Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you apply for or use VennAura, we collect:

• Account information: name, email address, phone number, city/location
• Identity verification: phone number for OTP verification; government ID via Persona (Phase 2)
• Depth profile: the information you share about your intellectual interests, relationship readiness, values, and what you're building toward
• Photos: up to 3 profile photographs
• Tier selection: your membership tier and payment information (processed via Stripe — we do not store card details)
• Communication preferences: your response to introductions, event RSVPs, and feedback on matches

1.2 Information Collected Automatically

• Device type and browser for security purposes
• Access logs for fraud prevention and safety
• App usage patterns (anonymised, Phase 2 only)

1.3 Information We Do Not Collect

VennAura does not collect, infer, or store:

• Sexual orientation or gender identity beyond what you explicitly choose to share
• Political views or religious beliefs
• Precise real-time location tracking
• Biometric data
• Information from your device contacts, microphone, or camera beyond explicit profile photos

2. How We Use Your Information

VennAura uses your information solely to:

• Verify your identity and maintain platform safety
• Curate introductions based on your depth profile
• Communicate with you about introductions, events, and your membership
• Process your membership payments via Stripe
• Improve our curation and resonance scoring (anonymised and aggregated)
• Comply with legal obligations

We never use your information for advertising purposes. We do not have, and will not establish, advertising-based monetisation. VennAura's only revenue is membership fees.

3. Information Sharing

VennAura shares your information only in the following circumstances:

• Introductions: When both parties accept an introduction, limited profile information is shared between the two members. No contact information is shared until mutual acceptance is confirmed.
• Service providers: Stripe (payments), Supabase (database infrastructure), Persona (identity verification, Phase 2), Resend (transactional email), Twilio (OTP verification). All service providers are bound by data processing agreements.
• Legal compliance: We will share information if required by law, court order, or to prevent imminent harm.

We do not sell, rent, or otherwise transfer your personal information to any third party for commercial purposes.

4. Data Retention

• Active account data is retained while your membership is active
• Upon account deletion, all profile data, photos, and match history are deleted within 30 days
• Payment records are retained for 7 years for tax and legal compliance (Stripe processes these)
• Safety incident records may be retained for up to 5 years if relevant to a legal matter
• Anonymised, aggregated usage patterns may be retained indefinitely for product improvement

5. Data Security

VennAura employs industry-standard security measures:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Supabase row-level security — all data access is role-controlled
• Regular security reviews
• Principle of least privilege — team members access only the data necessary for their role

No system is perfectly secure. In the event of a data breach, we will notify affected members within 72 hours of becoming aware, as required by law.

6. Your Rights

6.1 California Residents (CCPA)

California residents have the right to:

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Opt out of the "sale" of personal information (we do not sell your data)
• Non-discrimination for exercising these rights

6.2 EU/UK Residents (GDPR)

EU and UK residents have the right to access, rectification, erasure, restriction, portability, and objection. We process your data on the basis of contract performance and legitimate interest. To exercise your rights: legal@vennaura.com or aura@vennaura.com.

6.3 All Members

• Request a full export of your data
• Correct inaccurate information in your profile
• Delete your account and all associated data
• Withdraw consent where consent is the lawful basis

7. Children's Privacy (COPPA)

VennAura is strictly for users 18 years of age and older. This age requirement is enforced server-side — it is not merely a checkbox. We do not knowingly collect information from anyone under 18. If we become aware that a member is under 18, we will immediately terminate their account and delete all associated data.

8. Cookies and Tracking

VennAura uses only essential cookies required for authentication and security. We do not use advertising cookies, tracking pixels, or third-party analytics that share data with ad networks. We use privacy-respecting analytics (Mixpanel/PostHog configured for anonymisation, Phase 2).

9. Contact

For all privacy-related inquiries:

• Email: legal@vennaura.com
• Safety matters: safety@vennaura.com
• Mailing address: VennAura (Wyoming LLC) — available on request

We respond to all privacy requests within 30 days.

10. Changes to This Policy

We will notify all active members by email of any material changes to this privacy policy at least 30 days before they take effect. Continued use of VennAura after the effective date constitutes acceptance of the updated policy.