Plain answers to the questions people ask most about how Ventra handles data, who can see what, and where our responsibilities end and yours begin.

You do. Your leads, clients, quotations, projects, milestones, invoices, messages, and files are yours. We hold a limited licence to store, transmit, display, and back that content up solely to run the Service for you. That licence ends when the content is deleted.

Both, depending on the data.

• Account data — your name, email, company details, team member accounts, billing records. We are the controller.
• Workspace data — the leads and clients you capture, and everything attached to them. You are the controller. We process it on your instructions.

In practice this means your own privacy notice, not ours, is what the person filling in your website form should be reading.

No. We do not sell personal information and we do not share workspace content with advertisers. Ventra uses no advertising or cross-site tracking cookies.

No. We do not use the content of your workspace to train machine learning models. AI features appear on our roadmap; if any ship, we will update the Privacy Policy and give notice before the processing begins.

No. Workspaces are isolated from one another. No customer can see another customer's leads, clients, projects, or messages, and we do not aggregate data across workspaces.

Access to production systems is restricted to staff who need it. In practice that means diagnosing a fault or acting on a support request you have raised. We do not browse workspace content for any other reason.

Four routes: a connected website form, a custom webhook, the API, or manual entry by someone on your team. When a form is submitted, your site sends a POST request with a JSON payload to a Ventra endpoint, the request is validated against a token issued to your workspace, and a lead record is created.

Whatever your payload sends. Typically name, email, phone, company, website, service of interest, budget, message, and source — plus any custom fields you define. You control your form, so you control what reaches us.

No. Ventra does not append, enrich, or purchase additional information about a lead from any third-party data source. What your form sends is what Ventra holds.

Custom fields are supported, but the Terms prohibit sending special category data — health, biometric, racial or ethnic origin, political opinions, religious belief, sexual orientation, trade union membership — as well as payment card data, government identity numbers, and credentials. Ventra is not designed to hold that material.

Rotate it immediately, and contact [support@oo-technologies.com] if you think it was used. Treat the token as a secret: never embed it in client-side code, a public repository, or anything a third party can read.

Disconnect the webhook or rotate its token. Requests that fail validation are rejected and no lead is created.

Ventra converts the lead into a client, creates a client portal account, generates sign-in credentials, and emails a welcome message with the login details to the address held on the lead record. The client can then access their dashboard immediately.

It is worth understanding, which is why we state it plainly rather than burying it. Anyone with access to that mailbox can use the credentials. We recommend the account holder changes the generated password at first sign-in, and that you verify the email address on a lead record before sending a quotation to it.

That depends on your jurisdiction, and it is your call, not ours. The account is created on your instruction, so the obligation to have a lawful basis and to give any required notice sits with you as the controller. If you are unsure, take advice before you enable the workflow.

Their own projects and milestones, their quotations and invoices with downloads, their files, and their chat threads. They can approve or reject a milestone and leave feedback, upload files, track progress, and receive notifications. They cannot see another client's data at any point.

Revoke the portal account from your workspace. Doing that promptly at the end of an engagement is your responsibility under the Terms.

Six, with permissions scoped by role and by project assignment.

No. Chat is project-scoped. A client can message your administrators and the teams assigned to that client's projects. They cannot see or message the rest of your staff.

If the exposure follows from a role or project assignment you made, that is on you — the Terms are explicit about it. Grant the minimum access each person's work requires, review it periodically, and remove it when someone leaves or an engagement ends. If you believe the platform itself enforced permissions incorrectly, tell us at [support@oo-technologies.com] and we will investigate.

No. Ventra generates and delivers invoices but does not process payments. We are not a payment processor, money transmitter, escrow agent, or payment facilitator, and we never collect, hold, or transfer funds. No card number is ever entered into Ventra. Payment collection appears on our roadmap; nothing is live today.

It records your assertion that payment was received. It is a label you set, not confirmation from a bank or processor, and it is not evidence of settlement.

It applies the rate you type and does the arithmetic. It does not determine correct rates, verify tax registration numbers, apply place-of-supply rules, or assess whether a rate is right for a jurisdiction or a transaction. Getting the rate right is your responsibility.

We cannot warrant that it will. Numbering sequences, mandatory content, currency, language, e-invoicing mandates, archival format, and retention periods vary by jurisdiction. Confirm with your accountant that a Ventra-generated document meets your obligations before you rely on it.

Ventra records that the approval link was clicked and converts the lead to a client. Whether that click forms a binding contract is determined by your agreement with your client and by applicable law, not by us. The same goes for milestone sign-off: we log the action, we do not determine whether work met contract.

No. We have no contractual relationship with your clients and we do not arbitrate between you. The approval and feedback log in Ventra is available to you as evidence of what happened inside the platform, and that is the extent of our involvement.

• TLS on all traffic between your browser and Ventra.
• Passwords stored as one-way hashes — never in plain text, never recoverable.
• Role-based access control checked on every request.
• Protected sessions, invalidated on sign-out.
• Token validation on inbound webhooks.
• Authenticated API endpoints enforcing the same permission rules as the interface.
• Hosting on [Hostinger] infrastructure in [Global].

No, and that is by design. Passwords are hashed one way, so nobody at Ventra can read yours. A lost password can only be reset.

If we become aware of a breach affecting personal information we hold, we will notify you and, where required, the relevant supervisory authority, within the timeframe applicable law sets. No system is completely secure, and we do not claim otherwise.

Not without our prior written permission — the Terms prohibit unauthorised probing, scanning, and vulnerability testing. Write to [support@oo-technologies.com] to arrange scope in advance. If you have found something already, tell us and we will look at it.

A self-service bulk export is on the roadmap but is not available today. Until it ships, email [privacy@oo-technologies.com] and we will provide a copy of your workspace data.

It is removed from active systems immediately, and disappears from encrypted backups as the [30 days]-day window cycles. It is not recoverable after that.

Your workspace stays retrievable on request for [10 days] days after termination, and we hold a [10 days]-day grace period so an accidental closure can be reversed. After that the data is removed from active systems and cycles out of backups. Records we are legally required to keep, mainly billing and tax records, survive for the period the law specifies.

Export anything you need before you close the account.

Cancel at any time. Cancellation takes effect at the end of the current billing period and you keep access until then. Fees already paid are not refunded except where law requires.

Not without notice. A price change applies from your next renewal and we give advance notice before it does. If you do not accept it, cancel before that renewal.

For a security risk, a breach of the acceptable use rules, unlawful activity, non-payment after the notice period, or a legal requirement. Where practical we notify you first, and we restore access once the cause is resolved.

Using Ventra to serve your own clients is exactly what it is for, and giving them portal access is part of the product. Reselling, sublicensing, or white-labelling access to Ventra itself as a standalone product is not permitted. If you want a reseller arrangement, talk to us at [legal@oo-technologies.com].

Please don't. Roadmap items — AI features, time tracking, Kanban boards, calendar sync, payment collection, automation builders, third-party integrations, mobile apps, analytics, recurring billing — may change, be delayed, or never ship. Buy on what is live today.

A business you are working with uses Ventra to run client projects. When you approved their quotation, their workspace created a portal account for you so you can see projects, approve milestones, and access your quotations and invoices.

They control it. We store and process it on their instructions. Their privacy notice, not ours, tells you what they collect and why.

Ask the business whose workspace holds it. They can delete records and revoke your account. If you contact us directly we will forward your request to them and tell you we have done so, but we cannot act on it ourselves.

No. A client account only reaches its own projects, milestones, quotations, invoices, files, and chat threads.