# VenturePath Privacy Notice: Owner and Counsel Review Copy

**Version:** 0.3
**Review date:** 16 August 2026
**Controller:** `[INSERT LEGAL ENTITY AND ADDRESS]`  
**Privacy contact:** `[INSERT EMAIL/PORTAL/POSTAL ADDRESS]`

> This owner and counsel review copy supports service design and is not legal advice. It must be completed with the verified operator and contact details before a broader public launch.

## 1. Current public early-access service

The current VenturePath early-access service uses verified accounts and server-enforced workspace membership. Account details, legal acknowledgement receipts, privacy preferences and account-backed venture records are processed through Supabase. A device recovery copy may also retain venture work in the user's browser, and users can export portable copies. Consultation helpers format or copy a request locally and do not book or transmit it unless the user opens a configured external channel.

The installable web-app feature may cache public pages, interface assets, fonts, and icons on the user’s device for performance and offline resilience. Hosting, authentication, database, error-monitoring and network providers may process the limited information described in this notice and the Subprocessor Register. VenturePath does not intentionally install advertising or marketing trackers. Optional product analytics remains off unless a user separately opts in.

## 2. Who is responsible

The controller identity is not yet finalized in this owner-and-counsel review copy. Before a broader public launch, this notice must name the registered entity that decides why and how account, workspace, research, support, and product-usage data are processed. Business customers may be controllers for personal data they place in their workspace, while VenturePath acts as their processor under a Data Processing Addendum.

## 3. Data and purposes

| Data | Purpose | Proposed basis; counsel to confirm |
|---|---|---|
| Name, email, authentication ID, account status | Create, verify, secure, and administer the account | Contract steps/performance; security/legal interests |
| Terms/privacy/AUP versions and acknowledgement receipts | Prove what was presented and agreed; manage updates | Contract; legal/compliance interests |
| Venture membership, role, invitations, access history | Provide team workspaces and enforce authorization | Contract; security interests |
| Venture answers, evidence, decisions, plans, financial and impact inputs | Provide the user-requested planning service | Contract; customer instructions |
| Customer interview/research records | User-directed research workflow | Customer responsibility; consent or other lawful basis must be documented |
| AI task context, output, citations, disposition | Provide user-invoked AI support, safety, and auditability | Contract; customer instructions; specific consent if required for sensitive data |
| Support messages and incident records | Respond, troubleshoot, protect the service | Contract; legitimate/security/legal interests |
| Essential device/session/security logs | Authentication, fraud prevention, rate limits, availability | Security/legal interests; essential technology |
| Optional product analytics | Improve usability without collecting venture answers | Consent where required; otherwise assessed legitimate interest |
| Product/news emails | Send optional updates | Separate consent or legally valid existing-customer rule; easy opt-out |

Do not use consent when the user has no real choice. Do not treat acceptance of Terms or acknowledgement of this notice as consent to marketing, optional analytics, research, model training, or unrelated purposes.

## 4. Data minimization and special data

VenturePath should use display names and participant codes where possible, separate interview contact details from research notes, and avoid full transcripts in AI prompts. Early pilots exclude minors’ data, government identifiers, payment-card details, bank credentials, medical data, biometrics, criminal records, political/religious data, and other special/regulated categories unless a separately reviewed design, permission, security measure, and lawful condition applies.

## 5. Sources

Data comes from users, invited team members, organization/program administrators, customer-research participants (where the user has authority), connected services the user enables, public sources requested for research, and technical/security systems.

## 6. Sharing and processors

The service uses processors for hosting, authentication, database, private profile-image storage and security monitoring. It may later add transactional email, customer support and user-invoked AI providers only after the related legal and product controls are completed. The [Subprocessor Register](subprocessor-register.md) identifies active and proposed vendors, purpose, data, location, status, and safeguards. Processors receive only necessary data under written terms, confidentiality, security, deletion/return, incident, audit, and subprocessor controls.

The Operator may disclose information when lawfully required, to protect rights/safety, or in a corporate transaction with notice and continuing protection. Venture content is not sold. A sale/share analysis must be completed before serving California users or adding advertising technology.

## 7. AI processing

Before an AI task, the interface should show what records will be sent, purpose, provider/model class, material retention/training terms, and a non-AI path where feasible. Confidential venture content must not be used for shared-model training without separate opt-in. AI outputs remain separate from approved facts. See the [AI Data Use Notice](ai-data-use-notice.md).

