Privacy Policy

This Privacy Policy (the “Policy”) explains how Finity Ventures (“Finity Ventures,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in connection with Cevran, including our marketing site, web application, and related communications (together, the “Service”).

Cevran is a product brand of Finity Ventures. When this Policy says Cevran, it means the Service operated by Finity Ventures.

This Policy applies to visitors, account holders, and workspace members. It does not cover third party sites or apps you connect (such as commerce or advertising platforms). Those parties have their own privacy practices.

This page is not legal advice and does not create a lawyer client relationship.

We collect information in three main ways: you provide it, it is generated by your use of the Service, or it comes from integrations you authorize.

When you sign up or update your profile, we may collect:

• Name or display name
• Email address
• Authentication identifiers from sign in providers you choose (for example Google), when enabled
• Password credentials when you use email sign in (stored using industry standard hashing by our authentication provider; we do not store plaintext passwords)
• Workspace name, workspace type, and role within a workspace
• Records of Terms and Privacy acceptance (including version and time)

To operate research and collaboration features, we may process:

• Niche and market preferences you configure
• Keywords, categories, price bands, and similar research settings
• Product candidates, scores, notes, approvals, rejections, and related decision history
• Invitations you send (invitee email, role, status) and membership records
• Support messages and feedback you send us

If you connect a third party account (when that feature is available), we may receive tokens and basic account metadata needed to provide the integration. We process those credentials to operate the connection you requested.

Depending on the integration and permissions you grant, we may also receive store, catalog, order, or advertising related data needed for features you enable. We will describe those scopes in the connection flow when they launch.

We automatically collect technical information such as:

• IP address, approximate location derived from IP, browser type, and device type
• Pages or screens viewed, referring URLs, and timestamps
• Diagnostic logs, error reports, and performance metrics
• Cookie or similar technology identifiers where used for session continuity, security, or analytics

When paid plans are enabled, payment card details are collected and processed by our payment processor (for example Stripe). We typically receive billing metadata such as customer id, plan, invoice status, and limited card brand or last four digits, not your full card number.

We use personal information to:

• Provide, operate, secure, and improve the Service
• Create and manage accounts, workspaces, roles, and invitations
• Deliver product research features and store your decision history
• Authenticate users and prevent fraud, abuse, and security incidents
• Send transactional email (invites, security notices, billing notices when enabled)
• Respond to support requests
• Comply with law and enforce our Terms
• Analyze aggregated or de identified usage to improve product quality
• Communicate about the Service, with a way to opt out of non essential marketing where required

If you are in a region that requires a legal basis for processing, we rely on one or more of the following, depending on the context:

• Contract: to provide the Service you request
• Legitimate interests: to secure the Service, improve it, and understand aggregate usage, balanced against your rights
• Consent: where we ask for it (for example certain cookies or optional marketing), which you may withdraw
• Legal obligation: when we must retain or disclose information to comply with law

We do not sell your personal information. We share information in these situations:

• Service providers: hosting, authentication, email delivery, payments, error monitoring, and analytics vendors that process data on our instructions
• Workspace members: information you put in a workspace is visible to others in that workspace according to their roles
• Integrations you connect: data is shared with that provider as needed to perform the connection
• Business transfers: if Finity Ventures is involved in a merger, acquisition, or asset sale, information may transfer under appropriate confidentiality
• Legal and safety: when we believe disclosure is required by law, or necessary to protect rights, safety, or the integrity of the Service
• With your direction: when you ask us to share information

We use carefully selected vendors. Exact vendors may change as the product matures. Typical categories include:

• Cloud application hosting and databases
• User authentication
• Transactional email
• Payment processing (when billing is live)
• Product analytics and error reporting (configured to minimize unnecessary personal data where practical)

Finity Ventures may process information in Canada, the United States, and other countries where we or our providers operate. Those countries may have different data protection laws than your home country.

Where required, we will use appropriate transfer mechanisms (such as standard contractual clauses) for transfers from the EEA, UK, or Switzerland.

We retain personal information only as long as needed for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Workspace data generally remains while the workspace is active. After closure or long inactivity, we may delete or de identify data according to our retention schedule, unless a longer period is required by law or for legitimate dispute resolution.

Backup systems may retain residual copies for a limited period after deletion from production systems.

We use administrative, technical, and organizational measures designed to protect personal information, including access controls, encryption in transit, and encrypted storage for sensitive secrets where applicable.

No method of transmission or storage is perfectly secure. You are responsible for protecting account credentials and for configuring workspace membership carefully.

Depending on where you live, you may have rights to access, correct, delete, or export personal information, to object to or restrict certain processing, or to withdraw consent.

You can often update profile information in the Service. For other requests, email hello@cevran.ai with enough detail for us to verify your identity and locate your data.

Workspace owners may need to submit requests that affect shared workspace data. We may refuse requests that are unlawful, excessive, or that would break another person’s rights or our security obligations.

If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority. We encourage you to contact us first so we can try to resolve the issue.

We use cookies and similar technologies that are necessary for authentication, security, and remembering preferences. We may also use analytics technologies to understand how the Service is used.

You can control cookies through your browser settings. Blocking necessary cookies may prevent sign in or other core functions from working.

If we introduce non essential advertising cookies, we will update this Policy and provide choices required by law.

The Service is not directed to children under 16 (or the higher age required in your region). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps to delete it.

If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know, delete, correct, or opt out of certain processing, and not to be discriminated against for exercising those rights.

We do not sell personal information as “sale” is commonly defined. We do not share personal information for cross context behavioral advertising as of the effective date of this Policy. If that changes, we will update this Policy and offer required opt outs.

Categories of personal information we collect are described in Section 3. We collect them for the business purposes in Section 4.

To exercise rights, contact hello@cevran.ai. We will verify requests as required by law. Authorized agents may submit requests where the law allows, subject to verification.

Finity Ventures handles personal information in accordance with applicable Canadian privacy law for a private sector commercial product, including meaningful consent where required, limited collection, and safeguarding.

For account data about you as a Cevran user, Finity Ventures is typically the controller (or equivalent).

If your workspace stores personal information about other people (for example teammates, or later end customer data through integrations), you may be a controller of that information. You are responsible for providing notices and obtaining consents required for your use case.

When we process personal information solely on a customer’s documented instructions as a processor, a data processing addendum may apply for enterprise or regulated use. That addendum is not yet published for private beta.

We may update this Policy from time to time. We will post the updated version with a new effective date. Material changes may also be communicated in product or by email when appropriate.

Continued use of the Service after the effective date means you acknowledge the updated Policy, except where applicable law requires a different process.

Privacy requests and questions: hello@cevran.ai

Legal entity: Finity Ventures (Cevran product brand).

Registered office: 200-120 East Beaver Creek Rd, Richmond Hill, ON, L4B 4V1.