Privacy policy

This policy describes how Caventia, Inc., a Delaware corporation(together with its affiliates, "Caventia", "we" or "our") collects, uses and discloses personal information through caventia.com (the "Site"). It applies to anyone who visits the Site or submits a form on it.

Caventia is pre-product. This policy covers Site activity only. A separate Data Processing Addendum will govern any future customer-facing product.

Categories of personal information we collect

We collect only what you submit through forms on the Site, plus limited technical data your browser sends automatically.

• Identifiers. Name, work email address, professional title, employer name. Collected when you submit the whitepaper, design-partner or press forms.
• Professional information. AUM tier, regulator context and any free-text inquiry message you choose to include.
• Technical data. IP address, user-agent and referrer at the time of a Site visit. Captured by the hosting infrastructure; not used to identify individuals.

We do not collect sensitive personal information as defined by CCPA/CPRA. We do not collect biometric, genetic, health, sexual orientation, religious or political data.

How we use it

We use the information you submit to:

• Deliver the whitepaper or response you requested.
• Have a follow-up conversation about a design-partner relationship or press inquiry.
• Maintain a record of inquiries for our own contractual, regulatory and audit-trail purposes.
• Improve the Site in aggregate based on which content converts.

We do not sell, rent, share or trade your personal information with third parties for their own marketing. We do not engage in cross-context behavioral advertising as defined by CPRA.

Legal basis (GDPR / UK GDPR)

If you are in the EU or UK, our legal basis for processing your personal information depends on the purpose:

• Consent (Article 6(1)(a)) for delivering the whitepaper you requested.
• Legitimate interest(Article 6(1)(f)) for following up on commercial inquiries, maintaining inquiry records and improving the Site. Our legitimate interest is in operating a credible design-partner pipeline; we believe this does not override your rights and we will reconsider at any individual's request.

Cookies and tracking

The Site does not currently set cookies or use third-party tracking. We do not run advertising tags. We do not use Google Analytics. If we add a privacy-respecting analytics tool such as Plausible Analytics, it will be cookieless and aggregate only non-identifying page-view counts; this policy will be updated to reflect any such addition.

Service providers and sub-processors

We use the following services to operate the Site. Each processes a limited slice of the data described above under our instructions.

• Vercel hosts the Site. Vercel may process IP address and request metadata in the course of serving pages.
• Resend delivers transactional email when you submit a form. Resend processes your email address and the message body.

International data transfers

Our service providers are located primarily in the United States. If you submit personal information from outside the United States, that information will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or equivalent transfer mechanisms with our sub-processors.

Retention

We retain personal information only as long as needed for the purpose collected, then delete or anonymize it.

• Inquiry submissions are retained for the duration of the commercial relationship, plus a defensible tail not to exceed seven years for record-keeping.
• Server logs with IP addresses are retained no longer than ninety days.

You can request earlier deletion at any time at the address below; we will comply within thirty days unless we are subject to a legal-hold obligation that requires longer retention.

Your rights

Depending on where you live, you may have rights to access, correct, delete, port or restrict processing of your personal information. Specifically:

• EU / UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection and the right to lodge a complaint with your supervisory authority.
• California (CCPA / CPRA): right to know, right to delete, right to correct, right to opt out of sale or sharing (we do not sell or share), right to limit use of sensitive personal information (we do not collect sensitive data) and right to non-discrimination for exercising these rights.
• Other US states with comprehensive privacy laws (Colorado, Connecticut, Virginia, Utah and similar) provide analogous rights.

Email privacy@caventia.com to exercise any of these rights. We will verify your identity by confirming your control of the email address on file, then respond within the timing required by applicable law.

Children

The Site is not directed to children under sixteen. We do not knowingly collect personal information from anyone under sixteen. If you believe we have collected information from a child, please contact us and we will delete it.

Security

We use reasonable and appropriate technical and organizational safeguards including TLS in transit, encrypted storage at our sub-processors and access controls limited to staff with a business need. No security is perfect; we cannot guarantee absolute security but we will notify affected individuals of any breach as required by applicable law.

Automated decision-making

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

Changes to this policy

We may update this policy as our practices change. The "Effective" date at the top reflects the most recent revision. Material changes will be flagged at the top of this page for at least thirty days.

Contact

Caventia, Delaware, USA. For privacy questions or to exercise your rights: privacy@caventia.com. You can also reach the founder at ashish@caventia.com.

This document is a working policy and is not legal advice. Counsel review is scheduled before any production commercial relationship begins. Read the terms of service →