This Privacy Policy explains how Venture Online Ltd ("we", "us", or "our") collects, uses, and protects your personal data when you use the Venture platform and website at ventureonline.co.
We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Venture Online Ltd is the data controller for personal data processed through the Venture platform and website. If you have any questions about this policy or how we handle your data, please contact us at privacy@ventureonline.co.
2. What data we collect
Account and profile data
- Full name and email address
- Organisation name
- Password (stored as a one-way bcrypt hash — we cannot read it)
- Profile information you choose to add (avatar, phone number, timezone)
- Role within your organisation
Usage and platform data
- Projects, tasks, risks, documents, and other content you create within the platform
- Actions you take and features you use
- Session information including IP address and browser/device user agent
- Login timestamps
Billing data
- Subscription plan and billing frequency
- Payment method details — handled directly by Stripe; we do not store card numbers
- Invoice history
Communications data
- Messages sent via our contact form
- Support correspondence
Technical data
- IP address
- Browser type and version
- Operating system
- Referring URL
- Cookie identifiers (see Section 8)
3. How we use your data
| Data | Purpose | Legal basis |
|---|---|---|
| Account and profile data | To create and manage your account; to authenticate you; to personalise your experience | Contract performance |
| Usage and platform data | To deliver the Venture platform services you have subscribed to | Contract performance |
| Billing data | To process payments, manage subscriptions, and send invoices | Contract performance / Legal obligation |
| Session and security data | To protect your account, detect fraud, and maintain platform security | Legitimate interests |
| Contact form messages | To respond to your enquiries | Legitimate interests |
| Technical data | To diagnose errors, improve platform performance, and monitor uptime | Legitimate interests |
| Email address (marketing) | To send product updates and relevant announcements — only with your consent | Consent |
4. Legal bases for processing
Under UK GDPR, we rely on the following legal bases:
- Contract performance — processing necessary to deliver the services you have signed up for.
- Legal obligation — where we are required to process data to comply with UK law (e.g. financial records retention).
- Legitimate interests — where we have a legitimate business reason, balanced against your rights (e.g. security monitoring, fraud prevention, service improvement).
- Consent — for marketing communications. You can withdraw consent at any time.
5. Data sharing and third parties
We do not sell your personal data. We share data only with trusted third-party processors necessary to deliver the service:
- Supabase — database and authentication infrastructure. Data is hosted in the EU/UK.
- Stripe — payment processing. Stripe is PCI-DSS compliant. We do not store card data.
- Vercel — application hosting and CDN. Servers located in EU/UK regions.
- SMTP provider — for transactional emails (account notifications, invoices).
- Anthropic — AI language model provider. When you use AI features within the platform, the content of your prompts and relevant contextual data (such as project names, task descriptions, and document excerpts) is transmitted to Anthropic's API to generate a response. This data is processed by Anthropic in accordance with their privacy policy and enterprise data handling terms. Anthropic does not use API-submitted data to train its models. We do not send special category personal data to Anthropic. You should avoid including sensitive personal data in AI prompts.
- Google Analytics — website analytics. See Section 8 (Cookies) for details.
All processors are subject to data processing agreements and are required to handle your data only on our instructions.
We may disclose personal data to law enforcement or regulatory authorities if required by law or to protect the rights, property, or safety of Venture Online Ltd, our users, or others.
6. International transfers
Where any of our third-party processors transfer data outside the UK or EEA, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or equivalent mechanisms approved by the Information Commissioner's Office (ICO).
7. Data retention
- Account data is retained for as long as your account is active, plus 30 days after deletion to allow recovery.
- Billing and financial records are retained for 7 years in accordance with UK tax and accounting obligations.
- Session data is retained for 30 days.
- Contact form messages are retained for 2 years.
- Anonymised usage analytics may be retained indefinitely.
8. Cookies
We use the following cookies:
- vp_session — an HTTP-only, secure session cookie used to authenticate you. Expires after 30 days of inactivity. This cookie is strictly necessary for the platform to function.
- Google Analytics (_ga, _ga_*) — analytics cookies set by Google Analytics to help us understand how visitors use our website (pages visited, time on site, traffic source). These cookies collect data in an anonymised form. They are not used to identify you personally and are not used for advertising.
- cookie_consent — a localStorage entry (not a cookie) that stores your analytics consent preference so we don't ask again.
We obtain your consent before setting Google Analytics cookies on the public website, in accordance with the UK Privacy and Electronic Communications Regulations (PECR). You can withdraw consent at any time by clearing your browser's local storage or cookies for ventureonline.co.
Authenticated platform users are subject to analytics tracking as described in our Terms of Use, which you accept on registration.
We do not use advertising or retargeting cookies.
9. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — request deletion of your personal data in certain circumstances.
- Right to restrict processing — ask us to limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing.
- Rights related to automated decision-making — we do not use fully automated decision-making that produces legal or similarly significant effects.
To exercise any of these rights, email us at privacy@ventureonline.co. We will respond within one month. We may ask you to verify your identity before fulfilling a request.
10. Right to complain
If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
We would appreciate the opportunity to address your concerns before you contact the ICO — please reach out to us first at privacy@ventureonline.co.
11. Security
We implement appropriate technical and organisational measures to protect your personal data, including encrypted data storage, HTTPS-only transmission, HTTP-only session cookies, bcrypt password hashing, and access controls limiting who within our organisation can access personal data.
12. Children
Venture is a business platform intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a prominent notice on the platform. The "Last updated" date at the top of this page will always reflect the most recent version.
14. Contact us
Venture Online Ltd
Email: privacy@ventureonline.co