Summary

For your own account, website and billing data, Sunrise Platform, Inc. is the controller. For business data our clients load into Vervana Pro, the client is the controller and we are its processor.
We never sell personal data, never share it for cross-context behavioral advertising, and never use personal data to train AI models.
Client data is hosted in United States. AI processing for US clients uses the Google Gemini API.
We notify clients of a breach affecting their data within 24 hours of becoming aware of it, and return or delete client data within 30 days of termination, as set out in our DPA.
To use your rights or ask a question, write to support@vervana.pro.

This summary is a convenience. The full policy below is what applies.

1. Who we are

Sunrise Platform, Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, USA ("Vervana", "we", "us") operates Vervana and Vervana Pro, including this website (go.vervana.pro), Observer, Sandbox and the Vervana Pro platform. Contact for all privacy matters: support@vervana.pro

2. Our role: controller and processor

Account, website and billing data. For information about you as a visitor, account holder or customer contact (for example name, email, company, billing details, support messages and website usage), Vervana is the controller.

Client business data in Vervana Pro. For business data our clients load or connect into Vervana Pro (which may include personal data of the client's own customers, staff or counterparties), the client is the controller and Vervana is the processor (a "service provider" or "processor" under applicable US state privacy laws). That processing is governed by our Data Processing Agreement (DPA), which is authoritative for processing and is available on request at support@vervana.pro. If a client has signed an Order Form and agreement with us, those signed documents control over this policy and our website Terms for that client's data. We process it only on the client's documented instructions.

If your data is in Vervana Pro because one of our clients loaded it, please contact that client first. We will help the client respond to your request.

3. Information we collect

In the past 12 months, as a business we have collected the following categories of personal information.

Category	Examples	Where it comes from
Account and contact	Name, work email, company, role; Observer access or invitation requests	You, or the person or organization that invited you
Billing	Billing name and address, plan, payment status. Card details are handled by Stripe; we do not receive or store full card numbers.	You; Stripe
Website and technical usage	IP address, request logs, browser and device data created when you connect to our hosting providers	Your browser
Content you enter in free tools	Store names, addresses or map selections in the market analysis tools; questions typed into the demo chat (please do not enter personal, confidential or sensitive information into the demo chat)	You
Support and communications	Messages you send us, our replies, and records of account notices	You; us
Business contacts from client systems	Names, business emails, order, document, calendar or activity data about people at our clients' customers, suppliers and staff, loaded or connected by the client (we are the processor)	Our clients; connected tools such as Google Workspace or Microsoft 365

We do not knowingly collect special categories of personal data or sensitive personal information as defined by California law for our own purposes. We do not ask for it; a client may include such data in its own business data, which we process only on its instructions.

Where it comes from when not from you. Business contact data and business activity data in Vervana Pro come from our clients' own systems and from tools a client connects (such as Google Workspace, Microsoft 365, ERP and accounting systems), and may be supplemented by public sources. The client is responsible for its own notices to those people.

4. How we use information (business purposes)

To provide, secure and support our services and your account
To generate insights and recommendations for you
To process payments and keep billing records
To communicate with you about your account or access
To debug, detect abuse and protect the security of the services
To comply with legal obligations and respond to lawful requests

What we do not do. We do not sell or rent personal data. We do not use personal data to train models for our own or any third party's benefit, and we do not build cross-client datasets that contain personal data. Aggregated and anonymized derived data that cannot identify any individual or any client may be used solely to improve our services (for example Observer market insights).

Emails. The emails we send (sign-in links, invitations, account and service notices) are service emails. If we ever send marketing emails, we will include an unsubscribe link and our postal address, and honor opt-outs promptly.

5. Automated decisions and AI

We use AI models to generate insights, recommendations and answers. Inside the Vervana Pro platform, AI processing for this version runs through the Google Gemini API provided by Google LLC in the United States. The demo chat on this website (go.vervana.pro) is hosted on Vercel in the United States and sends what you type to the Google Gemini API provided by Google LLC in the United States, for all visitors. We do not make decisions about individuals that have legal or similarly significant effects through solely automated processing or profiling. Recommendations are reviewed and acted on by people. We do not use personal data to train models, and we do not permit our AI providers to do so on our behalf.

6. Google and Microsoft 365 user data

Vervana Pro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If a client chooses to connect Google (Google Workspace / Google APIs), we may access email (Gmail), files (Drive), calendar (Calendar) and Drive activity data. We access it only to provide the features the client has enabled in Vervana Pro, such as surfacing relevant documents, orders, meetings and activity inside the client's workspace. Content may be processed by the AI service described above only to provide those features to that client. The same principles apply to data received from Microsoft 365 when a client connects it.

We do not use this data for advertising, including retargeting or interest-based advertising.
We do not sell this data or transfer it to third parties except as needed to provide the enabled features, to comply with law, or as part of a merger or sale where the recipient is bound by the same limits.
Our people do not read it, except with your consent, for security purposes (such as investigating abuse), where required by law, or for internal operations where the data is aggregated and anonymized.
We do not use it to develop, improve or train generalized AI or machine-learning models.
Access tokens are stored encrypted and scoped to the individual client tenant.
You can revoke Vervana Pro's access at any time in your Google Account permissions or Microsoft account settings. You can also write to support@vervana.pro and ask us to delete data we obtained through the integration. Data in Vervana Pro is returned or deleted within 30 days of termination, as set out in the DPA, and backups roll off within 35 days.

7. Who we share information with

We share personal data only with providers that help us operate the services, under written agreements, and where required by law. We do not sell it and we do not share it for cross-context behavioral advertising. In the past 12 months we disclosed the categories above for business purposes only to the service providers and contractors below.

