Ventra holds your business data and your clients' data in one workspace. Every lead you capture, every quotation you send, and every project you run passes through it. We treat that as a responsibility, and this policy sets out exactly what we hold and why.

Who controls which data

Ventra handles two distinct categories of information, and our responsibilities differ between them. This distinction matters if you are assessing Ventra against a data protection obligation of your own.

Information Ventra collects

Account information you provide

• Identity and sign-in — name, display name, email address, and a one-way password hash. Plain-text passwords are never stored.
• Company profile — company name, business details, and company logo. These appear on the quotation and invoice PDFs Ventra generates.
• Profile image — optional, shown in the workspace and in chat.
• Team records — the team members you add, the teams you place them in, and the role assigned to each.
• Support correspondence — messages you send our support team, including attachments.

Workspace content you and your clients create

• Leads — name, email, phone, company, website, service of interest, budget, message, source, and any custom fields your capture form sends.
• Clients — records created when a quotation is approved, plus the client portal account attached to each.
• Quotations — services, descriptions, quantities, unit prices, discounts, taxes, notes, and terms and conditions.
• Projects — title, description, associated client, start date, deadline, status, priority, budget, notes, and attachments.
• Milestones — title, description, due date, assigned team, status, and the internal and client approval record, including any feedback left on a rejection.
• Invoices — invoice number, due date, line items, taxes, discounts, notes, and payment status.
• Messages and files — chat between your team, your clients, and your administrators, plus files uploaded to a project by either side.

Information collected automatically

• Log data — IP address, browser and device type, requested pages, timestamps, and referring URL.
• Usage data — which features are opened and how often, used to diagnose faults and prioritise development.
• Cookies — a session cookie that keeps you signed in and a CSRF token cookie that protects form submissions. Ventra does not use advertising or cross-site tracking cookies.

Lead capture and webhooks

Leads reach Ventra through four routes: a connected website form, a custom webhook, the API, or manual entry by a member of your team.

When you connect your website, your form sends a POST request with a JSON payload to a Ventra endpoint. That request is authenticated with a secure token issued to your workspace and validated before a lead record is created. Requests that fail token validation are rejected.

• Ventra stores whatever fields your payload sends, including any custom fields you define. You decide what your form asks for, so you decide what Ventra receives.
• Ventra does not enrich, append, or purchase additional information about a lead from any third-party data source.
• Ventra does not use one customer's lead data to benefit another customer, and does not aggregate lead data across workspaces.

Client portal accounts

When a lead approves a quotation, Ventra converts that lead into a client, creates a client portal account, generates sign-in credentials, and emails a welcome message with the login details to the address held on the lead record.

Two consequences of that automation are worth stating plainly.

• Credentials are delivered by email. Anyone with access to that mailbox can use them. We recommend the account holder changes the generated password at first sign-in.
• Account creation is triggered by your workflow, not by the client. The client does not separately register. If your jurisdiction requires consent or notice before creating an account on someone's behalf, that obligation sits with you as the controller.

Inside the portal, a client can view and download their quotations and invoices, view projects and milestones, approve or reject a milestone and leave feedback on it, upload files, track progress, receive notifications, and use chat.

Why Ventra collects data

We use the information described above for the following purposes, and no others.

• Running the platform — storing and displaying your workspace, generating quotation and invoice PDFs, delivering quotations and approval links, and routing chat messages.
• Notifications — alerting the relevant people when a lead arrives, a quotation is sent or approved, a client is created, a project is assigned, a milestone is created, approved, or rejected, an invoice is sent, a chat message arrives, or a project is updated.
• Dashboard and search — producing your lead statistics, revenue figures, pending milestones, upcoming deadlines, and team performance views, and returning results from global search.
• Maintenance and improvement — diagnosing errors, measuring performance, and identifying which parts of the product need work.
• Security — validating webhook requests, protecting API endpoints, enforcing role permissions, and investigating suspicious sign-in activity.
• Service communication — account notices and security alerts. These are operational and cannot be switched off while your account is active. Marketing email, if we send any, is opt-in and separately unsubscribable.
• Legal obligations — retaining records where tax, accounting, or other applicable law requires it.

