1Who we are
Venturial Studio LLC ("Venturial", "we", "us") is a venture studio operating from Guadalajara, Mexico and Miami, Florida. We build and operate software products, including Venturial Studio, a platform that helps founding teams manage their organization, fundraising, and marketing.
Venturial is the data controller for the personal data described in this policy. Where we process data on behalf of a customer organization using our platform, we act as a data processor under that customer’s instructions.
2What this policy covers
This policy applies to the venturial.io website and blog, the Venturial Studio web application at studio.venturial.io, and its supporting APIs.
It does not cover third-party services you reach through links from our products. Those services operate under their own privacy policies.
3Information we collect
We collect only what a given feature needs to work:
- Account data: name, email address, profile picture and authentication identifiers, provided when you sign up or sign in through our identity provider.
- Organization data: the workspaces, team members, roles, projects and documents you create inside the platform.
- Business content: investor records, cap table entries, data room documents and campaign material you choose to store with us.
- Connected platform data: described in the next section.
- Technical data: IP address, browser and device type, pages viewed and timestamps, collected through server logs and our error and performance monitoring.
- Communications: messages you send us through contact forms or email.
4Facebook and Instagram data
Venturial Studio includes an optional social content manager. If, and only if, you choose to connect a Meta account, we request your permission through Facebook Login and then access a limited set of data on your behalf.
We never post, comment or send messages without an explicit action taken by a user in your organization, and we never use this data for advertising or sell it to anyone.
- Facebook Pages you manage: page id, name and the access token that lets us act on that page.
- Instagram business accounts linked to those pages: account id, username and profile picture.
- Content you publish through us: captions, images, scheduling data and publication results.
- Public interactions on that content: comments and mentions, including the commenter’s public name and id, so they can be shown and answered in your inbox.
- Access tokens are encrypted at rest and are used exclusively to carry out actions you request.
5How we use information
We use personal data to:
- Provide, operate and secure the products you signed up for.
- Authenticate you and enforce the permissions your organization has assigned.
- Publish, schedule and report on content you create, to the accounts you connected.
- Answer support requests and communicate about service changes.
- Detect abuse, debug failures and monitor availability and performance.
- Meet legal, tax and accounting obligations.
6Artificial intelligence processing
Some features generate or suggest content using third-party AI providers. When you use them, the prompt (which may include your brand profile, campaign brief or the text of an interaction you asked us to draft a reply to) is sent to the selected provider to produce a result.
We choose providers that do not train their models on data submitted through their business APIs. You can avoid this processing entirely by not using the AI features.
- Text generation: Anthropic or OpenAI, selectable by your platform administrator.
- Image generation: FAL.AI or OpenAI, selectable by your platform administrator.
7Legal bases for processing
Where the GDPR or comparable laws apply, we rely on: performance of a contract, to deliver the service you asked for; legitimate interests, to secure our systems and improve the product; consent, for optional integrations such as connecting a Meta account, which you can withdraw at any time; and legal obligation, for records we are required to keep.
8Who we share data with
We do not sell personal data and we do not share it for advertising. We use a small set of vendors that process data on our behalf under contract:
- Amazon Web Services: application hosting, databases and file storage.
- Backblaze B2: encrypted document storage for data room files.
- Auth0 by Okta: authentication and session management.
- Meta Platforms: only when you connect a Facebook or Instagram account, and only for the actions you request.
- Anthropic, OpenAI and FAL.AI: AI generation, as described above.
- Stripe: subscription billing and payment processing. We never see or store your full card number.
- New Relic: application logging, error tracking and uptime monitoring.
- Google (Analytics and Ads): website measurement, always; advertising performance and personalisation, only if you accept advertising cookies.
- Cloudflare: bot protection on the site chat, so automated traffic cannot abuse it.
9How long we keep data
We keep account and organization data for as long as your account is active. When you delete a connected social account, its access tokens and stored credentials are removed immediately.
After an account is closed, we delete or irreversibly anonymize personal data within 30 days, except where we are legally required to retain records: invoices and tax documents, typically for the period your jurisdiction requires. Backups are purged on their normal rotation, within 90 days at most.
10Security
Data is encrypted in transit with TLS and at rest. Secrets and third-party access tokens are stored encrypted with keys held separately from the database. Access to production systems is restricted to the engineers who need it and is logged.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the applicable regulator as required by law.
11Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive a portable copy, and withdraw consent you previously gave.
To exercise any of these, email us from the address on your account. We respond within 30 days. You also have the right to complain to your local data protection authority.
12Deleting your data
You can disconnect a social account at any time from the platform, which deletes its tokens and stored content on our side. For full account deletion, follow the step-by-step instructions on our data deletion page at venturial.io/data-deletion.
13Cookies and similar technologies
We use cookies and local browser storage that are strictly necessary to keep you signed in, remember your language preference, remember your cookie choice, and protect against request forgery. These are always on, because the site cannot work without them.
We use Google Analytics to measure site traffic: which pages get read and where people arrive from. That measurement is on from the moment you land. Google’s advertising cookies are a separate thing and those do wait for your decision: they load in a denied state, store no identifiers, and we ask before that changes. Declining leaves the site working exactly as it does now, and you can change your mind by clearing this site’s storage in your browser.
- Strictly necessary: session, language preference, your cookie choice, request-forgery protection.
- Measurement (always on): Google Analytics, to see which pages and campaigns bring people here.
- Advertising (only with consent): Google Ads, to measure which ads lead to an enquiry and to personalise them.
14International transfers
We operate from Mexico and the United States, and our infrastructure and vendors are primarily located in the United States. If you are in the European Economic Area, the United Kingdom or another region with transfer restrictions, we rely on Standard Contractual Clauses or an equivalent safeguard with each vendor.
15Children
Our products are business tools and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
16Changes to this policy
We may update this policy as the product evolves. The date at the top of this page always reflects the current version. For material changes we will notify account holders by email or through an in-product notice before the change takes effect.