Privacy Policy

1. Introduction

Venril is owned and operated by Alpha Inception Ventures LLC (“we”, “our”, “us”). This Privacy Policy explains what data we collect, how we use it, and the choices you have regarding your information. This notice does not replace consent where consent is required.

Cookies, browser storage and your choices

Optional usage analytics (Vercel Web Analytics and product events) and performance monitoring (Vercel Speed Insights on static public pages and Sentry browser errors) stay off until you opt in to each purpose. Speed Insights may include page element selectors; we exclude private app pages from those measurements. We do not use session replay. Ignoring or closing the notice does not give consent. Rejecting optional services does not limit your access.

Privacy choices are also available in the website footer and Settings → Account → Browser privacy. Withdrawing consent stops new optional events immediately and refreshes Venril tabs where an optional service was running. Save any unsaved work before changing those choices.

• Your privacy receipt: the first-party HttpOnly cookie venril_privacy_receipt contains your separate choices, notice version, and issue/expiry times, signed by our server. Both acceptance and rejection last 180 days. This is our renewal period, not a statutory deadline. There is no account, workspace, IP address or device identifier in the receipt. You can download the current receipt in Privacy choices; we do not store a cross-device consent history.
• Withdrawal safeguard: venril_privacy_block disables optional collection during a change or failed save, for up to 180 days. A first-party local-storage signal tells other open tabs to recheck their choices. Clearing storage, expiry, or a changed notice version asks you again; collection stays off while the choice is unknown.
• Login and security: Supabase authentication storage maintains your requested login until it expires, is replaced, or you sign out. GitHub and Slack connection security cookies last ten minutes. Idle-session activity storage supports account security.
• Requested preferences and workflows: theme, workspace, filters and view preferences use first-party local storage without a fixed time expiry. Guided setup and one-time navigation use session storage until the tab closes. Some requested Vai conversations and report results are cached locally and may contain your workspace content. These stores are not reused for analytics.
• Optional providers: Vercel describes its analytics visitor hash as lasting up to 24 hours; aggregate analytics, performance and diagnostic retention depend on provider settings. We remove query strings, fragments, unknown path segments and workspace content from application telemetry. Provider processing still includes technical network and browser data. See Vercel analytics privacy and Speed Insights privacy.

2. Information We Collect

Information you provide directly:

• Account information: email address, display name, and password (stored hashed) when you register.
• Profile information: optional display name and avatar image.
• Workspace content: workspaces, initiatives, projects, tasks, comments, Docs, Canvas scenes, Mind maps, attachments, and other content you create within the Service.
• Feedback: bug reports and suggestions you submit through in-app feedback tools.
• Payment information: processed directly by Stripe; we receive only a customer reference ID and subscription status — never card numbers.
• Communications: messages sent through our contact form.
• Connected assistant information: the assistant client name, the workspaces you approve, connection and last-used times, and MCP tool activity, results, and errors when you connect an external AI assistant.

Information collected automatically:

• Usage data: pages visited, features used, and actions taken within the Service.
• Technical data: IP address, browser type, device information, and timestamps.
• Cookies and browser storage: used to maintain your login, secure requested integration connections, remember preferences such as your theme and selected workspace, and continue requested workflows. Local caches may contain workspace content, including recent Vai conversations and generated reports.
• Error and diagnostic data: when the Service encounters an error, technical details about the error (which may include your IP address and browser information) are collected through our error-monitoring provider to help us fix problems.

3. How We Use Your Information

• To provide, maintain, and improve the Service.
• To authenticate your identity and manage your account.
• To process billing and subscription management via Stripe.
• To send transactional emails (account confirmation, password reset, workspace invitations, and notifications such as task assignments — notification emails can be controlled in your settings).
• To respond to your support requests and contact form submissions.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

We do not sell your personal data to third parties.

