Privacy Policy

This Privacy Policy explains how [Company Legal Name: VENUS Digital Systems Inc.] ("VENUS", "we", "us", or "our") collects, uses, stores, and safeguards personal and operational information across our website, interactive tools, discovery booking workflows, client workspaces, and custom software engagements (collectively, the "Services").

We believe that client trust is earned through complete technical transparency. We never sell, rent, or trade your personal information or your end-users' records to third-party advertising brokers. Our business model is software engineering, system architecture, and technology services — not data monetization.

We only collect information that is strictly necessary to scope, engineer, deploy, and maintain custom web, AI, and business software systems.

Depending on how you interact with VENUS, information falls into two main categories: information you provide voluntarily (such as project briefs and contact details) and technical data gathered automatically to keep the application secure and performant.

You may provide personal and business details when filling out our contact form, requesting an estimate, booking an architecture discovery call, or creating an authorized client portal profile.

This includes: full name, business email address, phone number or WhatsApp handle, company name, industry, current tool stack, project requirements, target launch timelines, and budget expectations.

When you navigate the VENUS platform, our servers and edge delivery network automatically generate operational event logs.

These logs include: IP address, browser type and version, language settings, referring URL, operating system, timestamp of access, pages viewed, and error trace identifiers when an unhandled application exception occurs.

We use the collected information strictly for legitimate commercial and engineering purposes:

1. To evaluate project inquiries, prepare system architecture blueprints, and issue fixed-price proposals. 2. To manage authenticated workspaces, milestones, and task boards inside the client portal. 3. To provision, maintain, and safeguard client instances, databases, and API integrations. 4. To issue invoices, verify payments via Stripe, and reconcile ledger records. 5. To detect and remediate security vulnerabilities, unauthorized access attempts, and operational bottlenecks.

Information submitted through the project estimator, discovery wizard, or contact forms is routed directly to our engineering coordinators.

We retain lead information for as long as necessary to conduct project discussions or fulfill contractual follow-ups. If no commercial contract ensues, lead records are systematically archived and pruned according to our retention cycle.

When you schedule a discovery call via '/book', we collect your chosen appointment slot, timezone, meeting agenda, and direct contact details.

This information is synchronized with our internal calendar systems to prevent double-booking and send automated calendar invites and reminder links.

Access to the VENUS Client Portal ('/portal') is invite-only. To authenticate, clients maintain an account backed by Supabase Auth with an email address and salted/hashed password.

Profiles contain the client's name, company affiliation, assigned workspace identifiers, and role permissions (such as client or studio admin).

During active engineering engagements, clients upload project briefs, design assets, and architectural documents into our secured storage vaults.

Files are stored in private Supabase Storage buckets under strictly scoped paths ('portal-files/<workspace_id>/...'). Access is gated by short-lived signed URLs (60-second TTL) available only to authenticated members of that specific workspace.

VENUS does not collect, process, or store credit card numbers, debit cards, or bank cardholder data on its own servers.

Payment processing is delegated entirely to Stripe Checkout. When an invoice is paid, Stripe transmits verified server-side webhook events to our backend to update invoice settlement statuses and generate accounting ledger entries.

We use browser cookies, local storage tokens, and session identifiers to operate our platform securely and preserve your configuration choices.

Essential cookies are required for user authentication, CSRF validation, and interface language switching. Optional preference, analytics, and attribution cookies can be reviewed and managed at any time via our Cookie Preferences Center.

For a full list of all cookies, durations, and providers, please inspect our dedicated [Cookie Policy](/cookie-policy).

We capture minimal, privacy-conscious performance telemetry to measure page load times, server execution latency, Core Web Vitals, and client error boundaries.

We do not deploy invasive third-party cross-site behavioral tracking suites. Any performance metrics gathered are strictly anonymized and used to refine application speed and eliminate runtime defects.

To deliver high-availability software infrastructure, VENUS engages established infrastructure and technology service providers:

• Cloudflare: Edge content distribution, DDoS mitigation, DNS routing, and SSL termination. • Supabase: Managed PostgreSQL database, authentication engine, and secure object storage. • Stripe: Hosted payment gateway and billing infrastructure. • Docker / Frappe: Containerized ERPNext business runtime for client ERP configurations. • AI Model Providers: When clients opt into AI modules, queries are routed via OpenAI or Anthropic APIs with enterprise zero-retention / no-training flags enabled where supported.

