Updated June 17, 2026
Privacy Policy
How VETAID handles the information you share with us, and the operational-security boundaries we built around it.
Who we are
VETAID is an AI-powered navigator that helps active-duty service members, transitioning service members, National Guard and Reserve members, recently separated veterans, veterans, and their families find accurate, up-to-date information about benefits, claims, transition resources, and Veterans Service Organizations.
VETAID is operated by VETAID LLC. It is a guide and educator, not a filing tool, a law firm, or a healthcare provider. We do not file claims on your behalf, and nothing VETAID returns is legal, medical, or financial advice.
How VETAID uses AI
VETAID is an AI-assisted search and chat tool. When you ask a question, two services work together:
- Perplexity Sonar API performs the web search across our trusted-source allowlist (VA.gov, DoD pages, accredited VSO sites, and other authoritative public sources) and returns cited results.
- OpenAI takes those cited results and synthesizes a short answer, in your context, on each request.
This pattern is called retrieval-augmented generation (RAG). You see the source citations alongside the synthesized answer so you can verify any claim against the original public source. The synthesis is regenerated on every request; we do not serve cached AI answers across users.
VETAID's approach reflects the principles in the U.S. Department of Veterans Affairs Trustworthy AI framework: transparency about the system you are interacting with, accountability for outputs, and clear directives to verify high-stakes information against authoritative sources.
EU AI Act notice (Article 50). You are interacting with an AI system. Responses are generated, sourced, and synthesized by AI on each request.
Verifying AI output
AI systems can produce text that is inaccurate, incomplete, out of date, or fabricated. The technical name is "hallucination," and it can happen even when the answer reads with confidence. We design VETAID to make verification easy, but the verification step is yours.
- Treat the cited sources as the ground truth. The synthesized paragraph is a summary; the source is the record.
- For benefits eligibility, claim deadlines, dollar amounts, dates, ratings, and anything else that affects your money, healthcare, or legal standing, confirm against VA.gov, your accredited Veterans Service Organization (VSO), or another authoritative source before you act on it.
- VETAID is not legal, medical, or financial advice. It does not replace your VSO, your healthcare provider, or a licensed professional.
- If you find an answer that looks wrong, use the feedback widget on the answer or email support@joinvetaid.com. We use that signal to improve safety guardrails and source coverage.
Information we collect
- Account information. Email address and a securely hashed password. Optional profile fields you choose to share (branch, status, rank, interests), and an optional profile photo.
- Search queries and chat history. Questions you ask, the answers we generate, the citations we return, and any feedback you give, so your history syncs across your devices and we can improve quality.
- Community and network content. Posts, comments, replies, and boosts you create; your display name and your profile-visibility setting (full name, call sign, connections only, or private); connection requests; and reports you file. Community content is public and is stored in plain text so the community is searchable. It is not encrypted, and it is not covered by the auto-delete window or the "clear my activity" control; see How long we keep your data.
- Direct messages. The contents of one-to-one messages you send other members, plus delivery metadata (sender, recipient, and timestamps). Message contents are encrypted at rest. Message contents and community posts are screened by automated moderation before they are stored or sent.
- Waitlist email. While early access is capped, if you try to create an account after we have reached capacity, we store the email address you enter so we can offer you a spot when one opens. We do not use waitlist addresses for marketing, and we do not currently send automated waitlist email.
- Limited technical data. IP address, request timestamps, and user-agent strings, used for rate limiting, abuse prevention, and debugging.
VETAID does not accept document or file uploads, including DD214s. The one exception is an optional profile photo: if you add one, we resize and re-encode it (removing embedded metadata such as GPS or other EXIF location data) and store it with your account, and you can remove it at any time. The only service details we hold are the branch and rank you optionally enter in your profile. We do not ask for or store Social Security numbers, claim numbers, medical records, or banking information. See the next section for the full list of information you should not paste into search or chat.
Payment information
When you start a paid plan or buy a credit pack, payment is handled by Stripe. Stripe is a PCI DSS Level 1 certified payment processor; we use it so that card data never touches VETAID's servers.
- What you enter into Stripe, not VETAID: card number, CVV / security code, expiration date, and billing address. These are submitted directly to Stripe via Stripe Elements, an iframe hosted by Stripe inside our checkout page.
- What VETAID receives and stores: a Stripe-issued customer id, subscription id, and invoice ids; your active plan tier; the email Stripe has on file for billing receipts; and non-sensitive display data (the last four digits and brand of the card on file, so you can recognize it in the billing portal). We do not store full card numbers, CVVs, or expiration dates.
- How long we keep it: while your account is active and for up to seven years after your last paid transaction to meet tax, accounting, and anti-fraud obligations. Subscription cancellation does not automatically erase historical invoice records. To request earlier deletion of an inactive account and its billing history, email support@joinvetaid.com; we will honor deletions to the extent permitted by tax and recordkeeping law.
