1. Who we are
Ventale is a cloud-based CRM operated from the Philippines ("Ventale", "we", "us"). This Policy explains how we handle personal data when you visit ventale.app, use Ventale, or contact us. It is written to meet the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC).
2. Our role
Our role depends on the data involved:
- Your account and website data. We are the personal information controller. We decide how this data is used, as this Policy explains.
- Data you add about your leads, clients, and contacts. You are the personal information controller, and we are your personal information processor. You decide what goes in and why. Section 7 of our Terms of Service covers this processing.
If a business has added your details to Ventale, please contact that business first about your data. We will refer your request to it and help it respond where needed.
3. Data we collect
- Account data: name, email address, business details, role, login and workspace information, and preferences.
- Workspace data: what you enter, such as leads, clients, contact details, deals, tasks, notes, documents, products, sales, and payment status.
- Billing data: plan, subscription status, and payment records. Card or account details are handled by the payment processor, not stored by Ventale.
- Technical data: IP address, browser and device details, timestamps, login and security logs, usage, and error information.
- Messages: what you send through support, feedback, or the contact form.
4. How we use data and our legal basis
We use personal data for these purposes:
- To provide Ventale and fulfill our contract with you: running accounts and workspaces, processing subscriptions, and giving support.
- For our legitimate interests: keeping the service secure, preventing misuse, fixing errors, improving Ventale, and protecting our legal rights, where these interests are not overridden by your rights.
- To comply with the law: including tax, accounting, and lawful government requests.
- With your consent: such as promotional emails. You can withdraw consent at any time.
We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
6. Service providers and international transfers
We use these providers to run Ventale:
- Google Cloud and Firebase (Google): hosting, database, file storage, and login. The app runs in Google's Singapore region, and Firebase Authentication runs in United States data centers. Other Google services may process data in other locations where Google operates. Google processes this data under its Cloud Data Processing Addendum or Firebase Data Processing and Security Terms.
- Resend: delivering contact form and related emails.
- Payment processor: handling payments, as shown at checkout.
- Google Analytics and Microsoft Clarity: website analytics, when enabled on the website.
This means your data may be transferred outside the Philippines. We remain accountable for personal data we transfer, as the Data Privacy Act requires, and we use contracts and other reasonable means to require comparable protection.
7. How we protect data
We apply reasonable organizational, physical, and technical safeguards, including login controls, workspace separation, role-based access, encrypted connections, and security logging. Google reports independent security evaluations for Firebase services, including ISO 27001 and SOC 1, 2, and 3.
No online service can guarantee complete security or that data will never be lost. Please use a strong password, and keep your own copies of important records.
If a personal data breach occurs that the law requires to be reported, we will notify the NPC and affected individuals within 72 hours of knowing or reasonably believing it occurred, where we are the controller. Where you are the controller, we will notify you without undue delay so that you can meet your own duties.
8. How long we keep data
- Account and workspace data: while your account is active, then for at least 90 days after your trial or subscription ends. We may then delete it, with at least 15 days' notice to your account email.
- Billing and tax records: for as long as tax and accounting laws require.
- Logs and messages: only as long as needed for security, support, or legal claims.
- Backups: copies in provider backups may remain for a limited period before they are overwritten.
9. Your rights
Under the Data Privacy Act, and subject to its limits, you have the right to:
- Be informed about how your personal data is processed.
- Access your personal data.
- Object to processing, and withdraw consent where we rely on it.
- Have inaccurate data corrected.
- Have data erased or blocked, where the law allows.
- Get a copy of your data in a commonly used electronic format, where the law allows.
- Be compensated for damages caused by inaccurate, false, or unlawfully obtained or used data.
- Complain to the National Privacy Commission.
To use these rights, email support@ventale.app. We may need to verify your identity. If other privacy laws apply to you, such as the GDPR, you may have further rights under them, and you can contact us in the same way.
11. Emails from us
We send service messages needed to run your account. We send promotional emails only where the law allows, and you can opt out at any time. Opting out does not stop service messages.
12. Children
Ventale is for business use by people aged 18 or older. We do not knowingly collect personal data directly from children. If you think a child has given us personal data, contact us and we will take appropriate steps.
13. Changes to this Policy
We may update this Policy. The date at the top shows the latest version. For material changes, we will give at least 15 days' notice by email or in the app.
14. Contact us
For privacy questions, data requests, or to reach our Data Protection Officer, email support@ventale.app. We will share our registered business details on request where the law requires it.