4. Third-Party Services

We use the following third-party providers to operate the Service:

• Supabase — database, authentication, and file storage.
• Vercel — hosting and deployment, Web Analytics for website usage statistics, and Speed Insights for page performance measurements. These browser services can collect URLs, referrers, browser/device information, and performance metrics. Vercel describes these statistics as anonymous; privacy obligations depend on the data and configuration used.
• Stripe — payment processing. Governed by Stripe’s Privacy Policy.
• Resend — transactional email delivery.
• GitHub — optional GitHub App integration. Only connected at your explicit request; Venril stores the installation identifier and uses short-lived installation credentials generated by GitHub when needed. Governed by GitHub’s Privacy Statement.
• Slack — optional integration. Only connected at your explicit request; access tokens are stored encrypted. Governed by Slack’s Privacy Policy.
• hCaptcha (Intuition Machines) — bot protection on authentication and recovery forms. It analyzes signals such as IP address, browser information, and interactions to distinguish human activity from abuse. See hCaptcha’s Privacy Policy.
• Sentry — error monitoring and diagnostics.
• OpenAI and Anthropic — when you use AI-powered features (such as sprint planning suggestions, task auto-fill, or report digests), relevant content you entered (such as task titles and descriptions) is sent to the configured provider to produce the requested result. Venril does not use your content to train models. Provider processing is governed by OpenAI’s Privacy Policy or Anthropic’s Privacy Policy.

5. Connected AI Assistants and MCP

You may connect an external AI assistant, such as ChatGPT, Codex, or Claude, to Venril through the Model Context Protocol (MCP). The connection uses OAuth and can access only the workspaces you approve. Venril checks that you are still a member of an approved workspace on every request, and you can change workspace access or revoke the connection from Venril settings.

At your direction, the assistant may read or change Venril workspace data using the tools you invoke. Depending on the request, responses can include task and project content, status and delivery information, member display names, member email addresses used for assignment, and stable record identifiers needed for follow-up actions. Venril does not include authentication secrets in MCP tool responses.

Data returned to a connected assistant is also processed by that assistant provider under its own terms and privacy policy. Review the provider's data controls before connecting it. Venril records connection and tool activity for security, troubleshooting, and user-visible connection history.

6. Shared Report Links

Workspace members may create shareable, read-only report links. Anyone with such a link can view aggregated workspace analytics (counts, charts, and member display names) for the shared report — task titles, descriptions, and email addresses are never included. Links expire automatically and can be revoked by any workspace member at any time.

7. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide the Service. Items moved to Trash, including Docs, Canvases, and Mind maps, are generally retained for 30 days so they can be restored, then permanently removed. Archived items remain stored because archiving is an organization feature rather than a deletion request. You may delete your account at any time from your account settings, or by contacting us; deletion removes your profile and personal data from the Service. Certain records may be retained longer where required by law or for legitimate business purposes, including billing records. Content you contributed to shared workspaces may remain available to the other members of those workspaces.

Content and account data flagged for legal compliance may be retained longer than normal when necessary to satisfy reporting or preservation obligations, as described in Section 4 of our Terms of Service.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Correction: request correction of inaccurate data.
• Deletion: delete your account and personal data directly from account settings, or by request.
• Portability: request an export of your project data.
• Objection: object to certain uses of your data.
• Restriction and consent withdrawal: request a restriction of processing where applicable, or withdraw consent for processing based on consent. Withdrawal does not affect the lawfulness of processing before it was withdrawn.

To exercise any of these rights, contact us through our contact page. We may need to verify your identity and will respond within the time required by applicable law. You may also complain to the data protection authority in your jurisdiction.

9. Security

We implement industry-standard security measures including encrypted data transmission (TLS), hashed passwords, encrypted OAuth tokens, and row-level security policies on our database. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Children’s Privacy

The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice within the Service. The “last updated” date at the top of this page reflects the most recent revision.

12. Contact

If you have questions or concerns about this Privacy Policy, please contact us through our contact page.