- What Stripe does with the data: Stripe processes payments, screens for fraud, and complies with applicable financial regulations. Their handling is governed by Stripe's Privacy Policy. Stripe is listed in the Subprocessors section below with the full data flow.
Operational security (OPSEC)
We know our audience. Service members, transitioning personnel, Guard and Reserve members, recently separated veterans, veterans, Gold Star families, spouses, dependents, and caregivers are routinely trained to treat aggregated digital data as a vulnerability. VETAID is built to respect that posture.
Your queries are transmitted to OpenAI and Perplexity to produce your answer, and the contents of your queries pass through our application logs (see How long we keep your data). To keep that surface area small and to avoid creating an unnecessary record of sensitive information, do not paste any of the following into the search bar, the chat sidebar, or any feedback field:
- Social Security numbers, full dates of birth, driver's license numbers, or passport numbers.
- VA file numbers, claim numbers, military service numbers, or other unique government identifiers.
- Specific deployment dates, locations, unit movements, force composition, or anything else that would meet a unit OPSEC officer's definition of Critical Information.
- Controlled Unclassified Information (CUI), Sensitive But Unclassified (SBU) material, or anything marked FOUO.
- Protected Health Information (PHI), specific diagnoses, medication names and dosages, or other personally identifiable medical details.
- Bank account numbers, routing numbers, credit card numbers, or login credentials of any kind.
- Personal information about other people. Ask about your situation, not someone else's.
VETAID will never ask for any of these. We can answer almost every benefits, transition, education, housing, and family-resources question without them. When a question genuinely requires sensitive context, route it through your accredited VSO or VA.gov, not through this AI.
VETAID does not accept document or file uploads, including DD214s, with the single exception of an optional profile photo. The only service details we store are the branch and rank you optionally type into your profile. Your photo and these details stay in your account and are not parsed into our search or chat indexes.
California privacy categories
For California residents, the table below maps the data we collect to the statutory categories defined in Cal. Civ. Code §1798.140(o).
| Data we collect | CCPA category | Source | Shared with |
|---|---|---|---|
| Email, password (hashed), profile fields | A. Identifiers | Directly from you at signup or in your profile | Stored only on our infrastructure (Railway, PostgreSQL) |
| Service details (branch, rank) you enter in your profile | K. Professional or employment-related information | Directly from you when you fill in your profile | Stored only on our infrastructure (Railway, PostgreSQL). VETAID does not accept document or DD214 file uploads; we store only the branch and rank you enter manually. |
| Optional profile photo | A. Identifiers | Uploaded by you in your profile (optional) | Resized and re-encoded (embedded GPS/EXIF metadata removed), then stored only on our infrastructure (Railway, PostgreSQL); not shared with subprocessors. You can remove it at any time. |
| Search queries, chat messages, feedback | F. Internet or other electronic network activity | Generated by you using VETAID | OpenAI and Perplexity for AI synthesis (per-request only) |
| Community posts, comments, boosts, reports, display name, and profile-visibility setting; direct-message contents (encrypted at rest) and delivery metadata | F. Internet or other electronic network activity | Created by you when you post in the community or message other members | Community posts are public to other users and are stored in plain text on our infrastructure (Railway, PostgreSQL). Direct-message contents are encrypted at rest. Posts and messages are sent to OpenAI for automated moderation before storage (per-request only); not used for AI training. |
| IP address, request timestamps, user-agent | F. Internet or other electronic network activity | Captured automatically by your browser | Server logs only; not shared with subprocessors |
| Billing data for paid plans: Stripe customer id, subscription id, invoice history, plan tier, last four digits and brand of the payment card | B. Commercial information | Generated when you start a paid plan or purchase a credit pack. Full card details are entered directly into Stripe; VETAID never sees them. | Stripe (sub-processor) for payment processing |
How we use your information
- To answer your questions and tailor results to your situation.
- To save your search history and chat sessions to your account.
- To improve answer quality, source coverage, and safety guardrails, using aggregated feedback signals, not individual queries.
- To detect, investigate, and prevent abuse of the service.
- To operate the community and keep it safe: to display your posts and messages, run automated and human moderation, act on reports, and hide or remove content that violates our rules.
- To meet legal and security obligations.
Subprocessors and data flow
VETAID uses a small number of vetted third-party services. Your queries are sent to these providers strictly for the purpose of producing your response. We do not sell or rent your information to anyone.
OpenAI· United States
PurposeLarge-language-model synthesis.
Data flowYour question text plus a trimmed conversation context window. We do not opt into model training; OpenAI does not use API submissions to train models by default.
