Privacy Notice

VenturePath Privacy Notice: Owner and Counsel Review Copy

Version: 0.8
Review date: 13 October 2026
Controller: Amara+, operating from Doha, Qatar
Privacy contact: privacy@venturepathapp.com

This owner and counsel review copy supports service design and is not legal advice. It must be completed with the verified operator and contact details before a broader public launch.

1. Current public early-access service

The current VenturePath early-access service uses verified accounts and server-enforced workspace membership. Account details, legal acknowledgement receipts, privacy preferences and account-backed venture records are processed through Supabase. A device recovery copy may also retain venture work in the user's browser, and users can export portable copies. Consultation helpers format or copy a request locally and do not book or transmit it unless the user opens a configured external channel.

The installable web-app feature may cache public pages, interface assets, fonts, and icons on the user’s device for performance and offline resilience. The browser also stores the signed-in session and device recovery copies of business-plan work until the user signs out, clears site data, or the application removes them. Hosting, authentication, database, CAPTCHA, transactional email, error-monitoring and network providers may process the limited information described in this notice and the Subprocessor Register. VenturePath does not intentionally install advertising or marketing trackers. Optional product analytics remains off unless a user separately opts in.

2. Who is responsible

Amara+, operating from Doha, Qatar, decides why and how account, workspace, research, support and product-usage data are processed for the current controlled beta. A registered legal form, registration number and complete postal address have not been provided for publication, so the service must not be represented as a broader public or paid offering until those details are verified and published. A business customer may act as controller for personal data it places in a workspace only where a separately completed and executed Data Processing Addendum identifies the parties and their responsibilities.

3. Data and purposes

Do not use consent when the user has no real choice. Do not treat acceptance of Terms or acknowledgement of this notice as consent to marketing, optional analytics, research, model training, or unrelated purposes.

"Know yourself" reflections are stored inside the project workspace. The interface restricts that page to the team leader, but signed-in project members can technically read the shared workspace record through the project API. Users must not treat those reflections as confidential from their project team and should not enter credentials, regulated data or other secrets there. The account-deletion design removes the departing person's private reflection keys from current and versioned workspace records. This control is described as operational only after the release evidence records a successful hosted deletion test.

4. Data minimization and special data

VenturePath should use display names and participant codes where possible, separate interview contact details from research notes, and avoid full transcripts in AI prompts. Early pilots exclude minors’ data, government identifiers, payment-card details, bank credentials, medical data, biometrics, criminal records, political/religious data, and other special/regulated categories unless a separately reviewed design, permission, security measure, and lawful condition applies.

5. Sources

Data comes from users, invited team members, organization/program administrators, customer-research participants (where the user has authority), connected services the user enables, public sources requested for research, and technical/security systems.

6. Sharing and processors

The service uses providers for hosting, authentication, database, private profile-image storage, security monitoring, transactional contact-form email and published operator mailboxes. It may later add customer-support and user-invoked AI providers only after the related legal and product controls are completed. The Subprocessor Register identifies active and proposed vendors, purpose, data, location, status, and safeguards. Contract and transfer review remains incomplete where the register says verification is pending; no incomplete review is represented as an executed processor agreement.

The Operator may disclose information when lawfully required, to protect rights/safety, or in a corporate transaction with notice and continuing protection. Venture content is not sold. A sale/share analysis must be completed before serving California users or adding advertising technology.

7. AI processing

Before an AI task, the interface should show what records will be sent, purpose, provider/model class, material retention/training terms, and a non-AI path where feasible. Confidential venture content must not be used for shared-model training without separate opt-in. AI outputs remain separate from approved facts. See the AI Data Use Notice.

8. International transfers

Hosting, Supabase, AI, email, support, or other vendors may process data outside Qatar, the Philippines or the user’s country. Before activation, VenturePath must map each transfer and apply safeguards required by Qatar PDPPL Article 15, the Philippine Data Privacy Act and its rules where applicable, any applicable GDPR/UK GDPR, and customer contracts. Controls may include location selection, contracts/DPA, transfer assessment, encryption, minimization and documented lawful exceptions.

