LEGAL
Privacy Policy
How VENRAC handles account, scan, business, measurement and operational data.
1. Scope
This policy applies to the VENRAC service operated by EgnaFlex Inc. It does not apply to third-party websites that VENRAC scans or links to.
2. Roles
For account and billing data VENRAC acts as controller. For business content a customer uploads or connects, VENRAC acts as processor on that customer's instructions.
3. Account and workspace data
Email address, authentication material, workspace membership, role and organization settings.
4. Public website scan data
Publicly reachable pages of a scanned domain, the derived readiness findings, and the URLs that serve as evidence.
5. Domain verification data
Challenge tokens, DNS or HTTP responses observed during verification, and the resulting verification state.
6. Customer-provided business content
Company profile, offerings, locations, prompts, competitor lists and any content submitted through the application or a connector.
7. Connector and integration data
Connector configuration, declared scopes, mapping definitions, call metadata and delivery receipts.
8. Credentials and secrets
Credentials supplied for a connector are stored in the credential vault and referenced by handle. They are not displayed back in the interface and are not written to logs.
9. AI visibility measurement data
Prompts, locale, provider and surface identifiers, captured answers, cited sources and the resulting metrics.
10. Logs, telemetry and security data
Request identifiers, timestamps, coarse client information and security events used to operate and defend the service.
11. Billing metadata
Plan, billing state and references produced by an external payment provider. VENRAC does not store full card numbers.
12. Support communications
Messages you send to support, sales, security or privacy contacts.
13. Cookies and analytics
Essential cookies keep a session and a theme choice. Non-essential analytics run only where consent applies; see the cookie policy.
14. Purposes
Operating the service, producing measurements with evidence, enforcing entitlements and quotas, billing, security and abuse prevention, and support.
15. Legal bases
Where applicable law requires a legal basis, VENRAC relies on contract performance, legitimate interest in operating and securing the service, consent for non-essential cookies, and legal obligation where one exists.
16. Sharing
Data is shared with service providers that operate parts of the infrastructure, and with AI providers where a measurement requires it. Disclosed processors are listed on the subprocessors page.
17. AI providers
Measurement runs send prompts to AI providers. What is sent, and what is deliberately not sent, is described on the AI data use page.
18. International transfers
Region and data residency are account properties. Transfer mechanisms are documented on the subprocessors page once each processor is disclosed.
19. Retention
Retention by category is published on the data retention page. VENRAC does not state a retention period it cannot operationally honour.
20. Security
Controls in force are published on the security practices page with their status.
21. Your controls
Account settings expose theme, notification, publication-consent and closure controls. Publication of business facts always requires explicit consent.
22. Your rights
Access, correction, export, deletion, restriction where applicable, and withdrawal of consent. See the data rights page for how identity is verified.
23. Account deletion
Closure can be requested from settings. Some records are retained where law or legitimate operational need requires; those are named on the data retention page.
24. Children
VENRAC is a business service and is not directed at children.
25. Changes
Material changes are published here with a new version and effective date, and announced in-product where they affect customer data.
26. Contact
privacy@venrac.com reaches the privacy contact for EgnaFlex Inc.