Privacy Policy

This Privacy Policy explains how we collect, use, and share information when you use our website and product (the "Service"). We aim to collect only what we need to run the Service and to be clear about how it is used.

Who we are

Venturehand is a service of Маунтин Джем Инвестмънт ЕООД (Mountain Gem Investment EOOD), a company registered in Bulgaria. We are the data controller for the personal data described here.

• Legal form. Еднолично дружество с ограничена отговорност (ЕООД)
• Company number (ЕИК). 208115519
• VAT. BG208115519
• Registered seat. гр. София 1504, р-н Оборище, ул. Екзарх Йосиф 127, ет. 1, ап. 1, България
• Contact. office@venturehand.com

We have not appointed a Data Protection Officer; we are not required to. Privacy questions go to the address above.

Questions or requests? Email office@venturehand.com.

1. Information we collect

• Account information. When you create an account we collect your email address. If you sign in with Google, Google provides your name, email address, and profile identifier for authentication. Venturehand does not receive your Google password or request access to Gmail. If you choose to set a password, Supabase stores it only as a one-way hash; we never see or store it in readable form. Authentication is handled by Supabase.
• Content you submit. Product URLs you enter, the page content we fetch from those URLs to generate assets, your edits, and the assets you generate (videos, demos, copy, images, segment maps, outreach drafts, CRM contacts you add).
• Billing information. If you subscribe, payments are processed by Stripe. We receive limited details such as your subscription tier, status, and the last four digits / card brand — we do not store full card numbers.
• Connected social accounts. If you connect Facebook, Instagram, LinkedIn or TikTok so that John can publish for you, we receive an access token and the account details needed to show you which account a post will go to. Detail in section 14.
• Usage and device data. Product analytics events (e.g. which features you use), and standard technical data such as IP address, browser type, and timestamps, used for security and to improve the Service.
• How you found us. When you create an account, we save on it how your first visit reached us: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), the address of the page that linked to us (without its query string), a referral code if the link carried one (or a later link did, kept for 30 days from that visit), the page you landed on, and when. We use it to learn which channels bring people who sign up. Without your cookie consent, only the visit in which you sign up counts, and nothing is stored on your device for it. If the referral code belongs to another Venturehand user, that user, and no one else, sees how far you got: when you joined, whether you added your product context, which plan you are on, and the credits they earned from it. They see your product's name and website once you add them, and until then a shortened form of your email address (its first letters and its domain, such as ma•••@gmail.com). They never see your full email address or anything else in your account. When you run one of our free tools, we count the run with the campaign tags and referral code of the link that brought you, whether or not you accept cookies. That count is not tied to you: no account, email or IP address.
• Free-tool reports. When you use one of our free tools, such as the landing-page roast, and ask us to email you the full report, we collect your name, your email address, the address of the page you asked us to analyse (without its query string), and how your visit reached us, recorded the same way as for a sign-up (above). Asking for a report is not agreeing to marketing email. Detail in section 15.
• Marketing email, only if you opt in. If you tick the box to get launch tips and product updates (it is never ticked for you), we record when you ticked it and the exact wording you agreed to, when you confirmed, and when you unsubscribed.

2. How we use information

• To provide, operate, and maintain the Service and generate the assets you request.
• To email you a free-tool report you asked for.
• To process payments, manage your subscription, and track credit usage.
• To secure the Service, prevent abuse, and debug problems.
• To understand how the Service is used and improve it.
• To communicate with you about your account, security, and (if you opt in) product updates.

3. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of our contract with you (to provide the Service), our legitimate interests (to secure and improve the Service), your consent (where requested), and compliance with legal obligations.

4. Service providers (sub-processors)

We share data with vendors who process it on our behalf to run the Service. They are bound to use it only to provide their services to us:

• Supabase — authentication, database, and file storage.
• Google — optional account authentication using basic identity information only.
• Stripe — payment processing and subscription billing.
• OpenAI— AI generation of videos, copy, images, and other assets from your inputs, and the free tools' analysis of a page you submit (the page's content is sent; your name and email are not).
• Resend— sends our emails: the reports you ask for, the link that confirms a marketing opt-in, John's brief, and marketing email to people who opted in and confirmed. It also holds the list of those subscribers, with their unsubscribe status.
• Amazon Web Services (AWS) — media rendering and asset storage.
• Vercel — application hosting and privacy-friendly, cookieless web analytics.
• PostHog — product analytics and error reports, hosted in the EU. Collected server-side, and in your browser only as section 5 describes. It also records our AI requests (model, tokens, cost) and, for most features, the prompt and the output; for Outreach and Pipeline it records no prompt or output, because those contain the people you contact.
• Maildoso — the mailboxes used for Outreach sending. Processes the content of messages sent through the Service and the addresses they are sent to.
• Explee — business contact data. Where you ask us to find contacts, we send your search criteria and receive matching business contact records.
• Google Analytics — website analytics, loaded only if you accept analytics cookies. Data is processed by Google in the United States.
• OpenAI (advertising) — the OpenAI pixel, loaded only if you accept analytics and ad cookies. It lets OpenAI tell us, in aggregate, how many visits and plan purchases came from our ads in ChatGPT. For a purchase it sends the plan, its price and the Stripe checkout reference, never your payment details. Data is processed by OpenAI in the United States.

