Privacy Policy
Last updated: 6 October 2026
Version for: International. View the United States version
Summary
- For your own account, website and billing data, Tarida Capital GmbH dba Sunrise is the controller. For business data our clients load into Vervana Pro, the client is the controller and we are its processor.
- We never sell personal data, and never use personal data to train AI models.
- Client data is hosted in Switzerland. Some providers (for example payments, email delivery and this website's hosting) are in the United States; we use safeguards for those transfers.
- We notify clients of a breach affecting their data within 24 hours of becoming aware of it, and return or delete client data within 30 days of termination, as set out in our DPA.
- To use your rights or ask a question, write to support@vervana.pro.
This summary is a convenience. The full policy below is what applies.
1. Who we are
Tarida Capital GmbH dba Sunrise, 16 Spitalmattenweg, 6060 Sarnen, Switzerland ("Vervana", "we", "us") operates Vervana and Vervana Pro, including this website (go.vervana.pro), Observer, Sandbox and the Vervana Pro platform. Contact for all privacy matters: support@vervana.pro
This version applies to customers and visitors outside the United States. Customers in the United States are served by Sunrise Platform, Inc. (see the US privacy policy).
Data protection officer. We have not appointed a data protection officer because we do not consider one to be required under Article 37 GDPR. The contact above handles privacy requests.
2. Our role: controller and processor
Account, website and billing data. For information about you as a visitor, account holder or customer contact (for example name, email, company, billing details, support messages and website usage), Vervana is the controller.
Client business data in Vervana Pro. For business data our clients load or connect into Vervana Pro (which may include personal data of the client's own customers, staff or counterparties), the client is the controller and Vervana is the processor under Article 28 of the GDPR and the Swiss Federal Act on Data Protection (FADP). That processing is governed by our Data Processing Agreement (DPA), which is authoritative for processing and is available on request at support@vervana.pro. If a client has signed an Order Form and agreement with us, those signed documents control over this policy and our website Terms for that client's data. We process it only on the client's documented instructions.
If your data is in Vervana Pro because one of our clients loaded it, please contact that client first. We will help the client respond to your request.
3. Information we collect
As controller we collect the following categories.
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact | Name, work email, company, role; Observer access or invitation requests | You, or the person or organization that invited you |
| Billing | Billing name and address, plan, payment status. Card details are handled by Stripe; we do not receive or store full card numbers. | You; Stripe |
| Website and technical usage | IP address, request logs, browser and device data created when you connect to our hosting providers | Your browser |
| Content you enter in free tools | Store names, addresses or map selections in the market analysis tools; questions typed into the demo chat (please do not enter personal, confidential or sensitive information into the demo chat) | You |
| Support and communications | Messages you send us, our replies, and records of account notices | You; us |
| Business contacts from client systems | Names, business emails, order, document, calendar or activity data about people at our clients' customers, suppliers and staff, loaded or connected by the client (we are the processor) | Our clients; connected tools such as Google Workspace or Microsoft 365 |
We do not knowingly collect special categories of personal data (GDPR Article 9) for our own purposes. We do not ask for it; a client may include such data in its own business data, which we process only on its instructions.
Where it comes from when not from you. Business contact data and business activity data in Vervana Pro come from our clients' own systems and from tools a client connects (such as Google Workspace, Microsoft 365, ERP and accounting systems), and may be supplemented by public map and demographic sources. In that case the client is the controller and is responsible for informing the people concerned; we make this notice available so the client can rely on it.
4. How we use information and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide and operate the services, create and manage your account, support you | Performance of a contract (6(1)(b)); steps before a contract |
| Process payments and keep billing and accounting records | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Secure the services, prevent abuse, debug and keep logs | Our legitimate interests in security and reliable service (6(1)(f)) |
| Generate insights and recommendations for you; improve our services using aggregated, anonymized data | Contract (6(1)(b)); our legitimate interests in improving the product (6(1)(f)) |
| Communicate about your account, access and service changes | Contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Comply with law and respond to lawful requests | Legal obligation (6(1)(c)) |
| Any optional use we ask you about separately | Consent (6(1)(a)), which you can withdraw at any time |
Where we rely on legitimate interests we have weighed them against your rights and interests; you may object (see Your rights). The Swiss FADP does not require a legal basis for ordinary processing; we apply the same principles of lawfulness, good faith, proportionality and purpose limitation.
