Viabasis Data-Trust Statement

This is a pilot version. Data-Trust Statement revision 2026-09-14.2, in the acceptance bundle viabasis-pilot-legal-2026-09-14.2. The same bundle identifies the Terms of Service and Privacy Policy revisions named at first sign-in.

Effective date: 2026-09-14.

This statement describes what Viabasis does with the material you bring, and it is the one place that explains the mechanism in full. The Terms of Service and the Privacy Policy state the obligations and point here for the detail. It is not legal advice. The product's outputs are drafts that need professional review. They are not pricing, legal, tax or accounting advice.

Part A — On-screen statement

A1. One line

We do not use your material to train models. It stays in your company workspace and never goes to suppliers, clients or another customer's workspace.

A2. Three clauses — train / keep / send

Train. We do not use your material to train models or opt it into Anthropic training. Keep. We keep it in your company's workspace, isolated from every other company, until you delete it. Send. AI reading paths send the needed input to Anthropic; structured workbook import and Basis do not. Hosting and database providers process what the product needs. Never your suppliers, clients or another customer's workspace.

A3. Expandable version

How Viabasis handles your data

Pasted text and text read from ordinary Office files go through the Viabasis server to Anthropic for classification and extraction; the Office-file bytes stay in your browser. Workbooks that Viabasis detects as complex are held for the deterministic sheet, row and scenario chooser instead. Simple workbooks, including some with formulas or several sheets, follow the ordinary Office-text path. PDF and image bytes pass through the server to Anthropic and are not retained by Viabasis as original files.

Anthropic's commercial API does not use inputs or outputs to train models by default and automatically deletes them from its backend within 30 days, subject to its published exceptions. Viabasis uses the Messages API, not the Files API, and has no verified zero-data-retention arrangement.

Your workspace — source text, extracted facts, business data, inline logo, question log and saved Basis conversations — is stored in Supabase Postgres. Original source files are not kept in Supabase Storage by the current app. Every public app table has row-level security.

Supplier-question phrasing sends Anthropic only bounded source snippets, confirmed facts, business rules and prior outcomes. A pasted supplier reply follows the extraction path and proposes changes for your confirmation. Basis currently uses deterministic code; its saved question and structured context are not sent to Anthropic.

We keep a per-company exact-match cache in Supabase for extraction and supplier-question results. It stores validated results and grounding snippets, not original file bytes, and expires after 30 days. Optional feedback may contain what you type; leave out traveller, supplier and price details.

We never email suppliers or clients and never move money. Email support@viabasis.com to request export or deletion. Live workspace data is deleted within 30 days. Daily project backups are available on the database provider's current Pro plan; we do not promise a customer-restorable restore window until one is verified.

Part B — Full statement

1. Who this covers

1.1 Viabasis is a quote-to-profit and season-money workspace for small group tour operators and travel advisors. It is operated by Manapar LLC ("we").

1.2 This statement covers the material you bring into Viabasis: supplier quotes, contracts, invoices, budget sheets, business rules, and the facts we extract from them. It also covers your account data.

1.3 It does not cover traveller or passenger data. Viabasis has no passenger records. During the pilot you agree not to enter traveller personal data.

2. What leaves your browser, and where it goes

2.1 Pasted or typed text. When you paste a quote, type in the source box or paste a supplier reply, the text goes to the Viabasis server and then to Anthropic for classification or extraction. The provider returns facts for you to review. A deterministic engine recomputes numbers and applies only changes you confirm. Any inferred number is labelled as an assumption.

2.2 Office files (.xlsx, .docx, .pptx). These are opened inside your browser and their bytes never leave it. Text from ordinary Office files can follow the classification and extraction path in 2.1. The current structural check holds a workbook for the deterministic season-import flow when it has at least 20 formula cells across two or more non-empty sheets; at least 40 formula cells that make up 20% or more of its populated cells; or at least 20 formula cells and five calculation-error cells. You then choose the sheet, rows and group-size scenario without sending the workbook or its extracted table to Anthropic. A simpler workbook, including one with several sheets or some formulas, follows the ordinary Office-text path.

2.3 PDF and image files. The file bytes are sent inline to the Viabasis server and on to Anthropic, which reads them. The server passes them through and the current app does not write them to disk, the database or Supabase Storage. The cache stores the validated extraction result keyed by a fingerprint, not the original bytes.

