Privacy Policy

Last updated: April 17, 2026

1. Who we are

VA Claim Path is a veteran-focused tool operated by Craftloop, a veteran-owned software company based in the United States. This Privacy Policy explains what information we collect when you use VA Claim Path (the "Service"), how we use it, and the choices you have.

2. Information we collect

Information you provide

• Account information. Your name, email address, and authentication identifier from Firebase Authentication.
• Service profile. Branch of service, service dates, deployments, exposure history, military occupational specialty, and similar information you enter to help us identify presumptive conditions.
• Evidence you upload. Medical records, service records, DD‑214s, buddy statements, nexus letters, personal statements, lab results, imaging reports, pharmacy records, and other documents you submit so the Service can analyze them.
• Chat input. Messages you send to the claim assistant.
• Payment information. Billing is handled by Stripe. We do not store your card number; we store only a Stripe customer identifier and the fact that you paid.

Information generated for you

• AI‑extracted "atoms" (discrete facts) pulled from your uploaded documents.
• Identified conditions, VASRD code assignments, triad assessments, rating estimates, gap analyses, and what‑if scenarios.
• AI call logs: timestamps, models used, input/output token counts, and cost, so you can see what the Service did on your behalf.

Information collected automatically

• Basic technical information such as IP address, browser type, and timestamps, for security and troubleshooting.
• Cookies strictly necessary for authentication and session management. We do not use advertising cookies.

3. How we use your information

• To provide and operate the Service — extracting evidence, identifying conditions, producing rating estimates, answering your questions.
• To charge and renew your subscription through Stripe.
• To secure the Service and prevent abuse.
• To communicate with you about your account or the Service.
• To improve the Service in aggregate. We do not use your uploaded documents or evidence to train third‑party AI models.
• To comply with legal obligations.

4. Who we share information with

We do not sell your information. We share only what is necessary with the following categories of service providers:

• Hosting and infrastructure. Google Cloud Platform (Cloud Run, Cloud SQL, Cloud Storage).
• Authentication. Firebase Authentication.
• AI processing. Anthropic (Claude) and Google Cloud Vertex AI (Gemini) to analyze your documents and conversations. These providers process content under their own commercial terms and do not train their public models on your data.
• Payments. Stripe.
• Email delivery. Transactional email providers if you elect to receive emails.

We may also disclose information when legally required, to protect our rights, to prevent fraud, or in connection with a corporate transaction such as a merger or acquisition, in which case this Policy will continue to govern your information.

5. Data security

We use encryption in transit (HTTPS) and at rest for data stored in Google Cloud services. We restrict internal access to the minimum needed to operate the Service. No system is perfectly secure, and we cannot guarantee absolute security.

6. How long we keep your information

• While your subscription is active: we retain your account, uploaded documents, and analysis output so you can use the Service.
• After your one‑year access expires: we retain your account and your most recent analysis so you can continue to view your uploaded documents and past results. New analysis is paused until you renew.
• On request: you can ask us to delete your account and associated data at any time. We will honor the request within a reasonable period, except where we are required to retain specific records for legal or billing purposes.

7. Your choices and rights

• Access and correction. You can view and update most of your information within the Service.
• Export. You can request a copy of your data.
• Deletion. You can delete your account and associated data.
• Marketing emails. You can opt out at any time. Service and billing emails are not optional while your account is active.

Email [email protected] to exercise any of these rights. We may ask you to verify your identity before acting on a request.

8. Children

The Service is not directed to children under 18 and we do not knowingly collect information from them. If you believe a child has provided us information, email us and we will delete it.

9. Users outside the United States

The Service is designed for United States veterans and is hosted in the United States. If you access the Service from another country, you consent to the transfer and processing of your information in the United States.

10. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or by a notice on the Service. The "Last updated" date at the top reflects the most recent revision.

11. Contact us

Questions or requests: [email protected].