We do not sell your personal information. We only share it with these providers, where required by law, or in connection with a business transfer (e.g. merger or acquisition), in which case we will notify you.

Social platforms you connect yourself — Facebook, Instagram, LinkedIn, TikTok — are not on this list, because they do not process data on our behalf. They receive what you approve for publication and are separate controllers for it. That relationship is described in section 14.

5. Cookies and similar technologies

We use a small number of cookies and similar storage:

• Strictly necessary — authentication and session cookies (Supabase) that keep you signed in, and cookies set by Stripe to process payments and prevent fraud. These are required for the Service to work and cannot be turned off. If you tick the marketing box when you sign up, our cookie vh_mc carries that choice through the sign-in for up to 24 hours and is deleted once your account is created.
• Analytics, with your consent — Google Analytics sets first-party cookies (_ga, _ga_*) and PostHog sets one (ph_*) to measure how the site is used. These are set only after you press Accept, and never before. Until you choose, PostHog in your browser records nothing. If you press Reject, it stores nothing on your device and counts your visit with an anonymous daily hash computed on PostHog's servers. Vercel Analytics is cookieless, and PostHog's server-side events store nothing on your device. Our own first-party cookie vh_ftremembers how your first visit reached us for up to 30 days, so it can be saved on your account if you sign up later (see "How you found us" in section 1); it is deleted once it has been saved, or when you reject or withdraw consent.
• Advertising measurement, with your consent — the OpenAI pixel sets first-party cookies (__oppref, __obref, __oaiq_*) and may keep a local-storage entry (oaiq_consent) so that a visit arriving from one of our ads in ChatGPT, and a plan purchase that follows it, can be counted as such. Like the analytics cookies, it loads only after you press Accept, and never before. We use it to measure our own ads; we do not use it to show you ads elsewhere.

We ask before setting any analytics or advertising cookie, and rejecting is as easy as accepting. You can change your mind at any time through Cookie settings in the footer; withdrawing takes effect immediately.

6. Data retention

• Account data. For as long as your account is open.
• Generated assets (videos, posts, segment maps, drafts). Deleted within 30 days of account deletion.
• Billing records. 10 years, as Bulgarian accounting and tax law requires.
• Analytics events. 14 months.
• Backups. Rolling backups are overwritten within 35 days.
• Free-tool report requests (your name, email, the page analysed, how you reached us). Kept until you ask us to delete them; there is no automatic deletion yet.
• Marketing email. Your subscription is kept while you are subscribed. After you unsubscribe we keep your address and the dates you consented, confirmed and unsubscribed, so we can show what you agreed to and make sure you are not emailed again.

You can delete your account yourself from Profile → Your data, or export everything we hold from the same screen.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the use of your personal data, and to object to certain processing. Export and deletion are available in-product under Profile → Your data; for anything else, email office@venturehand.com. You may also withdraw consent at any time where processing is based on consent. California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.

Complaints. If you think we have handled your data badly, tell us first — but you have the right to lodge a complaint with a supervisory authority. Ours is the Commission for Personal Data Protection (Комисия за защита на личните данни), and you may also complain to the authority in your own country of residence or workplace.

8. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, such transfers are covered by appropriate safeguards (such as Standard Contractual Clauses).

9. Security

We use industry-standard measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you.

12. AI-generated content

Venturehand generates video, images, and text with AI. Under Article 50 of the EU AI Act we mark generated media so it is machine-detectable as artificially generated — this is provenance metadata inside the file, not a visible watermark, and it does not restrict how you use what you make. If you publish AI-generated content, obligations that apply to you as the publisher remain yours.

13. Data you give us about other people

Outreach and the CRM hold information about the people you want to reach. Some of it you give us; some of it we obtain for you from a business contact database, when you ask us to find people matching a description you have written. In both cases you are the controller — you decide who is approached and why — and we act as your processor, on the terms in our Data Processing Agreement. You are responsible for having a lawful basis to contact them.