2.4 Document classification. Before extraction, the first 1,500 characters of pasted text or of a file's extracted text are sent to the provider to work out what kind of document it is (the server caps this at 2,000). PDF and image files are classified inside the same reading call.

2.5 Planning questions, supplier replies and Basis. When Viabasis phrases questions for a supplier, it sends Anthropic bounded structured input: relevant source snippets, confirmed facts, business rules and prior question outcomes for that departure. The raw source document is not sent on that path. A pasted supplier reply follows 2.1, is saved in the workspace and proposes a deterministic set of changes; nothing is applied until you confirm it. Basis currently answers from sanitised structured workspace records using deterministic code. Its question, context and answer pass through the Viabasis server and are saved in the workspace, but are not sent to Anthropic.

2.6 When the AI is unavailable. The current pilot allowance is USD 5 of AI spend per company per month, and we can raise it for a company. If the AI quota is reached, pasted or office-file text is not sent to the provider; a deterministic parser on our server reads it instead and the result is flagged. If the provider cannot be reached, the text was sent but no answer came back; the same parser then reads it. PDF and image files cannot be read without the provider; in either case the file is not read and you see an error for that file.

2.7 Provider terms. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models by default and are automatically deleted from its backend within 30 days. Anthropic documents exceptions for separately agreed retention, longer-lived features, safety enforcement, legal obligations and anonymised data. Viabasis uses the Messages API, does not use Anthropic's Files API, and does not submit customer work through Anthropic feedback or opt-in training channels. We have not verified or obtained a zero-data-retention arrangement. See Anthropic's retention policy and training policy.

2.8 Size limits. For pasted or browser-extracted text, Viabasis first sends only the first 1,500 characters for document classification (the server accepts no more than 2,000). If the complete text is longer than 60,000 characters, that short classification prefix may already have been sent, but the complete text is not sent for AI extraction. The deterministic parser on our server reads it instead, and the result is flagged so you know which path ran. An extraction request larger than 2 MB is refused.

3. What we store, where, and how it is isolated

3.1 Your company workspace is stored in Supabase Postgres. It contains trips; source text; extracted facts; supplier contacts and confirmed supplier payment details; business rules; an inline company logo; obligations and calendar; question logs; saved Basis questions, structured context and answers; and version history. Supplier payment details come only from pasted or browser-extracted readable source text that you then confirm; the current product has no manual typed-entry path for them.

3.2 Isolation and administrative access. Every public app table has row-level security. Company-scoped rows are tagged with the company that owns them, so one company cannot read, list or change another company's rows. Authorized Supabase project administrators and the application service role can access project data for operations and support. A small number of named administrators hold Owner or Administrator access, and everyone on our side who can reach your data is bound by confidentiality.

3.3 Account and access data. A public access request sends the name, work email, company and optional note through Resend to support@viabasis.com. It creates no account, membership or invitation. We review requests and manually create an invitation or confirmed membership. An invited email can request a Supabase Auth one-time sign-in link; custom SMTP is currently configured through Resend, and these emails carry the submitted access-request fields or the invited address and authentication link. No password is stored by Viabasis. The database supports company memberships, but the current product has no self-service teammate invitation screen; additional memberships are created on request to support. Public sign-up by verified work email is enabled; anonymous sign-in is disabled. Before the workspace opens, an automated check reads the business details you give and confirms that they describe a travel business. It never refuses you on its own. If it cannot confirm the business, a person reviews the request, and you hear from us by email within one business day. When you sign up we store your work email, the business name you enter, the time of sign-up, and, if you arrived from an advertisement link, the campaign labels in that link (never your search terms or a third-party identifier). Landing-page visits and 'Start free' clicks are counted without an account, with only the campaign labels from the link, the page path and a per-tab random session id.

3.4 Original files and logos. The current app does not retain original source files in Supabase Storage. The company logo is stored inline in the company profile row. A private company-files bucket exists for future use but currently has no application upload path.

3.5 AI spend ledger. A per-company record of AI calls: token counts (the unit of text the AI provider bills by), cost and month. No content.

3.6 Browser data. Original Office-file bytes and deterministic season-import tables stay in the browser. The hosted workspace itself is stored in Supabase Postgres. The current backup control writes a JSON file to the user's device; the exact coverage of a support-provided cloud export remains to be confirmed.