Perplexity AI· United States
PurposeSourced web search across our trusted-source allowlist (sonar default).
Data flowYour question text plus minimal search-context metadata. Per Perplexity's published Sonar API documentation, the Sonar API operates under a Zero Data Retention policy (prompts and responses are not retained after the request completes); only operational metadata (token count, model id, request timestamp, billing key) is kept. Perplexity API ToS §2.3.3 separately prohibits use of customer content to train any AI model.
Google (Sign in with Google)· United States
PurposeOAuth identity verification when you choose Sign in with Google.
Data flowGoogle-issued ID token is exchanged for your verified email and Google sub claim. No ongoing data sharing.
Railway· United States
PurposeHosting infrastructure for the VETAID web app and backend API.
Data flowAll request and response data passes through Railway's network. Railway does not access application data.
PostgreSQL on Railway· United States
PurposePrimary application database (history, chat, feedback, accounts).
Data flowAll durable application data lives here, on encrypted volumes in production.
Google Cloud KMS· United States
PurposeEncryption-key management for content stored at rest.
Data flowHolds the wrapped key that encrypts your searches, chats, and feedback, and unwraps it for the application at startup. Google Cloud KMS never receives your content, only key material, and is reached through a decrypt-only credential separate from the database.
Stripe· United States
PurposePayment processing for paid plans and credit-pack purchases.
Data flowCard number, CVV, and billing address are submitted directly to Stripe through Stripe Elements; this data never reaches VETAID's servers. VETAID receives only Stripe-issued identifiers (customer id, subscription id, invoice ids) and non-sensitive display data (the last four digits of the card and the card brand). Stripe is PCI DSS Level 1 certified.
AI training, retention, and your data
No model training. VETAID does not use your queries or chats to train any AI model. The contractual and documented posture at our AI subprocessors is:
- Perplexity (Sonar API). Perplexity's API Terms of Service §2.3.3 contractually prohibits the use of customer content (your prompts and the AI's responses) to train, retrain, fine-tune, or otherwise improve any AI model. We do not opt in to any training program.
- OpenAI. OpenAI does not train models on data submitted via the API under its default terms. We do not opt in.
Moderation is not training. Community posts and direct messages are sent to OpenAI's moderation endpoint to screen for prohibited content before they are stored or delivered. This is a safety check on a per-request basis. It is not used to train any model, and we do not opt in to training.
Zero Data Retention (ZDR) at Perplexity. Perplexity's published Sonar API privacy and security documentation states that the API operates under a strict Zero Data Retention policy: prompts and responses are not retained after a request completes. Perplexity keeps only non-substantive operational metadata (token count, model identifier, request timestamp, API key for billing) and explicitly excludes prompt and response content from this metadata.
OpenAI retention. OpenAI's API does not retain inputs or outputs for training under its default terms. OpenAI may retain limited records temporarily for abuse monitoring per its published API data-usage policy.
What VETAID itself stores. Your search history and chat messages are stored in our application database so your history is available across devices when you sign in. You can delete any item, clear all your activity, set an auto-delete window, or delete your account entirely. See How long we keep your data for the full retention table.
We will update this section if we ever change provider, plan, or training posture, and the change will be recorded in the changelog at the bottom of this page.
How long we keep your data
- Account and profile: until you delete your account.
- Search history and chats: until you delete or archive them, or until you delete your account.
- Auto-delete (optional): from your profile you can set searches and chats to delete automatically after 3, 18, or 36 months. By default we keep them until you delete them.
- Community posts and comments: public and stored in plain text so the community stays searchable. They are not covered by auto-delete or "clear my activity." You can delete your own content at any time: an item with no replies is removed entirely, and an item that already has replies is replaced with a "[deleted]" placeholder so the surrounding conversation stays readable. Deleting your account follows the same rule.
- Direct messages: encrypted at rest and exempt from auto-delete and "clear my activity." If you delete your account, your messages remain readable to the other member as a read-only thread with a "[deleted]" sender; a thread is fully purged only once both members have deleted their accounts.
- Anonymous activity: searches and chats created before you sign in are removed after 30 days.
- Waitlist email: kept until we admit you from the waitlist or you ask us to remove it, whichever comes first.
- Server logs (operational): retained for up to 30 days for security, abuse prevention, and debugging, then rotated. To support those operational needs, the text of your search query or chat message can appear in our application logs alongside request-level metadata. Logs are not shared with subprocessors and are not used for AI training. This is one more reason the OPSEC guidance above matters: assume anything you type into an internet-connected service can end up in an operational log somewhere.
- Feedback (thumbs up / thumbs down): retained indefinitely in aggregated form for quality improvement, tied to your account if you were signed in.
