Privacy Policy

Section 01Scope of this policy

This policy describes how Venaera Inc. collects, uses, shares, and protects personal information. It covers three distinct situations, and the practices differ meaningfully between them.

The first is your use of this website. The second is information you send us when you request a briefing or otherwise contact us. The third is the telemetry and operational data we process when delivering managed detection and response services to a client organization.

Where a written client agreement addresses a matter covered here, that agreement governs for the services it describes. This policy does not reduce any commitment made in a signed agreement, and nothing in it creates rights beyond those provided by applicable law.

Our role in your data

For information collected through this website and through direct correspondence with us, Venaera acts as the controller of that information. We decide what is collected and why.

For telemetry and operational data processed in the delivery of security services, Venaera acts as a processor on behalf of the client organization. The client determines the scope of data in the engagement, and we process it under the client agreement and on the client's instructions. If you are an employee, customer, or contractor of an organization that uses Venaera and you have a question about data relating to you, direct it to that organization in the first instance. We will support them in responding.

Information we collect

Information you give us

When you submit a briefing request or contact us by email or telephone, we receive the information you choose to provide. Through the briefing form this typically includes your name, work email address, organization, role, sector, approximate data volume, coverage interest, timeline, and the description of what you need to protect.

The briefing form on this site does not transmit data to a server when you submit it. Submitting opens your own email client with the information prefilled and addressed to us, which means nothing leaves your device until you send the message yourself. From that point it is an ordinary email in our mail system.

Information collected automatically

Our web hosting infrastructure processes standard request data when a page is served, including IP address, requested URL, timestamp, referring page where supplied by your browser, and user agent string. This is used for security, abuse prevention, and operational diagnostics, and is retained for a limited period.

Information from third parties

We may receive business contact information through professional referrals, industry introductions, or publicly available business sources. We use it only to make or continue a direct business approach, and we honour any request to stop.

How we use information

We use the information described above for the following purposes, and we do not use it for unrelated ones without telling you first.

To respond to briefing requests, questions, and other correspondence you initiate.
To scope, price, contract, deliver, and support managed detection and response services.
To maintain the security, availability, and integrity of our own systems and this website.
To comply with legal, regulatory, tax, and contractual obligations.
To establish, exercise, or defend legal claims where that becomes necessary.

Where applicable law requires a legal basis for processing, we rely on performance of a contract for service delivery, our legitimate interests in operating and securing our business and in responding to business enquiries, your consent where we have asked for it, and compliance with legal obligations where one applies.

We do not sell personal information. We do not share it for cross context behavioural advertising. We do not use it to build advertising profiles.

Client telemetry

Delivering security monitoring requires access to data that can include personal information: authentication events, device and user identifiers, email metadata, network activity, and file and application access records. The scope is enumerated with the client during onboarding and limited to what detection genuinely requires.

Where a source exposes fields that detection does not need, those fields are excluded at collection rather than collected and ignored. Telemetry is encrypted in transit on every path and encrypted at rest for the duration of retention. Analyst access to client telemetry is role scoped, individually attributed, and logged, and a client can request an access report covering their own environment.

Client telemetry is used to deliver and improve coverage for that client. It is not pooled with other clients for model training without a separate written agreement. Threat indicators derived from an incident may be shared in anonymized form to protect other clients, and a client may decline that in their agreement.

Retention periods for client telemetry are set in the client agreement against investigative needs and regulatory obligations. On termination, integrations are disconnected, credentials issued to us are revoked, and telemetry is deleted on the agreed schedule, with an exportable record of monitoring and incidents provided before access ends.

Cookies and analytics

This website does not set cookies, does not use advertising or analytics trackers, and does not fingerprint visitors. There is no consent banner here because there is nothing to consent to.

The site loads the Inter typeface from Google Fonts. When your browser requests those font files, Google receives the request, which includes your IP address, as it would for any third party resource. No other third party resources are loaded. If you prefer to avoid that request entirely, blocking third party font loading in your browser will cause the site to fall back to a system typeface with no loss of content or function.

We disclose personal information only in the circumstances below.

Service providers. Vendors who process information on our behalf under contract, including infrastructure, email, and business systems providers. They are bound to confidentiality and to process only on our instructions. For client engagements, material subprocessors are disclosed to the client.
At your direction. Where you ask us to share information, or where sharing is an obvious part of the service you requested.
Legal requirement. Where disclosure is required by law, regulation, legal process, or enforceable governmental request. Where we are permitted to notify the affected party, we will.
Protection of rights. Where necessary to investigate or prevent fraud, security incidents, or illegal activity, or to protect the rights, property, or safety of Venaera, our clients, or others.
Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, subject to the recipient honouring commitments materially consistent with this policy.

Retention

Briefing request correspondence is retained for as long as needed to respond and to maintain a record of the business relationship, and thereafter only as required for legal, tax, or audit purposes. Web server request data is retained for a limited operational period and then deleted or aggregated.

Client telemetry is retained for the period set in the applicable client agreement. Records of our own business operations, including contracts and billing, are retained for the periods required by law.

Where we no longer have a purpose or legal requirement for information, we delete it or render it non-identifying.

How we protect information

We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold. These include encryption in transit and at rest, role based access control with individual attribution, separation of engineering access to production systems from analyst access to client telemetry, credential management through a managed secret store, logging and monitoring of our own environment, and review of access rights.

No safeguard eliminates risk entirely. If a security incident affecting personal information occurs, we will notify affected parties and regulators where notification is required, within the timeframes that apply, and we will say what happened rather than what is comfortable.

Your rights and choices

Depending on where you live, you may have the right to request access to the personal information we hold about you, to request correction of inaccurate information, to request deletion, to object to or restrict certain processing, to request portability, and to withdraw consent where processing relies on it. You also have the right not to be discriminated against for exercising these rights.

To make a request, email contact@getvenaera.net. We will verify your request, respond within the period required by applicable law, and explain our decision if we cannot fully comply. An authorized agent may submit a request on your behalf with appropriate proof of authority.

If your request concerns data we process as a service provider for a client organization, we will refer you to that organization and support their response, because they determine the scope and purpose of that processing.

If you are unsatisfied with our handling of a request, you may lodge a complaint with your supervisory authority or applicable regulator. We would prefer you raise it with us first so we have a chance to put it right.

International transfers

Venaera is based in the United States and our systems are operated primarily from the United States. If you contact us or engage our services from another country, your information will be transferred to and processed in the United States, which may have different data protection rules from your own jurisdiction.

Where a transfer requires a lawful mechanism, we rely on appropriate safeguards including standard contractual clauses, together with supplementary technical and organizational measures. Client engagements with data residency requirements are arranged so that collection and retention satisfy those requirements, and the arrangement is documented before any system is connected.

Children

This website and our services are directed to organizations and their personnel, not to children. We do not knowingly collect personal information from anyone under sixteen. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal obligations. The effective date at the top of this page shows when the current version took effect. Where a change materially affects how we handle personal information, we will provide notice appropriate to the circumstances, and for client engagements we will notify the client directly.

How to contact us

For any question, request, or complaint about privacy at Venaera, write to contact@getvenaera.net or call (631) 513-6237. Our postal address is Venaera Inc., 9810 Owensmouth Ave, Ste 3, Chatsworth, CA 91311, United States.