9. Retention

The current service does not offer account deactivation, so no two-year post-deactivation clock currently runs. The owner-approved two-year period remains a proposed requirement if deactivation is introduced, and it must not be represented as operational until a deactivation workflow and scheduled purge exist. Active accounts are retained while the service relationship continues. Users can instead use the verified account-deletion workflow, subject to applicable rights and documented lawful holds. Shared venture contributions may remain in anonymized form so another member's project record is not silently rewritten. Deleted projects have a disclosed recovery window before active-system purge. Backup encryption, rotation and verified restoration remain release controls that must be evidenced before they are described as operational.

10. Rights and choices

Depending on applicable law, users may have rights to information, access, correction, deletion/erasure or blocking, consent withdrawal, objection, restriction, portability/export, complaint, and notification of inaccurate disclosure or qualifying breaches. Qatar NCSA guidance and the Philippine Data Privacy Act/implementing rules provide overlapping but not identical rights and procedures; the production workflow must apply the relevant requirement to the verified facts.

VenturePath must provide a self-service or support route, verify identity proportionately, record the request, meet the applicable deadline, explain refusals, and propagate approved changes or deletion to processors. Optional marketing and analytics choices are changeable in Settings without closing the account.

11. Security

Current controls include verified authentication, server-side tenant authorization, Row Level Security, encryption in transit, least privilege, versioned changes and account deletion. The broader-launch control plan also includes appropriate session controls, MFA for privileged roles, managed backups, audit logs, rate limits/CAPTCHA as appropriate, vulnerability and dependency scanning, incident response, vendor review, and independent security assessment. No system is risk-free.

12. Breaches

VenturePath will detect, contain, document, assess, recover, and notify regulators/individuals where required. Qatar PDPPL Article 14 and NCSA guidance require documented assessment and notification where the legal threshold is met. Other jurisdictions may impose specific deadlines; the incident process must follow the shortest applicable requirement.

13. Children

VenturePath is intended for adults and early-stage venture teams, not children. Production registration is 18+. If the service later supports schools, minors, or actual knowledge of under-13 US users, it must implement separate age, parental/institutional notice and verifiable consent, safeguarding, minimization, security, retention, and deletion controls before collecting personal information.

14. Cookies and local technology

See the Cookie & Local Storage Notice. Non-essential analytics/marketing technology must remain disabled until the relevant consent or legal-basis design is implemented. Rejecting non-essential technology must be as easy as accepting it.

15. Complaints and regulator

Contact VenturePath first at privacy@venturepathapp.com. If Qatar law applies, users may have a route to the National Cyber Security Agency's competent privacy authority. If Philippine law applies, users may have a complaint route to the National Privacy Commission. If another law applies, its relevant supervisory and complaint rights remain available.

16. Changes and language

Display the current effective date and retain historic versions. Material processing changes should be actively communicated before they begin. Taglish coaching is not a substitute for an accurate legal translation. Provide this notice in every language required or used to obtain legal agreement/consent; Filipino/Taglish and any Arabic versions require substantive legal review.

Primary sources

• Qatar Law No. 13 of 2016: https://www.almeezan.qa/EnglishLaws/132016.pdf
• Qatar NCSA Privacy Notice Guidelines: https://assurance.ncsa.gov.qa/sites/default/files/library/2022-09/Privacy%20Notice%20-%20Guideline%20for%20Regulated%20Entities%20%28English%29.pdf
• Qatar NCSA Individuals’ Rights Guidelines: https://assurance.ncsa.gov.qa/sites/default/files/library/2022-12/Individuals%27%20Rights%20-%20Guideline%20for%20Regulated%20Entities.pdf
• Philippines Data Privacy Act, RA 10173: https://privacy.gov.ph/data-privacy-act/
• Philippines Data Privacy Act Implementing Rules: https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/
• EU GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

Download historical version 0.7