Where we send on your behalf, we operate the mailbox and the sending, we apply an opt-out to every message, and we include a link to the notice written for the people who receive it — where their details came from, who is responsible, and how to object. If someone opts out, we record it against that address across the whole Service and do not contact them again for any customer. If you have been contacted by one of our customers and want to be removed, write to office@venturehand.com and we will suppress the address Service-wide; you may also need to ask the customer directly, as they are the controller for their own records.

14. Connecting a social account (Meta, LinkedIn and TikTok)

Studio can publish on your behalf to accounts you connect. Connecting is optional, always started by you, and nothing is posted that you have not approved. Facebook and Instagram run on the Meta developer platform— Facebook Login and the Graph API for Facebook Pages, Instagram Login and the Instagram API for Instagram professional accounts — and we use them under Meta's Platform Terms and Developer Policies. LinkedIn works the same way through its own API. TikTok runs on TikTok for Developers— Login Kit and the Content Posting API — under TikTok's Developer Terms of Service. For TikTok we only send a video to your TikTok inbox as a draft: you write the caption and post it yourself in the TikTok app, and nothing is public until you do.

What we receive when you connect.

• An access token for the account, and for Facebook a separate token for each Page you administer. Tokens are encrypted at rest, never shown in the interface, and never included in a data export.
• The list of Facebook Pages you administer — name, identifier and picture — so you can choose which Page to post as rather than have one chosen for you.
• For Instagram, the username and profile picture of the professional account, so you can see which account you are connected as.
• For TikTok, your account's display name, profile picture and TikTok's identifier for you within our app (its “open ID”), so you can see which account a video will go to.

We request the narrowest permissions the job needs: pages_show_list, pages_manage_posts and pages_read_engagement for Facebook Pages, instagram_business_basic and instagram_business_content_publish for Instagram, user.info.basic and video.upload for TikTok. We do not read your personal profile, your friends or followers, your messages, or your advertising data. The Graph API cannot post to a personal Facebook profile at all — Pages only.

What we do with it. One thing: publish the posts you approve (and, when you ask for it on LinkedIn, like the post and add the first comment you wrote), and show you which account they will go to. We do not use data obtained from Meta, LinkedIn or TikTok for advertising, to build profiles, to train models, or for any purpose beyond running the Service for you. We do not sell it and we never expose it to another customer.

What the platform receives. The content you approved, at the moment you publish it. Once it is there, Meta, LinkedIn or TikTok is the controller for what it holds, under its own terms — Meta's Privacy Policy and LinkedIn's Privacy Policy and TikTok's Privacy Policy.

Disconnecting and deletion. Disconnect at any time under Posts → Connected accounts. Disconnecting deletes the stored tokens and the account details listed above from our systems; deleting your account removes them as well. You can also revoke our access from the platform's own side — Settings → Apps and Websites on Facebook and Instagram, and Settings and privacy → Security and permissions → Apps on TikTok. To have the deletion confirmed in writing, email office@venturehand.com. Disconnecting does not remove posts already published — those are on the platform, and you delete them there.

15. Free-tool reports and marketing email

A report request is not marketing consent. When you ask for a free-tool report by email, we send that report and nothing else. We use your name and email to send it, and keep the request so we can see whether it was delivered and stop the form being used to email someone repeatedly (each address gets at most three reports a day). The legal basis is your request (performance of a contract, Art. 6(1)(b) GDPR).

Marketing email is opt-in, and confirmed twice. The box offering launch tips and product updates — on the report form and at sign-up — is never ticked for you, and leaving it unticked changes nothing else. If you signed up before the box existed, your workspace asks you the same question once, and a no changes nothing. If you tick the box or say yes, we email you a confirmation link, and send no marketing email until you open it. The legal basis is your consent (Art. 6(1)(a) GDPR). We expect to write about once a week.

Unsubscribing takes one click. Every marketing email has an unsubscribe link and the headers that let your mail app show its own Unsubscribe button. Either one stops marketing email at once, here and at Resend, our email provider. Withdrawing consent does not affect email you were sent before.

Who sees it.Your name and email go to Resend, to send the email. Only people who opted in and confirmed are added to Resend's subscriber list. OpenAI analyses the page you submit, not your details. We do not sell or share the list. To have your contact record deleted, email office@venturehand.com.

16. Contact

Маунтин Джем Инвестмънт ЕООД · ЕИК 208115519 · гр. София 1504, р-н Оборище, ул. Екзарх Йосиф 127, ет. 1, ап. 1, България
For any privacy question or request, email office@venturehand.com.