## 8. International transfers

Hosting, Supabase, AI, email, support, or other vendors may process data outside Qatar, the Philippines or the user’s country. Before activation, VenturePath must map each transfer and apply safeguards required by Qatar PDPPL Article 15, the Philippine Data Privacy Act and its rules where applicable, any applicable GDPR/UK GDPR, and customer contracts. Controls may include location selection, contracts/DPA, transfer assessment, encryption, minimization and documented lawful exceptions.

## 9. Retention

Data is kept only as long as necessary for its purpose, security, contract, law, dispute, or consent record. The proposed periods are in the [Retention & Deletion Schedule](retention-deletion-schedule.md). Deleted projects should have a disclosed recovery window, then be purged from active systems; backups expire on a documented cycle. Legal holds are exceptional and documented.

## 10. Rights and choices

Depending on applicable law, users may have rights to information, access, correction, deletion/erasure or blocking, consent withdrawal, objection, restriction, portability/export, complaint, and notification of inaccurate disclosure or qualifying breaches. Qatar NCSA guidance and the Philippine Data Privacy Act/implementing rules provide overlapping but not identical rights and procedures; the production workflow must apply the relevant requirement to the verified facts.

VenturePath must provide a self-service or support route, verify identity proportionately, record the request, meet the applicable deadline, explain refusals, and propagate approved changes or deletion to processors. Optional marketing and analytics choices are changeable in Settings without closing the account.

## 11. Security

Current controls include verified authentication, server-side tenant authorization, Row Level Security, encryption in transit, least privilege, versioned changes and account deletion. The broader-launch control plan also includes appropriate session controls, MFA for privileged roles, managed backups, audit logs, rate limits/CAPTCHA as appropriate, vulnerability and dependency scanning, incident response, vendor review, and independent security assessment. No system is risk-free.

## 12. Breaches

VenturePath will detect, contain, document, assess, recover, and notify regulators/individuals where required. Qatar PDPPL Article 14 and NCSA guidance require documented assessment and notification where the legal threshold is met. Other jurisdictions may impose specific deadlines; the incident process must follow the shortest applicable requirement.

## 13. Children

VenturePath is intended for adults and early-stage venture teams, not children. Production registration is 18+. If the service later supports schools, minors, or actual knowledge of under-13 US users, it must implement separate age, parental/institutional notice and verifiable consent, safeguarding, minimization, security, retention, and deletion controls before collecting personal information.

## 14. Cookies and local technology

See the [Cookie & Local Storage Notice](cookie-notice.md). Non-essential analytics/marketing technology must remain disabled until the relevant consent or legal-basis design is implemented. Rejecting non-essential technology must be as easy as accepting it.

## 15. Complaints and regulator

Contact VenturePath first at `[INSERT PRIVACY CONTACT]`. If Qatar law applies, users may have a route to the National Cyber Security Agency’s competent privacy authority. If Philippine law applies, users may have a complaint route to the National Privacy Commission. If EU/UK or another law applies, the notice must identify the relevant supervisory/complaint rights.

## 16. Changes and language

Display the current effective date and retain historic versions. Material processing changes should be actively communicated before they begin. Taglish coaching is not a substitute for an accurate legal translation. Provide this notice in every language required or used to obtain legal agreement/consent; Filipino/Taglish and any Arabic versions require substantive legal review.

## Primary sources

- Qatar Law No. 13 of 2016: https://www.almeezan.qa/EnglishLaws/132016.pdf
- Qatar NCSA Privacy Notice Guidelines: https://assurance.ncsa.gov.qa/sites/default/files/library/2022-09/Privacy%20Notice%20-%20Guideline%20for%20Regulated%20Entities%20%28English%29.pdf
- Qatar NCSA Individuals’ Rights Guidelines: https://assurance.ncsa.gov.qa/sites/default/files/library/2022-12/Individuals%27%20Rights%20-%20Guideline%20for%20Regulated%20Entities.pdf
- Philippines Data Privacy Act, RA 10173: https://privacy.gov.ph/data-privacy-act/
- Philippines Data Privacy Act Implementing Rules: https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/
- EU GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679