Contact Information

Scope

This Policy covers personal data we process when you visit our site, create an account, upload project documents, receive reports, or contact support. The Service is for business users and not for children.

1. Data we process

• Account and contact data: name, business email, company, role, authentication identifiers (via Clerk), billing contacts.
• Project content (Customer Data): documents you upload and the outputs we generate.
• Service Data (technical/usage): device/browser info, IP address, timestamps, feature usage, performance metrics, error logs, and de-identified statistics.
• Payments: processed by Stripe; we do not store full payment card details.
• Support communications: messages and attachments you send us.

We do not seek to collect special category data.

2. Purposes and legal bases

• Provide the Service, operate accounts, process uploads, generate outputs. Legal basis: performance of a contract.
• Security, fraud prevention, service reliability, product quality improvements that do not train or fine-tune LLMs. Legal basis: legitimate interests.
• Billing, tax, recordkeeping. Legal basis: legal obligations.
• Communications about the Service (operational). Legal basis: legitimate interests/contract.
• Marketing communications (optional). Legal basis: consent. You can withdraw consent at any time.

3. AI and model usage

• We do not train or fine-tune any large language model on Customer Data.
• Third‑party AI providers we use are configured or contractually bound not to use Customer Data for training.
• We may conduct limited human review of specific runs to improve rules and quality and may use de-identified and aggregated Service Data for reliability and security.
• We do not create models that memorize or reproduce your confidential content for other users.

4. Sharing and subprocessors

We share personal data with service providers that process it for us ("subprocessors") under data protection agreements and with appropriate transfer safeguards. Current categories include:

• Cloud hosting (AWS eu‑north‑1)
• Application hosting (Vercel)
• Edge/security (Cloudflare)
• Payments (Stripe)
• Authentication (Clerk)
• Email (Google Workspace)
• AI inference APIs (OpenAI, Google Gemini, Perplexity)

A current list is maintained in our Terms/DPA Annex C. We also share data where required by law or in connection with a reorganization or sale of our business.

5. International transfers

We use Standard Contractual Clauses (SCCs) and the UK Addendum, as applicable, for transfers to countries without an adequacy decision. Details are available on request.

6. Retention

• Customer Data: retained while your account is active. After termination, we maintain an encrypted archive for up to 10 years for security, audit trails, product quality improvement that does not train or fine‑tune LLMs, and to establish, exercise, or defend legal claims. You may request earlier deletion at any time; we will comply within a reasonable period, subject to backups aging out on a normal cycle.
• Service Data and logs: retained for operational needs and then aggregated or de‑identified.
• Marketing data: retained until you unsubscribe or withdraw consent.

7. Your rights

You may request access, correction, deletion, restriction, portability, and object to processing (including processing based on legitimate interests). You may withdraw marketing consent at any time. To exercise rights, contact privacy@genvision.com.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, encryption at rest for primary storage, access controls, logging, and incident response. More details are in our Security Measures (Terms/DPA Annex B).

9. Children

The Service is for business users and not directed to children.

10. Changes

We may update this Policy. For material changes, we will provide reasonable advance notice in-product or by email.

Categories

• Strictly necessary cookies (essential): required for security, authentication, and basic functionality (for example, Clerk auth, Cloudflare security, Vercel routing). These run without consent.
• Optional analytics/performance cookies: used only if enabled by us and only after you give consent. Currently, we do not use non‑essential cookies.

Your choices

If we introduce optional cookies, we will show a consent banner that blocks non‑essential cookies until you choose Accept or manage preferences. You can change your choices anytime in Cookie Settings.

Cookie banner text (minimal)

Managing cookies

You can also control cookies via your browser settings. Note some features may not work without essential cookies.

Contact

Questions about cookies: privacy@genvision.com.