Production databases and file vaults are hosted within enterprise cloud data centers equipped with 24/7 biometric physical security, redundant power, and environmental controls.

Data residency defaults to regional cloud infrastructure in North America and Europe, in alignment with client deployment parameters and hosting agreements.

We implement defense-in-depth technical and operational safeguards:

• Encryption in Transit: All data transferred between clients, servers, and backend services is encrypted using modern TLS (Transport Layer Security). • Row Level Security (RLS): Database-level tenancy policies enforce workspace isolation so queries from one tenant cannot read or write another tenant's rows. • Tokenized Authorization: User identities are verified via cryptographic JWTs on every API interaction. • Secret Isolation: Sensitive operational credentials (API keys, webhook secrets, database credentials) remain strictly server-side. • Automated Backups: Scheduled encrypted database snapshots are produced and synced to independent cloud storage destinations.

We retain personal and project information only for as long as necessary to fulfill the operational, delivery, and contractual objectives for which it was gathered.

• Active Client Accounts: Retained for the duration of the commercial agreement plus post-launch maintenance SLA. • Completed Project Files: Preserved in read-only vaults for 12 months following sign-off for warranty support, unless client requests immediate purge or handoff. • Invoices & Financial Records: Retained for 7 years to satisfy statutory tax, accounting, and audit governance rules. • Inbound Leads & Briefs: Retained for up to 180 days after inactivity before archival.

VENUS does not sell, license, or monetize your personal or commercial records. We disclose data strictly under the following limited circumstances:

1. Infrastructure Processors: Trusted technical subprocessors listed in Section 13 who operate under written data protection and confidentiality covenants. 2. Client Consent: When you explicitly instruct us to integrate a third-party tool, payment rail, or external CRM API. 3. Legal Compliance: If required by a valid, binding subpoena, court order, or lawful government mandate, provided we notify you in advance unless prohibited by law.

As a globally distributed technology studio, VENUS operates with engineering personnel and infrastructure located in North America, Europe, the Middle East, and Asia-Pacific.

When operational or project data crosses international borders, we ensure that appropriate technical, administrative, and contractual safeguards (such as Standard Contractual Clauses where applicable) govern the transfer to maintain confidentiality.

Depending on your jurisdiction, you may have specific legal rights regarding your personal data:

• Right of Access: You may request a machine-readable copy of your personal and account records. • Right of Rectification: You may update inaccurate or out-of-date information in your profile settings. • Right of Erasure: You may request the deletion of your account and personal records, subject to statutory retention obligations. • Right to Restrict or Object: You may restrict processing or opt out of non-essential communications. • Cookie Choices: You can modify cookie preferences at any time using our on-site consent controls.

Clients may initiate an account deletion request through the Client Portal settings or by submitting a verified request to our privacy desk.

Because software contracts often govern active production deployments and intellectual property escrows, account deletion triggers a verification step to confirm outstanding deliverables, invoice settlements, and code handover protocols.

When you send us a message, project question, or privacy query, our internal intake system logs the message details along with timestamps and sender metadata.

We use this information exclusively to communicate with you and evaluate your request. You may opt out of further follow-up correspondence at any time by replying with an unsubscribe request.

The VENUS platform and engineering services are exclusively directed to commercial entities, business owners, and adult professionals aged 18 and older.

We do not knowingly collect or solicit personal information from children under the age of 16. If we discover that personal data of a minor has been inadvertently collected, we will take prompt steps to permanently delete the records.

We review and update this Privacy Policy periodically to reflect changes in our engineering architecture, infrastructure providers, or legal obligations.

When material changes occur, we update the Effective Date at the top of this document. For active portal clients, significant changes will be communicated via in-portal notification or verified email dispatch.

For any questions, clarifications, data access requests, or governance inquiries regarding this Privacy Policy, please contact our data team:

• Legal Entity: [Company Legal Name: VENUS Digital Systems Inc.] • Physical Address: [Registered Address: 100 Tech Oasis Blvd, Suite 400, Wilmington, DE 19801] • Privacy Contact: privacy@venus.dev • Data Protection Officer: dpo@venus.dev • Jurisdiction: [Jurisdiction: State of Delaware / Applicable Law]