Ventrova ("we", "us") operates ventrova.dev and provides LLM/AI security tooling and compliance-evidence services. The full legal entity, registered address, and (where applicable) VAT identifier of the controller are set out in our Imprint. For any privacy question or request, contact business@ventrova.dev.
| Data | When / why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Aggregate usage analytics (pages viewed, referrer, approximate region, browser type) | Every visit, to understand what content is useful. Collected via GoatCounter, a privacy-friendly analytics tool that does not set cookies and does not build cross-site profiles. | Legitimate interest (Art. 6(1)(f)) in operating and improving the site |
| Contact details you send us (name, email address, message contents) | When you email us or use a contact/order link. | Steps prior to a contract / legitimate interest in responding (Art. 6(1)(b)/(f)) |
| Service-delivery data (system descriptions, scan output/JSON, attestation names you provide) | Only for paying customers, to deliver the evidence you ordered. | Performance of a contract (Art. 6(1)(b)) |
| Billing data (name, billing address, VAT ID, payment status) | To invoice and receive payment. Card data is handled by Stripe; we do not see or store full card numbers. | Contract + legal obligation (Art. 6(1)(b)/(c)) |
We do not use cookies for tracking or advertising, we do not run ad networks, and we do not sell personal data.
We use a small number of reputable providers to run the service. Each acts as a processor under a data-processing agreement:
| Provider | Purpose |
|---|---|
| Cloudflare | Website hosting, CDN, DNS, security |
| GoatCounter | Cookieless, aggregate web analytics |
| Google Workspace (Gmail) | Email correspondence |
| Stripe | Payment processing and invoicing |
| GitHub | Hosting of our open-source tooling |
Some of these providers are based in the United States. Where personal data is transferred outside the EEA, it is protected by the providers' Standard Contractual Clauses and equivalent safeguards.
Analytics are aggregate and retained only as long as useful for trend analysis. Email correspondence is kept while a conversation or relationship is active and for a reasonable period afterward. Billing records are kept for the period required by applicable tax and commercial law. You can ask us to delete data we are not legally required to keep.
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. To exercise any of these, email business@ventrova.dev. You also have the right to lodge a complaint with your local data-protection supervisory authority.
The site is served over HTTPS. We limit access to personal data to what is needed to deliver the service, and we rely on the security controls of the processors listed above. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your data.
We may update this policy as our services or providers change. The "last updated" date above reflects the current version.