What we do not do. We do not sell or rent personal data. We do not use personal data to train models for our own or any third party's benefit, and we do not build cross-client datasets that contain personal data. Aggregated and anonymized derived data that cannot identify any individual or any client may be used solely to improve our services (for example Observer market insights).
Emails. The emails we send (sign-in links, invitations, account and service notices) are service emails. If we ever send marketing emails, we will do so only where the law allows or with your consent, and include an unsubscribe link and our postal address, and honor opt-outs promptly.
Is providing data required? You are not obliged to give us personal data, but we cannot create an account, provide the services or take payment without the account and billing data described above. Data in Vervana Pro is provided by the client under its own legal basis.
5. Automated decisions and AI
We use AI models to generate insights, recommendations and answers. Inside the Vervana Pro platform, AI processing for this version runs with Infomaniak Network SA in Switzerland. The demo chat on this website (go.vervana.pro) is hosted on Vercel in the United States and sends what you type to the Google Gemini API provided by Google LLC in the United States, for all visitors. We do not make decisions about individuals that have legal or similarly significant effects through solely automated processing or profiling. Recommendations are reviewed and acted on by people. We do not use personal data to train models, and we do not permit our AI providers to do so on our behalf.
6. Google and Microsoft 365 user data
Vervana Pro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If a client chooses to connect Google (Google Workspace / Google APIs), we may access email (Gmail), files (Drive), calendar (Calendar) and Drive activity data. We access it only to provide the features the client has enabled in Vervana Pro, such as surfacing relevant documents, orders, meetings and activity inside the client's workspace. Content may be processed by the AI service described above only to provide those features to that client. The same principles apply to data received from Microsoft 365 when a client connects it.
- We do not use this data for advertising, including retargeting or interest-based advertising.
- We do not sell this data or transfer it to third parties except as needed to provide the enabled features, to comply with law, or as part of a merger or sale where the recipient is bound by the same limits.
- Our people do not read it, except with your consent, for security purposes (such as investigating abuse), where required by law, or for internal operations where the data is aggregated and anonymized.
- We do not use it to develop, improve or train generalized AI or machine-learning models.
- Access tokens are stored encrypted and scoped to the individual client tenant.
- You can revoke Vervana Pro's access at any time in your Google Account permissions or Microsoft account settings. You can also write to support@vervana.pro and ask us to delete data we obtained through the integration. Data in Vervana Pro is returned or deleted within 30 days of termination, as set out in the DPA, and backups roll off within 35 days.
7. Who we share information with
We share personal data only with providers that help us operate the services, under written agreements, and where required by law. We do not sell it.
- Microsoft Corporation (Azure, Switzerland North): hosting of the platform and client data, and database
- Microsoft Corporation (Azure Communication Services): email delivery from the Vervana Pro platform
- ZITADEL AG: identity and sign-in
- Stripe, Inc.: payments (independent controller where applicable)
- Google LLC: Google Workspace and Google APIs when a client connects Google; the Gemini API for the demo chat on this website
- Infomaniak Network SA (Switzerland): AI processing in the Vervana Pro platform
- Cloudflare, Inc.: DNS, CDN and security
- GitHub, Inc.: code hosting (no client data)
- Vercel Inc.: hosting of the marketing website go.vervana.pro (visitor and website data only, not client platform data)
- Resend (United States): delivery of sign-in and invitation emails sent from this website
Clients' signed DPA contains the sub-processor list that applies to their data. The free market analysis tools also request public map and demographic data from OpenStreetMap (including geocoding of addresses you enter) and the US Census Reporter service; your browser loads map tiles from OpenStreetMap.
