Privacy Policy

2. Scope of This Policy

This Policy applies to the Ventale marketing website, the Ventale service and workspaces where this Policy is presented, support or feedback interactions, and service communications. It describes processing by Ventale and does not replace a customer's own privacy notice for information that the customer collects from other people.

Other terms may apply to your use of the service, including our Terms of Service. Our Security page describes security principles at a high level.

3. Our Role in Processing Personal Information

Ventale can have different privacy roles depending on the information and the activity involved. Those roles may be described differently under different laws.

Information Ventale handles for its own purposes

For information used for account administration, authentication, subscriptions or licensing where offered, security, support, feedback, service communications, and service operations, Ventale may act as a data controller or equivalent role.

Customer CRM information

For personal information that a Ventale customer enters into a workspace about its leads, clients, contacts, or other individuals, the customer generally decides why and how that information is processed. In that context, Ventale may act as a data processor, service provider, or equivalent role on the customer's behalf, subject to the customer's instructions and applicable agreements.

4. Information We Collect and Process

The information involved depends on how you interact with Ventale and which service functionality is enabled. It may include:

Account information

• Name, email address, organization or business, and account identifier.
• Role, permissions, workspace membership, and authentication-related information.
• Account preferences and service communications.

Customer and CRM data

If a customer uses Ventale to manage sales work, the workspace may contain lead and client information, contact details, deals or opportunities, sales-pipeline activity, tasks, follow-ups, notes, documents, products and services, sales records, payment status, balances, business activity, and reports. Customers decide what information to enter and are responsible for using the service lawfully.

Technical information

The service or its hosting layer may generate technical information such as IP address, browser and device characteristics, operating system, timestamps, authentication events, security logs, usage information, and error or diagnostic information.

Support and feedback

When you use an enabled support or feedback channel, we may receive your name, email address, organization, message, feedback, page or route context, and relevant diagnostic information. The marketing-site contact form sends submissions to support@ventale.app through the configured email delivery provider. The marketing site does not store submissions in its own database, although the email provider may process and retain the message as needed to deliver and secure it.

5. How We Use Information

Depending on the context and applicable law, we may process information to:

• Provide, maintain, and improve Ventale and its requested functionality.
• Authenticate users, manage accounts, and provide authorized workspace access.
• Process customer instructions and provide CRM functionality.
• Maintain security, prevent unauthorized access, investigate errors, and protect the service.
• Provide support, respond to feedback, and send service communications.
• Manage subscriptions or licenses where applicable.
• Comply with applicable law, enforce agreements, and protect the rights and safety of Ventale, customers, and users.

6. Legal Bases for Processing

Where a law requires a legal basis, the basis depends on the specific activity. Possible bases include:

• Performance of a contract or steps requested before entering into one.
• Legitimate interests, such as operating, securing, and supporting the service, where those interests are not overridden by applicable rights.
• Consent, including for non-essential analytics or promotional communications where consent is required.
• Compliance with a legal obligation.
• Establishing, exercising, or defending legal rights and protecting security.
• Another lawful basis recognized by the law that applies to the processing.

No single legal basis applies to every activity. For customer CRM data, the customer generally determines the appropriate lawful basis and provides the relevant instructions.

7. Customer CRM Data

Your data is yours. You retain ownership of the business data and personal information you submit to Ventale. We do not access or review your data except when necessary to provide, secure, or support the service, or when you authorize us to do so.

When access or processing is necessary to provide, maintain, secure, support, or operate the service, Ventale may host, store, back up, and otherwise process that data as needed to provide functionality, in accordance with your instructions and applicable agreements.

Ventale customers are responsible for the personal information they enter into a workspace. Customers should:

• Have the authority and lawful basis required to collect and use the information.
• Provide any privacy notices and obtain consent when required.
• Use the information lawfully, fairly, and only for appropriate purposes.
• Respond to their own data subjects and honor applicable rights requests.
• Configure appropriate workspace users, roles, and access permissions.
• Give Ventale lawful, documented instructions when Ventale processes the information on the customer's behalf.

Ventale does not give a customer permission to collect information that the customer otherwise has no lawful right to process.

8. How We Share Information

Ventale does not sell your business data to advertisers. We do not sell personal information. We may disclose or make information available only as reasonably necessary to operate the service, follow a customer's instructions, or meet a lawful requirement, including to:

• Service providers that host, secure, support, communicate about, or otherwise help operate Ventale.
• A customer or workspace administrator as directed by the customer.
• Authorities, advisers, or other parties where disclosure is required by law or needed to protect rights, safety, or security.
• A successor or transaction participant in a merger, acquisition, restructuring, financing, or sale of assets, subject to applicable safeguards.

9. Service Providers / Subprocessors

Ventale may use providers for hosting, cloud infrastructure, authentication, storage, email or communications, analytics, security, and support. Providers should receive only the access needed for their function and should be required to protect information and process it according to applicable instructions and agreements.

A verified production subprocessor list, payment provider, and customer-application infrastructure description are not yet available for this publication. The contact form uses Resend when the deployment is configured with the required API key and verified sender. Named providers, locations, and any customer data processing addendum should be confirmed and added before commercial launch.

10. International Data Transfers

Because Ventale may use cloud infrastructure and serve customers internationally, information may be processed in countries other than the country where you live or where your organization is established. We do not claim that all information is stored in the Philippines, the United States, or any other single country.

