Privacy Policy

This Privacy Policy explains how we collect, use, and share information when you use our website and product (the "Service"). We aim to collect only what we need to run the Service and to be clear about how it is used.

Who we are

Venturehand is a service of Маунтин Джем Инвестмънт ЕООД (Mountain Gem Investment EOOD), a company registered in Bulgaria. We are the data controller for the personal data described here.

• Legal form. Еднолично дружество с ограничена отговорност (ЕООД)
• Company number (ЕИК). 208115519
• VAT. BG208115519
• Registered seat. гр. София 1504, р-н Оборище, ул. Екзарх Йосиф 127, ет. 1, ап. 1, България
• Contact. office@venturehand.com

We have not appointed a Data Protection Officer; we are not required to. Privacy questions go to the address above.

Questions or requests? Email office@venturehand.com.

1. Information we collect

• Account information. When you create an account we collect your email address. If you sign in with Google, Google provides your name, email address, and profile identifier for authentication. Venturehand does not receive your Google password or request access to Gmail. Authentication is handled by Supabase.
• Content you submit. Product URLs you enter, the page content we fetch from those URLs to generate assets, your edits, and the assets you generate (videos, demos, copy, images, segment maps, outreach drafts, CRM contacts you add).
• Billing information. If you subscribe, payments are processed by Stripe. We receive limited details such as your subscription tier, status, and the last four digits / card brand — we do not store full card numbers.
• Usage and device data. Product analytics events (e.g. which features you use), and standard technical data such as IP address, browser type, and timestamps, used for security and to improve the Service.

2. How we use information

• To provide, operate, and maintain the Service and generate the assets you request.
• To process payments, manage your subscription, and track credit usage.
• To secure the Service, prevent abuse, and debug problems.
• To understand how the Service is used and improve it.
• To communicate with you about your account, security, and (if you opt in) product updates.

3. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of our contract with you (to provide the Service), our legitimate interests (to secure and improve the Service), your consent (where requested), and compliance with legal obligations.

4. Service providers (sub-processors)

We share data with vendors who process it on our behalf to run the Service. They are bound to use it only to provide their services to us:

• Supabase — authentication, database, and file storage.
• Google — optional account authentication using basic identity information only.
• Stripe — payment processing and subscription billing.
• OpenAI — AI generation of videos, copy, images, and other assets from your inputs.
• Amazon Web Services (AWS) — media rendering and asset storage.
• Vercel — application hosting and privacy-friendly, cookieless web analytics.
• PostHog — product analytics, collected server-side (no cookies).
• Maildoso — the mailboxes used for Outreach sending. Processes the content of messages sent through the Service and the addresses they are sent to.
• Explee — business contact data. Where you ask us to find contacts, we send your search criteria and receive matching business contact records.
• Google Analytics — website analytics, loaded only if you accept analytics cookies. Data is processed by Google in the United States.

We do not sell your personal information. We only share it with these providers, where required by law, or in connection with a business transfer (e.g. merger or acquisition), in which case we will notify you.

5. Cookies and similar technologies

We use a small number of cookies and similar storage:

• Strictly necessary — authentication and session cookies (Supabase) that keep you signed in, and cookies set by Stripe to process payments and prevent fraud. These are required for the Service to work and cannot be turned off.
• Analytics, with your consent — Google Analytics sets first-party cookies (_ga, _ga_*) to measure how the site is used. These load only after you press Accept, and never before. Vercel Analytics is cookieless and PostHog runs server-side, so neither stores anything on your device.

We ask before setting any analytics cookie, and rejecting is as easy as accepting. You can change your mind at any time through Cookie settings in the footer; withdrawing takes effect immediately. We do not use advertising or cross-site tracking cookies.

6. Data retention

• Account data. For as long as your account is open.
• Generated assets (videos, posts, segment maps, drafts). Deleted within 30 days of account deletion.
• Billing records. 10 years, as Bulgarian accounting and tax law requires.
• Analytics events. 14 months.
• Backups. Rolling backups are overwritten within 35 days.

You can delete your account yourself from Profile → Danger zone, or export everything we hold from the same screen.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the use of your personal data, and to object to certain processing. Export and deletion are available in-product under Profile → Danger zone; for anything else, email office@venturehand.com. You may also withdraw consent at any time where processing is based on consent. California residents have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.

Complaints. If you think we have handled your data badly, tell us first — but you have the right to lodge a complaint with a supervisory authority. Ours is the Commission for Personal Data Protection (Комисия за защита на личните данни), and you may also complain to the authority in your own country of residence or workplace.

8. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, such transfers are covered by appropriate safeguards (such as Standard Contractual Clauses).

9. Security

We use industry-standard measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you.

12. AI-generated content

Venturehand generates video, images, and text with AI. Under Article 50 of the EU AI Act we mark generated media so it is machine-detectable as artificially generated — this is provenance metadata inside the file, not a visible watermark, and it does not restrict how you use what you make. If you publish AI-generated content, obligations that apply to you as the publisher remain yours.

13. Data you give us about other people

Outreach and the CRM hold information about the people you want to reach. Some of it you give us; some of it we obtain for you from a business contact database, when you ask us to find people matching a description you have written. In both cases you are the controller — you decide who is approached and why — and we act as your processor, on the terms in our Data Processing Agreement. You are responsible for having a lawful basis to contact them.

Where we send on your behalf, we operate the mailbox and the sending, we apply an opt-out to every message, and we include a link to the notice written for the people who receive it — where their details came from, who is responsible, and how to object. If someone opts out, we record it against that address across the whole Service and do not contact them again for any customer. If you have been contacted by one of our customers and want to be removed, write to office@venturehand.com and we will suppress the address Service-wide; you may also need to ask the customer directly, as they are the controller for their own records.

14. Contact

Маунтин Джем Инвестмънт ЕООД · ЕИК 208115519 · гр. София 1504, р-н Оборище, ул. Екзарх Йосиф 127, ет. 1, ап. 1, България
For any privacy question or request, email office@venturehand.com.