Privacy Policy

Genvision Privacy Policy

Last updated: May 27, 2026

This Privacy Policy explains how Genvision Inc. ("Genvision," "we," "us") collects, uses, shares, and protects personal data when you use our websites, applications, and services that simulate validation checks for carbon credit projects (the "Service").

Contact Information

Controller: Genvision Inc., 251 Little Falls Drive, Wilmington, DE 19808, USA. Privacy contact: privacy@genvision.com.

EU establishment: For EU users, processing occurs in the context of our EU establishment, Genvision BV, Petrusberg 22, 3001 Leuven, Belgium.

UK contact: Elitsa Marinova, Flat 19, Dawkins Court, 2 Garland Close, SE1 6AY, United Kingdom, elitsa@genvision.com. UK individuals may contact our representative in addition to contacting us at privacy@genvision.com.

Scope

This Policy covers personal data we process when you visit our site, create an account, upload project documents, receive reports, or contact support. The Service is for business users and not for children.

1. Data we process

Account and contact data: name, business email, company, role, authentication identifiers (via Clerk), billing contacts.
Project content (Customer Data): documents you upload and the outputs we generate.
Service Data (technical/usage): device/browser info, IP address, timestamps, feature usage, performance metrics, error logs, and de-identified statistics.
Payments: processed by Stripe; we do not store full payment card details.
Support communications: messages and attachments you send us.
Google Drive integration data (optional): when you connect Google Drive, your Google account email, OAuth access and refresh tokens, and file and folder metadata and contents for files you browse, select, import, or export through the Service.

We do not seek to collect special category data.

2. Purposes and legal bases

Provide the Service, operate accounts, process uploads, generate outputs. Legal basis: performance of a contract.
Security, fraud prevention, service reliability, product quality improvements that do not train or fine-tune LLMs. Legal basis: legitimate interests.
Billing, tax, recordkeeping. Legal basis: legal obligations.
Communications about the Service (operational). Legal basis: legitimate interests/contract.
Marketing communications (optional). Legal basis: consent. You can withdraw consent at any time.
Google Drive integration (optional). Legal basis: performance of a contract and consent when you authorize OAuth access.

3. AI and model usage

We do not train or fine-tune any large language model on Customer Data.
Third-party AI providers we use are configured or contractually bound not to use Customer Data for training.
We may conduct limited human review of specific runs to improve rules and quality and may use de-identified and aggregated Service Data for reliability and security.
We do not create models that memorize or reproduce your confidential content for other users.

4. Google Drive integration

When you choose to connect your Google Drive account to the Service, we use Google's OAuth 2.0 authorization to access Google Drive on your behalf. You control this connection and can disconnect it at any time from Settings → Integrations in the Service.

What we access. With your authorization, we may access:

your Google account email address;
OAuth access and refresh tokens needed to maintain the connection;
file and folder metadata (such as names, IDs, MIME types, and modification dates) for files and folders you browse or select;
file contents that you import into the Service, export from the Service, or that the Service processes at your direction (for example, to populate a project data room or generate documents).

How we use it. We use this access to:

browse and let you select files and folders from your Google Drive, including shared drives where you have access;
import documents you select into your projects;
export or save documents generated by the Service back to Google Drive when you request it;
display previews of connected files within the Service.

Important limits.

We access Google Drive only after you authorize the connection and initiate actions that require it.
We do not use Google Drive data to train or fine-tune AI models.
OAuth tokens are stored securely and used only to provide the integration. When you disconnect Google Drive, we revoke and delete stored tokens associated with that connection.
You can also revoke access at any time from your Google Account permissions page.

Genvision's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Sharing and subprocessors

We share personal data with service providers that process it for us ("subprocessors") under data protection agreements and with appropriate transfer safeguards. Current categories include:

Cloud hosting (AWS eu-north-1)
Application hosting (Vercel)
Edge/security (Cloudflare)
Payments (Stripe)
Authentication (Clerk)
Email (Google Workspace)
Google Drive API (Google LLC) - optional user-authorized file import and export integration
AI inference APIs (OpenAI, Google Gemini, Perplexity)

A current list is maintained in our Terms/DPA Annex C. We also share data where required by law or in connection with a reorganization or sale of our business.

6. International transfers

We use Standard Contractual Clauses (SCCs) and the UK Addendum, as applicable, for transfers to countries without an adequacy decision. Details are available on request.

7. Retention

Customer Data: retained while your account is active. After termination, we maintain an encrypted archive for up to 10 years for security, audit trails, product quality improvement that does not train or fine-tune LLMs, and to establish, exercise, or defend legal claims. You may request earlier deletion at any time; we will comply within a reasonable period, subject to backups aging out on a normal cycle.
Google Drive OAuth tokens: retained while the integration remains connected; deleted when you disconnect or upon account termination.
Service Data and logs: retained for operational needs and then aggregated or de-identified.
Marketing data: retained until you unsubscribe or withdraw consent.

8. Your rights

You may request access, correction, deletion, restriction, portability, and object to processing (including processing based on legitimate interests). You may withdraw marketing consent at any time. To exercise rights, contact privacy@genvision.com.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit, encryption at rest for primary storage, access controls, logging, and incident response. More details are in our Security Measures (Terms/DPA Annex B).

10. Children

The Service is for business users and not directed to children.

11. Changes

We may update this Policy. For material changes, we will provide reasonable advance notice in-product or by email.

Genvision Cookie Notice

Last updated: May 27, 2026

We use cookies and similar technologies to operate our website and Service.

Your choices

If we introduce optional cookies, we will show a consent banner that blocks non-essential cookies until you choose Accept or manage preferences. You can change your choices anytime in Cookie Settings.

Cookie banner text (minimal)

"Genvision uses essential cookies to make our site work. With your consent, we may use optional cookies to measure usage and improve the Service. Click Accept to consent or Cookie Settings to choose."

Managing cookies

You can also control cookies via your browser settings. Note some features may not work without essential cookies.

Contact

Questions about this Policy or our cookie practices: privacy@genvision.com.