Where a transfer is restricted by applicable law, Ventale will use an appropriate transfer mechanism or safeguard for the circumstances, such as an adequacy decision, contractual safeguards, or another lawful mechanism. The specific mechanism and any required supplementary measures should be confirmed for the production service and relevant customer agreements.

11. Data Security

Ventale applies, or intends to apply as the service develops, reasonable and appropriate technical and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. Depending on the service component, safeguards may include authentication, access restrictions, workspace or tenant separation, role controls, secure transmission, and security logging.

No internet service can guarantee absolute security. Please use appropriate account security practices and notify Ventale or your organization promptly if you believe an account or workspace has been accessed improperly. We will handle legally reportable incidents in accordance with applicable law and our contractual obligations.

12. Data Retention

We retain information only for as long as reasonably necessary to provide the service, maintain accounts, support security, resolve disputes, meet legal or contractual obligations, and establish or defend legal claims. Retention may also be affected by legitimate operational and backup requirements.

Customer CRM data may be retained according to account status, customer instructions, subscription or contractual terms, legal requirements, and operational or backup needs. Ventale has not yet published a fixed retention schedule for each category of information; that schedule and account-closure deletion process should be finalized before commercial launch.

13. Your Privacy Rights

Depending on your jurisdiction, you may have rights concerning your personal information, including the right to be informed, access, correction or rectification, deletion or erasure, restriction, objection, withdrawal of consent, portability, and the right to lodge a complaint with an appropriate supervisory authority. Rights vary by jurisdiction, role, legal basis, and applicable exceptions, and may require identity verification.

European Economic Area and GDPR

Where the GDPR applies, we will describe and handle processing using an applicable legal basis, provide the rights available under the GDPR subject to lawful limits, and address international transfers using an appropriate mechanism where required. You may complain to the data protection supervisory authority in the country where you live, work, or believe an infringement occurred.

United Kingdom and UK GDPR

Where the UK GDPR applies, similar rights and transfer protections may apply, subject to UK law and its exceptions. You may complain to the UK Information Commissioner's Office or another appropriate supervisory authority where applicable.

Philippines

If you are located in the Philippines, your personal information may be protected under Republic Act No. 10173, the Data Privacy Act of 2012, its implementing rules and regulations, and applicable issuances of the National Privacy Commission. Subject to applicable rules, a data subject may lodge a complaint with the National Privacy Commission. More information is available from the National Privacy Commission's data-subject rights guidance.

Other jurisdictions

People in other countries, states, or territories may have additional rights under the laws that apply to them. We do not claim that every privacy law applies to every Ventale user or that Ventale has completed an assessment for every jurisdiction.

14. Requests Concerning Customer Data

If your information appears in a Ventale workspace because a business or organization entered it, contact that business or organization first. It generally controls the purpose and legal basis for that information and is responsible for responding to its data subjects.

Ventale will provide reasonable assistance to a customer with a valid request where required by the customer's agreement and applicable law. We may verify the request, refer it to the relevant customer, limit a response where legally permitted, and retain a record of the request as needed for security and compliance.

15. Cookies and Similar Technologies

Necessary authentication, session, and security technologies may be used by a customer application where required to provide account access. These technologies are not advertising cookies.

The marketing site can load Google Analytics 4 and Microsoft Clarity only when their corresponding public environment identifiers are configured. When enabled, those tools may use cookies or similar identifiers and may receive page, route, and interaction information. No advertising-cookie implementation is currently present. If non-essential analytics are enabled where consent is required, Ventale should obtain consent before loading them.

The marketing site does not currently implement localStorage or sessionStorage preferences. The customer application may use browser storage or session technologies; those details should be confirmed and documented in the applicable service notice before launch.

16. Marketing Communications

We may send service communications that are necessary to operate an account or provide Ventale. Promotional communications will be sent only where permitted and with consent or another lawful basis where required. You can opt out of promotional messages using the available unsubscribe method or by contacting the verified privacy or support contact once published. Opting out of marketing does not stop necessary service messages.

The current marketing site does not implement a mailing list. Contact form delivery uses the configured email provider described above.

17. Children's Privacy

Ventale is business software and is not intended for children. We do not knowingly design the service to collect personal information from children. We do not state a universal minimum age because age rules can differ by jurisdiction. If you believe a child has provided personal information to Ventale, contact the verified privacy contact when available.

18. Automated Decision-Making

Ventale does not currently describe automated decision-making or profiling that produces legal or similarly significant effects. If Ventale introduces such processing, this Policy will be updated with the information and rights required by applicable law before that processing is used.

19. Business Transfers

If Ventale is involved in a merger, acquisition, restructuring, financing, insolvency process, or sale of assets, personal information may be transferred as part of that transaction. Any transfer will remain subject to applicable law, appropriate privacy safeguards, and any notice obligations.

20. Changes to This Policy

Ventale may update this Policy as the service evolves, our processing practices change, or privacy laws develop. The Last Updated date above shows when the current version was posted. We will provide additional notice for material changes where required and will not reduce applicable rights without an appropriate legal basis.

21. Contact Us

For privacy questions or requests, use the verified contact details below once they are confirmed:

Service

Ventale — ventale.app

Privacy contact

[Privacy email to be confirmed before publication]

Legal operator

[Legal operator name and address to be confirmed before publication]

Operator establishment

[Country to be confirmed before publication]

General website questions can be sent through the Contact page and are delivered to support@ventale.app. Do not use this form for a privacy request; use the privacy contact details above once they are confirmed.