Our hosting provider in the United States: hosting of the platform and US client data, and database (current provider named in the DPA or on request)
Microsoft Corporation (Azure Communication Services): email delivery from the Vervana Pro platform
ZITADEL AG: identity and sign-in
Stripe, Inc.: payments (independent controller where applicable)
Google LLC: Google Workspace and Google APIs when a client connects Google; the Gemini API for the demo chat on this website and for AI processing in the Vervana Pro platform
Cloudflare, Inc.: DNS, CDN and security
GitHub, Inc.: code hosting (no client data)
Vercel Inc.: hosting of the marketing website go.vervana.pro (visitor and website data only, not client platform data)
Resend (United States): delivery of sign-in and invitation emails sent from this website

Clients' signed DPA contains the sub-processor list that applies to their data. The free market analysis tools also request public map and demographic data from OpenStreetMap (including geocoding of addresses you enter) and the US Census Reporter service; your browser loads map tiles from OpenStreetMap.

We may also disclose information to professional advisers, to authorities where legally required, and in connection with a merger, financing or sale of the business, in which case the recipient must honor this policy.

8. Where your data is hosted

US client data is hosted and processed in the United States. Our marketing website (go.vervana.pro) is hosted by Vercel Inc. in the United States.

Sign-in and identity data is processed by ZITADEL AG, which operates its service from Switzerland, so that limited data (such as your name, work email and sign-in events) is processed outside the United States. Switzerland has strong data protection law; you can ask about the safeguards at support@vervana.pro.

9. How long we keep information

Category	Retention
Account data	For the life of your account, then deleted or anonymized, except records we must keep by law (see billing)
Client data in Vervana Pro	Returned or deleted within 30 days of termination, as set out in the DPA. Backups roll off within 35 days.
Billing and tax records	Kept only as long as tax and records law requires, up to 7 years
Website and security logs	No longer than 12 months, then deleted or anonymized
Support and communications	For the life of the account plus no more than 24 months, then deleted

These are maximum periods. Where there is no legal need to keep data we delete it sooner.

10. Data security

We apply technical and organizational measures including role-based access control with least privilege, multi-factor authentication, TLS encryption in transit, encryption at rest, tenant isolation with row-level security, logging of privileged actions, and an incident response process. We notify clients of a personal data breach affecting their data within 24 hours of becoming aware of it. No system is perfectly secure.

11. Cookies, local storage and tracking signals

We do not add advertising or analytics cookies or third-party analytics or tracking scripts to this website, so we do not show a cookie banner. Some tools store small items in your browser (session storage or local storage), for example to remember that a page was unlocked or to count demo chat usage; these stay on your device. When you pay, Stripe Checkout, a page hosted by Stripe, may set its own cookies under its own policy. Our hosting and security providers (Vercel and Cloudflare) process technical data such as your IP address and keep request logs to deliver and protect the site, as described above.

Because we do not sell or share personal data or track you across sites, there is nothing to opt out of; we treat Global Privacy Control signals and Do Not Track requests accordingly (that is, we honor them because we do not track).

12. Your privacy rights (California and other US states)

Depending on where you live, the California Consumer Privacy Act as amended by the CPRA (CCPA), and laws in states such as Virginia, Colorado, Connecticut, Utah and Texas, may give you rights described below. We list these laws as a courtesy and honor the rights below for all US residents regardless of whether a particular statutory threshold applies to us.

Know and access the personal information we hold about you, and the categories, sources, purposes and recipients
Delete personal information we collected from you
Correct inaccurate personal information
Obtain a portable copy
Opt out of sale, sharing and targeted advertising
Limit use of sensitive personal information
Not be discriminated against for exercising these rights

We do not sell or share personal information (as "sell" and "share" are defined by California law), including that of people under 16, and we do not use it for targeted advertising or profiling that produces legal effects. For that reason we do not offer a "Do Not Sell or Share My Personal Information" link: there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes that would give a right to limit.

How to submit a request, verification and authorized agents

Email support@vervana.pro with the subject "Privacy request" stating which right you wish to use. You may also write to Sunrise Platform, Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, USA, marked "Privacy request". Because we operate exclusively online and have a direct relationship with consumers, we accept requests by email and post rather than by a toll-free number.

To protect you, we verify requests by matching the details you give us against the account email we hold, and may ask for more information. We respond within 45 days (extendable once by 45 days where the law allows). An authorized agent may submit a request for you with your written permission; we may verify with you directly.

If your data is in Vervana Pro because a client loaded it, we are that client's service provider: please contact the client, and we will assist it.

Appeals (Virginia, Colorado, Connecticut, Texas and similar states)

If we decline your request you may appeal by emailing support@vervana.pro with the subject "Appeal" within the period your state law provides. We respond in writing within the legally required time (generally 45 to 60 days) and explain the outcome. If the appeal is denied you may contact your state attorney general.

Other California disclosures

Retention periods for each category are in "How long we keep information". We do not currently publish annual CCPA request metrics; if the law requires us to, we will. Under California's "Shine the Light" law you may ask which personal information we shared with third parties for their own direct marketing: we share none. California residents with questions may also contact us at support@vervana.pro.

13. Business-to-business context

Our services are for businesses. Information about individuals acting on behalf of a business, such as work contact details, is handled as described in this policy and, where the law treats it as personal information, under the rights above.

14. Children

Our services are not directed to children under 16, and we do not knowingly collect personal information from children under 13 (COPPA) or sell or share data of anyone under 16. If you believe a child has given us personal information, write to support@vervana.pro and we will delete it.

15. Changes to this policy

We will update this page when our practices change and revise the "Last updated" date above. For material changes we will give clients reasonable advance notice by email or in the product.

16. Contact

Sunrise Platform, Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, USA. Questions about this policy or your rights? Contact us at support@vervana.pro

Privacy Policy