Privacy Policy

Genvision Privacy Policy

Last updated: August 10, 2026

This Privacy Policy explains how Genvision Inc. ("Genvision", "we", "us") collects, uses, shares, and protects personal data when you use our websites, applications, and services that simulate validation checks for carbon credit projects (the "Service").

Contact information

Controller: Genvision Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA. Privacy contact: privacy@genvision.com.

EU establishment. For EU users, processing occurs in the context of our EU establishment, Genvision BV, Petrusberg 22, 3001 Leuven, Belgium.

Scope

This Policy covers personal data we process when you visit our site, create an account, upload project documents, receive reports, or contact support. The Service is for business users and not for children.

1. Data we process

Account and contact data: name, business email, company, role, authentication identifiers (via Clerk), billing contacts.
Project content (Customer Data): documents you upload and the outputs we generate. To make documents searchable within your projects, we also store text excerpts of your documents and vector embeddings derived from them in a search index. Section 6 explains where this index is hosted.
Organization preferences: the Service learns organization-specific preferences such as language, formatting and style. These preference records are Customer Data. They are stored against your organization and used only within your organization.
Service Data (technical and usage): device and browser information, IP address, timestamps, feature usage, performance metrics, error logs, and de-identified statistics. Service Data does not include Customer Data content.
Payments: processed by Stripe. We do not store full payment card details.
Support communications: messages and attachments you send us.
Google Drive integration data (optional): when you connect Google Drive, your Google account email, OAuth access and refresh tokens, and file and folder metadata and contents for files you browse, select, import, or export through the Service.

We do not seek to collect special category data.

2. Purposes and legal bases

Provide the Service, operate accounts, process uploads, generate outputs. Legal basis: performance of a contract.
Security, fraud prevention, service reliability, product quality improvements that do not train or fine-tune LLMs. Legal basis: legitimate interests.
Billing, tax, recordkeeping. Legal basis: legal obligations.
Communications about the Service (operational). Legal basis: legitimate interests/contract.
Marketing communications (optional). Legal basis: consent. You can withdraw consent at any time.
Google Drive integration (optional). Legal basis: performance of a contract and consent when you authorize OAuth access.

3. AI and model usage

We use third-party inference APIs. We do not host, train or fine-tune our own large language models, and we do not train or fine-tune any large language model on Customer Data.

Providers. Our current AI inference and retrieval providers are Google Gemini (via Google Cloud Vertex AI), OpenAI, Anthropic, Perplexity, Novita, Venice, Together AI, Atlas Cloud, and DeepInfra. Each is admitted only on the basis of a no-retention policy for API traffic and is configured or contractually bound not to use Customer Data for training.

This is enforced both contractually and technically. Providers we reach directly are bound by no-retention terms at the account level. For inference served through our model routing layer, the no-data-retention requirement is attached as a parameter to each individual request, and fallbacks to providers outside that arrangement are disabled, so a request cannot be served outside that policy. Content sent for inference is processed for the duration of the request and is not retained by the provider afterward.

Cross-client isolation. Models are stateless per request and are not trained or fine-tuned on your data, so there is no channel through which one customer's content or learned preferences can influence another customer's output. We do not create models that memorize or reproduce your confidential content for other users.

Open-internet research. Where the Service draws on public web or scientific literature sources, the content needed for that request is sent to an external provider under the same no-training and no-retention arrangements. Nothing from your documents is published to or indexed on the open internet. The research step reads public sources only.

Access by Genvision personnel. Our personnel access Customer Data on a need-to-know basis in order to provide and support the Service. This includes configuring the platform for your use case, investigating issues, and reviewing specific runs to confirm that results are correct for your account. Anything learned from this support access is applied only within your own organization's account, for example as improved rules or configuration for your projects. It is not used to change how the Service behaves for other customers.

This access is necessary to provide and support the Service and is carried out on your organization's instructions under the Data Processing Agreement. It is subject to the confidentiality, role-based access, and logging controls described in Section 9. Because it forms part of delivering the Service to your organization, it cannot be switched off while an account is active. If your organization wishes to limit or change how we support your account, it should contact us at privacy@genvision.com.

De-identified Service Data. We may use de-identified and aggregated Service Data, which contains no Customer Data content, for reliability, security and product quality.

4. Google Drive integration

When you choose to connect your Google Drive account to the Service, we use Google's OAuth 2.0 authorization to access Google Drive on your behalf. You control this connection and can disconnect it at any time from Settings, then Integrations, in the Service.

What we access. With your authorization, we may access:

your Google account email address;
OAuth access and refresh tokens needed to maintain the connection;
file and folder metadata (such as names, IDs, MIME types, and modification dates) for files and folders you browse or select;
file contents that you import into the Service, export from the Service, or that the Service processes at your direction, for example to populate a project data room or generate documents.

How we use it. We use this access to:

browse and let you select files and folders from your Google Drive, including shared drives where you have access;
import documents you select into your projects;
export or save documents generated by the Service back to Google Drive when you request it;
display previews of connected files within the Service.

Limits.

We access Google Drive only after you authorize the connection and initiate actions that require it.
We do not use Google Drive data to train or fine-tune AI models.
OAuth tokens are stored securely and used only to provide the integration. When you disconnect Google Drive, we revoke and delete stored tokens associated with that connection. You can also revoke access at any time from your Google Account permissions page.