Your rights
From your profile you can review or edit your profile, delete individual conversations, clear all of your activity at once, set an auto-delete window, or delete your account and the data tied to it. To request a copy of your data or account-level deletion by email, contact support@joinvetaid.com; we aim to respond within 30 days.
California residents (CCPA). You have the right to know what personal information we hold about you, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising these rights. Use the email above to make a request and we will respond within the timelines required by law.
California Shine the Light (Cal. Civ. Code §1798.83). We do not share your personal information with third parties for those parties' own direct-marketing purposes. California residents may request written confirmation of this once per calendar year by emailing support@joinvetaid.com.
Family members and caregivers. If you use VETAID on behalf of a service member or veteran (as a spouse, dependent, caregiver, or other representative), you confirm that you are authorized by them to access and manage their account information and to receive communications about it.
Children
VETAID is not directed at children under 13. If you believe a child has created an account, contact us at support@joinvetaid.com and we will remove the account. Service members in the Delayed Entry Program who are 17 may use VETAID with the understanding that some content addresses adult-oriented benefits topics.
Security
We follow standard industry practices: passwords are bcrypt-hashed; auth tokens are signed and stored in httpOnly cookies; and database connections in production run over SSL. Your searches, chats, and feedback are encrypted at rest at the application layer (AES-256), and the encryption key is managed in Google Cloud KMS rather than stored alongside the database. No system is perfectly secure. If you believe you have found a vulnerability, email support@joinvetaid.com and please do not exploit it further.
Breach notification
In the event of a security incident affecting your personal information, we will notify affected users without undue delay, consistent with applicable state and federal breach-notification laws (including California Civil Code §1798.82). Notification will describe the nature of the incident, the information involved, the steps we are taking, and what you can do to protect yourself.
Accessibility
VETAID targets WCAG 2.1 Level AA conformance. We test with VoiceOver, NVDA, and keyboard-only navigation. If you encounter an accessibility barrier or would like an alternative format of any content, email support@joinvetaid.com and we will work with you to provide it.
A note on crisis support
VETAID is not a substitute for emergency services, mental-health care, or clinical advice. If you are in crisis, call or text 988 (press 1) for the Veterans Crisis Line, dial 911, or go to the nearest emergency room.
Recruiter and impersonation scams
VETAID will never ask you to pay a fee to access benefits, send a paid job offer through DM, or impersonate VA staff or military leadership. If someone claims to be from VETAID and asks for money, login credentials, or your DD214, it is not us. Report it to support@joinvetaid.com.
Changes to this policy
We may update this policy as VETAID evolves. Material changes will be announced on this page and, when appropriate, communicated to you by email. Continuing to use VETAID after a change constitutes acceptance of the updated policy. See the changelog at the bottom of this page for prior versions.
Contact
Questions about this policy or your data? Email support@joinvetaid.com.
VETAID LLCAttn: Legal
8 The Green, Ste A
Dover, DE 19901
United States
What changed
- May 8, 2026
- Initial public version.
- May 9, 2026
- Cookie inventory corrected: auth cookie listed as vetaid_token with 7-day retention to match implementation.
- May 26, 2026
- Added a Payment information section disclosing Stripe as our payment processor, what billing data we store, and how long we retain it. Added Stripe to the subprocessor list and added a CCPA category B row for commercial information.
- May 28, 2026
- Removed references to DD214 file uploads and Amazon S3 document storage from the data-collection, retention, security, and California-categories sections; that feature was removed before launch and VETAID stores only the branch and rank you enter manually. Added disclosure of waitlist email collection while early access is capped.
- May 28, 2026
- Documented that searches, chats, and feedback are encrypted at rest with the key managed in Google Cloud KMS (added to the subprocessor list). Described the new self-serve controls: delete a conversation, clear all activity, set an auto-delete window (3, 18, or 36 months), or delete your account. Updated the data-request language so copies of your data are provided on request.
- May 29, 2026
- Disclosed the optional profile photo: the only file you can upload. We resize and re-encode it, removing embedded GPS/EXIF metadata, store it with your account, and let you remove it at any time. Added it to the data-collection and California-categories sections. The prohibition on document and DD214 uploads is unchanged.
- June 17, 2026
- Documented the community and networking features: posts, comments, boosts, reports, display name, and profile-visibility settings, plus one-to-one direct messages. Disclosed that community content is public and stored in plain text so it is searchable (and therefore is not covered by the auto-delete window or 'clear my activity'), while direct-message contents are encrypted at rest. Explained that community posts and messages pass OpenAI automated moderation before storage and that moderation is not model training. Described how deletion and account closure treat community content (childless items removed, items with replies replaced with a [deleted] placeholder) and direct messages (read-only to the other member after one party deletes, fully purged only when both members delete). Added a California-categories row (category F) for community and direct-message data and a community-safety entry to how we use your information.