We may also disclose information to professional advisers, to authorities where legally required, and in connection with a merger, financing or sale of the business, in which case the recipient must honor this policy.
8. Hosting and international transfers
Client data in Vervana Pro is hosted in Switzerland (Microsoft Azure, Switzerland North). Switzerland is recognized by the EU as providing adequate protection.
Some providers process data in the United States: Vercel Inc. (hosting of this website, so visitor and website data, including what you type into the demo chat), Google LLC (Gemini API for the demo chat, and Google Workspace APIs if a client connects them), Resend (sign-in and invitation emails, so your email address), Stripe, Inc. (payments) and Cloudflare, Inc. (DNS, CDN, security).
For transfers to the United States we rely on the EU-US and Swiss-US Data Privacy Frameworks where the recipient is certified and, otherwise, on the EU Standard Contractual Clauses with the Swiss addendum (and, where applicable, the UK addendum) in the provider's data processing terms. You can request information about the safeguards, or a copy, at support@vervana.pro.
9. How long we keep information
| Category | Retention |
|---|---|
| Account data | For the life of your account, then deleted or anonymized, except records we must keep by law (see billing) |
| Client data in Vervana Pro | Returned or deleted within 30 days of termination, as set out in the DPA. Backups roll off within 35 days. |
| Billing and tax records | Kept only as long as tax and commercial-records law requires, up to 10 years (Swiss Code of Obligations Art. 958f) |
| Website and security logs | No longer than 12 months, then deleted or anonymized |
| Support and communications | For the life of the account plus no more than 24 months, then deleted |
These are maximum periods. Where there is no legal need to keep data we delete it sooner.
10. Data security
We apply technical and organizational measures including role-based access control with least privilege, multi-factor authentication, TLS encryption in transit, encryption at rest, tenant isolation with row-level security, logging of privileged actions, and an incident response process. We notify clients of a personal data breach affecting their data within 24 hours of becoming aware of it. No system is perfectly secure.
11. Cookies, local storage and tracking signals
We do not add advertising or analytics cookies or third-party analytics or tracking scripts to this website, so we do not show a cookie banner. Some tools store small items in your browser (session storage or local storage), for example to remember that a page was unlocked or to count demo chat usage; these stay on your device. When you pay, Stripe Checkout, a page hosted by Stripe, may set its own cookies under its own policy. Our hosting and security providers (Vercel and Cloudflare) process technical data such as your IP address and keep request logs to deliver and protect the site, as described above.
Because we do not sell or share personal data or track you across sites, there is nothing to opt out of; we treat Global Privacy Control signals and Do Not Track requests accordingly (that is, we honor them because we do not track).
12. Your rights
Under the GDPR and the Swiss FADP you have the right to: be informed; access your data; have it corrected; have it erased; restrict processing; receive it in a portable format; object to processing based on legitimate interests; and withdraw consent at any time (without affecting earlier processing). Write to support@vervana.pro; we will respond within one month (extendable where the law allows), and may ask you to verify your identity. Rights are free of charge unless requests are manifestly unfounded or excessive.
You have the right to lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the data protection authority in your EU country of residence, workplace or where an issue occurred. We would appreciate the chance to resolve your concern first.
If your data is in Vervana Pro because one of our clients loaded it, please contact that client first as it is the controller; we will assist it in responding.
13. Business-to-business context
Our services are for businesses. Information about individuals acting on behalf of a business, such as work contact details, is handled as described in this policy.
14. Children
Our services are not directed to children under 16. If you believe a child has given us personal information, write to support@vervana.pro and we will delete it.
15. Changes to this policy
We will update this page when our practices change and revise the "Last updated" date above. For material changes we will give clients reasonable advance notice by email or in the product.
16. Contact
Tarida Capital GmbH dba Sunrise, 16 Spitalmattenweg, 6060 Sarnen, Switzerland. Questions about this policy or your rights? Contact us at support@vervana.pro