Ventra does not sell personal information. Ventra does not share workspace content with advertisers. Ventra does not use the content of your workspace to train machine learning models.

Who can see what inside Ventra

Access inside a workspace is governed by role and by project assignment, not by seniority alone. Six roles are supported.

Chat access follows the same principle. Administrators can message clients, team members, and project managers. A client can message administrators and only the teams assigned to that client's projects. A client cannot see or message the rest of your staff, and cannot see another client's data at any point.

Workspaces are isolated from one another. No customer of Ventra can see another customer's leads, clients, projects, or messages.

Your privacy controls

• Access and correction — view and edit your profile, company details, and any lead, client, quotation, project, milestone, or invoice record directly in the workspace.
• Deletion within the workspace — delete individual records you no longer need, at any time.
• Access control — change a team member's role, move them between teams, or remove their access to a project.
• Webhook control — stop new leads reaching Ventra at any time by disconnecting the webhook or rotating its token.
• Client access — revoke a client portal account when an engagement ends.

Depending on where you live, you may also have the right to obtain a copy of your personal information, object to or restrict its processing, or complain to a supervisory authority. Requests of that kind can be sent to the contact address below and we will respond within the period applicable law allows.

Sharing your information

Ventra discloses information outside your workspace only in these circumstances.

• On your instruction — sending a quotation and its PDF to a lead, emailing an invoice to a client, issuing portal credentials, or delivering a notification you configured.
• To service providers — hosting with [Hosting provider] and transactional email delivery through [Email delivery provider]. These providers process data on our instructions under contract and may not use it for their own purposes.
• For legal reasons — where applicable law requires disclosure, or where it is necessary to investigate fraud or prevent imminent harm. Where we are permitted to notify you first, we will.
• In a business transfer — if [OO Technologies — registered legal name] is involved in a merger, acquisition, or asset sale, we will give notice before your information becomes subject to a different privacy policy.

The current subprocessor list is maintained on the Subprocessors page and is updated when a provider is added or replaced.

Keeping your information secure

• Encryption in transit — all traffic between your browser and Ventra is served over TLS.
• Password storage — passwords are stored as one-way hashes. Nobody at Ventra can read your password, and a lost password can only be reset, never recovered.
• Role-based access control — every request is checked against the acting user's role and project assignment before data is returned.
• Session security — authenticated sessions are protected and invalidated on sign-out.
• Webhook validation — inbound lead requests must carry a valid workspace token and pass payload validation.
• Protected API — API endpoints require authentication and enforce the same permission rules as the interface.
• Hosting — Ventra runs on [Hosting provider] infrastructure in [Data centre region].

Retaining your information

Retention depends on the type of record.

Where you delete a record inside the workspace, it is removed from active systems immediately and disappears from backups as the window above cycles.

Deleting your information

You can delete individual leads, clients, projects, milestones, quotations, invoices, and files from within the workspace at any time.

To close your account entirely, contact us at the address below. On closure we remove your workspace from active systems after a [10 days]-day grace period, which exists so an accidental or disputed closure can be reversed. After that period the data is removed from active systems and is cycled out of encrypted backups within the window shown above, after which it is unrecoverable.

Records we are legally required to keep, principally billing and tax records, survive account closure for the period the relevant law specifies and are then deleted.

Compliance & cooperation with regulators

We review this policy against the data protection requirements that apply to [OO Technologies — registered legal name] and to the regions we serve. Where a dispute cannot be resolved directly with you, we cooperate with the appropriate supervisory authority.

If you believe your information has been handled improperly, contact us first so we can investigate. You retain the right to complain to your local data protection authority regardless of the outcome.

Changes to this policy

Ventra is under active development, and this policy changes as the product does. The effective date at the top of the page always reflects the current version.

Where a change materially reduces your rights or introduces a new category of processing, such as payment collection or a third-party integration, we give notice before it takes effect.

Contact us

Questions about this policy, or a request relating to your information: