Policy Update History | Vesperion Gate

This page records material policy revisions. Subscribe to the policy updates feed to be notified of changes, including notice of new or replacement subprocessors under the Data Processing Addendum. Where the law requires a specific notice or fresh consent, we provide it separately.

September 9, 2026

Added Plausible Insights OÜ to the provider register before enabling public website analytics for Thicket. The Privacy Policy now describes the public page and signup-page measurements, EU processing, and the exclusion of private workspace data, account identities, form contents and customer conversion events.
Archived the preceding Privacy Policy and provider register below.

September 8, 2026

Aligned the Data Processing Addendum's subprocessor process with the Basecamp open-source policies our documents are adapted from: current providers are listed in the provider register, notice of a new or replacement provider is posted here before it processes customer data, subscribers to the policy updates feed are notified, an objection may be raised within ten business days, and if the concern cannot be resolved within thirty days the affected service may be ended with a refund of prepaid fees for the remainder of the term.
Revised the Terms of Service liability section to the same precedent's wording, keeping the sentence that preserves rights the law does not allow us to exclude.
Replaced the account-email notice wording in the Privacy Policy and Terms with the update history and feed, and added the feed.
Thicket and LensCherry signup alerts to our operations chat no longer include any personal information: only the sign-in method, the time and a link to our administration console. The Telegram disclosure added on September 4 is retired from the Privacy Policy and the provider register.
Named the AI assistant tools our staff use (Anthropic's Claude, OpenAI's ChatGPT and Codex), how training on our conversations is disabled and the providers' exceptions, and why these tools are not subprocessors: customer content and personal data stay out of them.
Archived the September 4 Data Processing Addendum and Terms text below.

September 4, 2026

Explained data shared with customer-selected AI tools through APIs, CLI tools, MCP, and agent members, including current access boundaries and the limits of disconnecting.
Separated customer-selected tools, LensCherry's built-in AI processing, and the approval requirements for staff AI use.
Added a provider register and Data Processing Addendum.
Corrected an omission in the provider register: existing Thicket and LensCherry signup alerts send contact details to a private Telegram operations chat. Disclosed the information sent and that account closure does not automatically remove those messages. This is a correction to the description of existing processing.
Corrected storage locations following the completed move to US object storage and backups. Removed the monthly and annual database tier, shortened ordinary customer-content recovery backups to 28 days, and aligned operations with deletion from ordinary recovery backups within 60 days of account closure.
Disclosed MCP audit and duplicate-action records, provider retention, and the distinction between account-content deletion and other necessary records.
Allowed supported automation explicitly. Limited LensCherry image terms to the relevant features and replaced the perpetual promotional content license with permissions needed to provide the service.
Updated LensCherry billing descriptions for one-time credit packs while preserving the earlier subscription guarantee. Clarified account ownership and separate provider billing.

Current documents: Privacy, Terms, Cancellation, Refunds, and Account Ownership.

Previous published versions

These archived text copies preserve the policy wording that preceded this revision. They contain historical information and are not the current policies.

Questions about a revision or a notice: [email protected].