Genvision's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Sharing and subprocessors

We share personal data with service providers that process it for us ("subprocessors") under data protection agreements and with appropriate transfer safeguards. We impose data protection terms on all subprocessors and remain responsible for their performance. Our current subprocessors are:

Amazon Web Services. Cloud infrastructure and storage. EU regions eu-central-1 (Frankfurt) and eu-north-1 (Stockholm).
Vercel. Application hosting and edge delivery. EU and global edge.
Cloudflare. Security and edge services. Global.
Stripe. Payments. United States and EU.
Clerk. Authentication and user management. United States and EU.
Google Workspace. Email and notifications. EU and United States.
Google Drive API (Google LLC). Optional user-authorized file import and export integration.
Pinecone. Vector search index powering document retrieval. Hosted on AWS in the United States. Stores document text excerpts and embeddings, under a data processing agreement with Standard Contractual Clauses.
OpenAI. AI inference API. Vendor-provided regions.
Perplexity. AI retrieval and inference API. Vendor-provided regions.
Google Cloud Platform (Vertex AI). AI inference for Gemini models, and cloud infrastructure. Vendor-provided regions.
Anthropic. AI inference API for document and spreadsheet editing. Vendor-provided regions.
OpenRouter. Model routing layer used to reach the model serving hosts listed below. Vendor-provided regions.
Novita, Together AI, Venice, Atlas Cloud, DeepInfra. Approved model serving hosts reached via OpenRouter, each admitted on the basis of a no-retention policy for API traffic and bound per request by a no-data-collection requirement with fallbacks disabled.

A current list is maintained in our Terms and DPA, Annex C. We also share data where required by law, or in connection with a reorganization or sale of our business.

Changes to subprocessors. We maintain an online subprocessor list and provide 30 days' notice of material changes, with a right to object on reasonable data protection grounds.

6. International transfers and data location

Primary storage of Customer Data is in the EU, on AWS in eu-central-1 (Frankfurt) and eu-north-1 (Stockholm). Application services run on AWS infrastructure in the EU and on Vercel (EU with global edge). Cloudflare provides security and edge services.

Two categories of data are processed outside the EU:

AI inference requests, handled transiently in vendor-provided regions under the no-retention arrangements described in Section 3; and
the document search index, hosted on AWS in the United States, which stores text excerpts and vector embeddings of uploaded documents in order to power retrieval.

Payments, authentication and email subprocessors may also process data in the United States.

For transfers to countries without an adequacy decision we rely on EU Standard Contractual Clauses for processors (Module 2), the UK International Data Transfer Addendum, and the Swiss Addendum, as applicable. Module 1 may apply where Genvision acts as an independent controller. Copies of the executed clauses are available on request, redacted as permitted.

7. Retention, export and deletion

Customer Data during the relationship: retained while your account is active. You can export or delete data at any time from the platform.
After termination: on written request within 30 days of termination, we make Customer Data available for export in a commonly used format. Customer Data is then deleted from active systems. Every check, finding and source trace is exportable in a format intended to be compatible with long-term audit retention requirements.
Archive: we maintain an encrypted archive of Customer Data for up to 10 years. It is used only for security, audit trails, improving the quality of the Service, and establishing, exercising or defending legal claims. It is never used to train or fine-tune any large language model. Where we review archived data to improve the quality of the Service, we do so as a controller on the basis of our legitimate interests, and you may object to that use. You may request earlier deletion at any time and we will comply within a reasonable period, subject to backups aging out on a normal cycle.
Google Drive OAuth tokens: retained while the integration remains connected. Deleted when you disconnect or upon account termination.
Service Data and logs: retained for operational needs and then aggregated or de-identified.
Marketing data: retained until you unsubscribe or withdraw consent.

8. Your rights

Where the GDPR or UK GDPR applies to our processing, you have the following rights. You may request access, correction, deletion, restriction, and portability, and object to processing, including processing based on legitimate interests. You may also withdraw marketing consent at any time. To exercise these rights, contact privacy@genvision.com.

9. Security

We implement administrative, technical and physical safeguards designed to protect personal data. These include:

Encryption: TLS 1.2 or higher in transit, and AES-256 at rest for primary storage.
Access control: least privilege, role-based access with periodic reviews, and multi-factor authentication for administrative access.
Tenant isolation: the Service is multi-tenant with logical separation. Every record is bound to an organization and project, and every request is authorized against the caller's organization membership before data is returned. This is enforced in the application and data layer on every query, not by client-side filtering. Documents are stored under per-project key prefixes with server-side encryption and no public access.
Network and monitoring: network segmentation, firewalls, and security logging and monitoring.
Development and testing: secure development practices, code review, dependency management, vulnerability scanning, independent penetration testing and security audits, and regular security reviews conducted on an assume-breach basis.
Personnel: Genvision personnel are bound by confidentiality obligations and receive data protection training.

Further detail is available in our Security Measures at Annex B of our Terms of Service.

10. Children

The Service is for business users and is not directed to children.

11. Changes

We may update this Policy. For material changes, we will provide reasonable advance notice in-product or by email.

Genvision Cookie Notice

Last updated: August 10, 2026

We use cookies and similar technologies to operate our website and Service.

Your choices

If we introduce optional cookies, we will show a consent banner that blocks non-essential cookies until you choose Accept or manage preferences. You can change your choices at any time in Cookie Settings.

Cookie banner text

"Genvision uses essential cookies to make our site work. With your consent, we may use optional cookies to measure usage and improve the Service. Click Accept to consent, or Cookie Settings to choose."

Managing cookies

You can also control cookies via your browser settings. Some features may not work without essential cookies.

Contact

Questions about this Policy or our cookie practices: privacy@genvision.com.