing and reviewing code. Those tools sit outside the products and never touch your content: customer content, support correspondence and identifiable production records stay out of them, training on our conversations is turned off in each account, and both providers appear in our provider register.
You may connect an AI assistant or agent of your choice to Thicket. It uses the access you authorize, and your agreement with its provider and your settings govern how it handles information it receives, including storage, review and training. Read-only access still shares information. The section on apps and services you connect above describes that sharing.
Your rights with respect to your information
We extend the same rights to everyone, whatever the law where you live. Depending on applicable law, you may have the right to know what we collect and why, to access it and receive a copy you can take elsewhere, to correct it, to have it erased, to restrict or object to how it is used, to withdraw consent where consent is the legal basis, to not be subject to decisions made solely by automated processing, and to complain to a regulator. Exercising a right will never get you a worse service, though erasing some information can mean closing an account that needs it.
Many of these are in your hands in the products: you can change your profile and delete content yourself. For anything else, email [email protected]. We may need to verify your identity, and some requests belong to the organization that controls your workspace, in which case we will refer you to it. We respond within the period the applicable law allows, and if we cannot fulfill a request we will explain why and how to appeal.
You can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner, and in the EEA or the UK to your data protection authority. Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you, our legal obligations, our legitimate interest in securing and administering the Services, and consent where we ask for it. California residents have the rights to know, access, correct, delete and limit certain uses; we do not sell personal information or share it for cross-context behavioral advertising.
How we secure your data
Connections to our websites and products use HTTPS encryption. Uploaded files are encrypted at rest, and database backups are encrypted. Most data in our databases is not encrypted at rest, since the products need it ready to show you; it is protected by access controls, restricted administration and monitoring like the rest of our systems. Our Trust and Security page has the details, and our Security Response page says how to report a problem and what happens after you do.
What happens when you delete content in your accounts
In Thicket, items and projects you trash stay in the Trash for 30 days, where you can restore them; authorized Trash controls can remove them sooner. Some content, such as chat messages and individually deleted time entries, is deleted without a Trash recovery period. After trashed content is removed from our active systems, copies in our backups expire within 28 days of that.
If you close your Thicket account, or ask LensCherry to delete yours, access ends at once and you have 30 days to change your mind. Then your content is removed from our active systems, and ordinary backups are purged within 60 days of closure. We cannot recover content after that. See the Cancellation Policy for the difference between cancelling a plan and closing an account.
Data retention
We keep your information for as long as we need it for the purpose we collected it, and then delete or aggregate it, except where we must keep it to meet a legal obligation, resolve a dispute or enforce our agreements. Billing and tax records can outlast an account. Thicket’s connection audit records contain identifiers and action metadata, not content, and are deleted after 180 days; they may remain after an account closes. Records used to prevent duplicate actions can include saved action results and expire within 24 hours. Backup retention is described above and in the provider register. Copies held by apps you connect follow those apps’ own retention policies.
Location of site and data
Our products are housed in the United States: application servers, databases, uploaded files and backups for Thicket and LensCherry are all there, and we administer them from Canada. Our providers may process some information elsewhere, for support, networking, email, payments or AI processing, as the provider register notes. Information you give us from anywhere else in the world is therefore stored in the United States.
When transferring personal data from the EU or the UK
Personal data transferred out of the EU or the UK must be protected to the standard EU and UK law require. Our Data Processing Addendum, which forms part of our Terms of Service without a separate signature, incorporates the EU Standard Contractual Clauses and the UK Addendum for that purpose. You can read it on this site or download it as a PDF or a Markdown file. Canada’s adequacy arrangements apply within their scope and do not automatically cover onward transfers; write to us for the safeguards that apply to your account.
Changes and questions
This policy changes when our practices or the law do. For a change that matters, the date at the top moves, the policy updates page records what changed, and subscribers hear about it by email or feed. Where the law requires a specific notice or fresh consent, we provide it separately.
Anything to ask about this policy, your data or your rights? Email [email protected]. For help with your account, write to [email protected].