4. What we never do

4.1 We do not use your material to train models or opt it into Anthropic training. Anthropic says commercial API inputs and outputs are not used to train its models by default; clause 2.7 states the exact provider terms and exceptions.

4.2 We never sell your material or your account data.

4.3 We never share your material with another customer. No cross-company learning happens without your explicit consent, and then only in aggregate.

4.4 We never email your suppliers or your clients. Viabasis drafts the email; you copy and send it from your own mailbox. Viabasis uses email for access requests, manually initiated invitations, sign-in links, and ordinary support or service correspondence. Stripe sends its own payment communications. No marketing email and no digest unless you opt in later. If you opt in, Viabasis emails you a weekly reminder of the departure tasks and supplier payments due in the next 14 days. It lists titles and dates only, no amounts, with a one-click link to stop it.

4.5 We never execute payments and never send money to suppliers. Viabasis records what is owed and when. It moves no money.

4.6 We never see or store card numbers. See clause 8.

4.7 We never reuse a quote of yours as test material unless you opt in, per quote. If you do, we convert it to a sanitised synthetic fixture — the shape, not the content. There is no blanket consent.

4.8 We run no third-party analytics, no session replay and no advertising cookies.

5. The AI-result cache

5.1 Purpose. So identical text/file extraction and supplier-question phrasing requests are not processed and paid for twice.

5.2 What it holds. A one-way fingerprint of the exact input and schema version; the validated extraction or question result; grounding snippets included in that result; the model name; and timestamps. For PDF and image files the fingerprint is derived from the bytes, but the bytes themselves are not stored in the cache.

5.3 Match rule and scope. Exact match only and scoped to the company. One company's cache entry is never served to another. A changed input or schema version misses the cache.

5.4 Location and lifetime. The hosted lane stores the cache in the Supabase ai_cache table. Reads ignore entries older than 30 days, and an active daily database job purges them. The process-memory stores are restricted to the explicit no-cloud QA lane.

5.5 Deletion. Company deletion removes its cache entries. Support can also purge them on written request.

6. Usage telemetry

6.1 What we record. Event names, counts, durations, statuses and fixed-choice fields, for example a status such as "succeeded" or "failed". A typical event is "extraction_run", how long it took, and whether it succeeded. The purpose is to see where the product fails.

6.2 What ordinary telemetry excludes. Quote content, fact text, labels, amounts and question text. Fixed-choice fields are allowlisted at the receiver.

6.3 Voluntary-text exceptions. Optional session feedback can store up to 500 characters, and optional survey feedback can store up to 200 characters, of what you type. The interface asks you not to include traveller details, supplier information or prices. A small number of named administrators can read this feedback.

6.4 Session id. A random id is stored in browser sessionStorage. It is used for rate limiting and to understand whether a session got past a step. It is not a cookie and normally ends with that browser tab's session.

6.5 Cookies. Only strictly necessary cookies: the sign-in session and, while the preview password gate exists, the preview-session cookie. Neither carries workspace content. No advertising or analytics cookies.

6.6 Storage and life. Telemetry is stored in the telemetry table in the Viabasis database at Supabase. An active daily job deletes raw events after 12 months. The current schema has no separate long-lived telemetry aggregate.

7. Sub-processors

A sub-processor is a company we use to run Viabasis that handles your data on our behalf.

7.1 We will update this table before we add a sub-processor. We tell you 30 days before we add a sub-processor, by email.

8. Payments

8.1 The founding offer is paid through a Stripe Payment Link, hosted by Stripe. You enter card details on Stripe's page. Viabasis never sees or stores card numbers. Viabasis never executes a payment on your behalf.

8.2 Stripe keeps its own records of the transaction under its own terms. Deleting your Viabasis account does not delete Stripe's legal records.

8.3 Viabasis keeps a restricted signed-event log and a summary scoped to your company so we can match and acknowledge founding payments. The log holds bounded signed-event identifiers, payment status, amount, currency, mode and timestamps; the summary holds the reviewed subscription status and current reviewed paid-through date. If a match fails, the restricted record also keeps the review time, the reviewer and a short reason. The restricted log is visible only to Viabasis administrators; your company's members can read the resulting subscription status. It never holds card numbers, payment emails or raw payment-processor webhook bodies. A signed paid event is still pending until a reviewer verifies its signature and manually matches the customer and subscription in Stripe against the intended company, then records a reviewed current paid-through date. Target manual review is one staffed business day. For an existing accepted company workspace whose 14-day trial plus 7-day saving grace would otherwise end, a signed paid event keeps that workspace saving for at most 72 hours from Stripe's event timestamp while review is open, so a business that has just paid is not thrown into read-only mode; while review is open we show that review is pending and never ask you to pay again. After the trial and grace period, ongoing saving and the other Viabasis tools continue only while your company workspace has a manually matched paid subscription with a current reviewed paid-through date and no suspension. If manual review rejects the match, if the 72-hour continuation window expires without a completed match, or if the reviewed paid-through date lapses, the workspace returns to view, download, export and recovery only; the paid subscription in Stripe is unaffected and Viabasis neither cancels nor refunds Stripe activity. Suspension of an already-matched paid entitlement is reserved for a reviewed refund, a chargeback or dispute, delinquency, a paid period the reviewer has invalidated, or a breach of the Terms of Service; cancellation alone does not trigger suspension. Cancelling renewal by writing to support@viabasis.com takes effect at the end of the current paid period; saving and tools continue through that period.

9. How long we keep things

10. Your rights, export and deletion

10.1 Access and correction. You can see and correct your workspace in the product. Ask support@viabasis.com for anything you cannot reach. We answer within 1 business day and complete the request within the period your law sets: one month under GDPR and UK GDPR, 15 days under LGPD, and otherwise within 30 days.

10.2 Export. The current backup control downloads a JSON file to the user's device. A complete cloud-workspace export must be requested through support, and its exact field coverage must be verified before this becomes an in-force promise.

10.3 Deletion. Email support@viabasis.com from your account address. During the pilot, deleting an account or company is handled by support; a trip can be deleted in the app and its soft-deleted row is purged after 30 days. The database function removes live company-scoped rows and cache entries, unlinks telemetry and anonymises required spend totals; the support deletion procedure separately removes any reserved Storage prefix. We answer within 1 business day and complete the request within the period your law sets. Daily project backups are available on the current Pro plan, and we do not promise when a backup copy disappears until the restore window is verified.

10.4 Objection and complaint. You may object to processing and you may complain to your supervisory authority. Pilot companies may be in the EU (GDPR), the UK, the US, Brazil (LGPD) or elsewhere. Your local law applies to your rights.

10.5 Leaving the pilot. You can stop using Viabasis at any time. Ending the pilot, declining the founding offer or becoming inactive does not itself delete the workspace. Silence never authorizes deletion. The workspace moves through the trial, grace and paid-continuation states in 8.3, and remains available to view, download, export and recover while the account remains active. We delete it only after account or company deletion, your written deletion request, or service shutdown under the Terms of Service.

11. Roles

11.1 For your account data, Viabasis is the controller.

11.2 For the supplier material you bring — quotes, contracts, supplier contact identities, supplier bank details — your company is the controller and Viabasis is the processor. We process it only to run the product for you.

11.3 Our data-processing terms are in the Terms of Service, section 5. A data-processing agreement is available on request (Terms section 5) for pilots under the GDPR, the UK GDPR and Brazil's LGPD; write to support@viabasis.com and we send a copy.

12. Security posture, as of this draft

12.1 API keys live on the server only. They are never sent to the browser.

12.2 All source text is treated as untrusted data. The extraction prompt marks the start and end of your text and tells the model to read it, never to obey it. An adversarial test suite is re-run before every exposure.

12.3 Row-level security is enabled on every public app table in the current project.

12.4 Viabasis holds no card data.

12.5 Source code is in a private GitHub repository with no customer data in it.

12.6 Input sizes are capped (clause 2.8). The usage-log receiver limits how many events one browser can send per minute and refuses oversized messages.

12.7 If we learn of a breach affecting your data, we tell you without undue delay and within 72 hours of learning of it, by email. We tell you what we know at that time, even if our investigation is not finished.

13. Changes and contact

13.1 We will not weaken this statement for a pilot company during its pilot without written notice.

13.2 We publish the current version in the product and at https://viabasis.com. Each version carries its date.

13.3 Questions: support@viabasis.com. We reply within 1 business day.