Valeno

Privacy Policy

Effective 13 October 2026

This policy explains how Gradient Insight Ltd (registered in England and Wales, no. 13730284), 100 Copythorn Road, Portsmouth PO2 0DZ, United Kingdom (“we”, “us”) handles personal data in Valeno: our website at valeno.ai, the portal our business customers sign in to, and the lead pages we build and host for them.

For anything in it, write to [email protected].

1. Who is responsible for what

We are the controller for our own website, for the accounts and business data of our customers, and for our communications with them. Contact: Gradient Insight Ltd (registered in England and Wales, no. 13730284), 100 Copythorn Road, Portsmouth PO2 0DZ, United Kingdom, [email protected].

For the details someone submits through a customer's lead page, such as an inquiry, a photo or a phone number, that customer is the controller and we act only as their processor, under a data processing agreement and on their instructions. If you sent an inquiry to a business through a page we host, that business decides how your data is used; contact them, or write to us and we will pass your request on.

2. What we collect

  • Account data: your name, email address, sign-in and session records. If you sign in with Google we receive your name, email address and profile picture from Google, and nothing else from your Google account.
  • Business data: what you enter during onboarding and in settings: business name, address, contact details, website, services, service area, opening hours, budget, preferred contact channel, and the company details required for a legal notice such as VAT number, company register entry and trade authority.
  • Content you upload or approve: photos, text, logos and the versions of your page.
  • Usage and technical data: IP address, browser and device information, timestamps, pages viewed, actions in the portal, recordings of your own portal screen with anything you type masked out, and security and error logs.
  • Lead data, as processor for our customer: the name, phone number, email address, answers and photos an inquirer submits, plus the Google click identifier, campaign parameters and referrer that came with the visit, and aggregated page-view counts.
  • Communications: emails you send us, and the delivery status of the mail we send you.
  • Billing data: invoicing details, payment references and the invoices themselves.

3. Why we use it, and on what legal basis

  • To provide the Service (build and host your page, run the form, generate summaries, send notifications and reports, run and report on campaigns, manage your account): performance of our contract with you, Art. 6(1)(b) GDPR.
  • To keep the Service secure and working (logging, abuse and fraud prevention, backups, debugging, statistics and screen recordings showing how the portal is used, improving what we offer): our legitimate interests, Art. 6(1)(f) GDPR. You can object at any time.
  • To send our own business customers information about the Service and similar offerings, and to name them as references as agreed in our terms: our legitimate interests, Art. 6(1)(f) GDPR. You can object at any time.
  • For analytics, session replay and advertising measurement on lead pages: your consent given through the cookie banner on that page, Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.
  • To keep accounting and tax records and answer lawful requests from authorities: our legal obligations, Art. 6(1)(c) GDPR.
  • To establish, exercise or defend legal claims: our legitimate interests, Art. 6(1)(f) GDPR.

4. AI processing

We use AI models to draft page text and images, ad copy, form questions and lead summaries. To do that we send the relevant business information, uploaded content and lead answers to model providers through OpenRouter. Those providers act for us as processors and, where the provider offers the option, we use the setting that excludes our data from training their models.

No decision producing legal effects or similarly significant effects is taken automatically about anyone. A lead summary is a suggestion for the business owner who receives it, and they decide what to do with it.

5. Cookies

The portal sets a session cookie that keeps you signed in, a cookie that remembers your language, and a cookie our own usage measurement uses to recognise the same browser on a later visit. No advertising cookies are set in the portal and nothing there is shared with an ad network.

That usage measurement runs on a service hosted for us in the EU. It records which steps of setup you finish, what you click, the errors the software hits, and a replay of your own screen inside the portal. We watch it for one thing: finding the step where people get stuck, so we can fix it. Anything you type into a field is masked out before a recording leaves your browser, we do not use any of it for advertising, and we do not share it with anyone else. We rely on our legitimate interest in a product that works, and you can turn it off for your account at any time by writing to us.

Published lead pages are separate and show a consent banner. Google Analytics, Google Ads conversion tracking and the analytics and session replay described above load there only after consent is given, again with form inputs masked, and clearing the page's cookies withdraws it.

6. Who we share data with

We do not sell personal data and do not share it for other companies' advertising. We use the following service providers, who process data for us under contract and, where relevant, under Art. 28 GDPR:

  • Portal hosting and database (European Union): the application servers and the PostgreSQL database that store accounts, businesses and leads.
  • Amazon Web Services, S3 (European Union): storage of photos and other media used on your lead page, and of any photos an enquirer attaches to an enquiry. Photos attached to an enquiry are shown only to the business that enquiry was sent to.
  • Netlify, Inc. (United States, global CDN): building and serving published lead pages, including TLS certificates for custom domains.
  • OpenRouter, Inc. (United States): routing our requests to the AI models that draft pages, ad copy and lead summaries.
  • Model providers reached through OpenRouter, currently OpenAI and Google (United States): generating that text and those images.
  • Google Ireland Ltd and Google LLC (European Union and United States): Google Ads campaigns, Google Analytics and Google Ads conversion tracking on lead pages, sign-in with Google if you use it, and Google Maps Platform, which we ask with your business name, address and phone number for your public Google listing, whose rating and reviews your lead page shows and whose opening hours we suggest to you; and the Google Maps embed, whose map of your listing visitors of your lead page can load.
  • DataForSEO OÜ (Estonia; servers in Germany and the United States): search-volume figures for your area, and the rating and reviews of your public Google listing, which we ask for by its Google place ID.
  • PostHog, EU Cloud (European Union): product analytics, error tracking and session replay in the portal, and consent-gated analytics and session replay on lead pages. Anything typed into a form is masked before a recording leaves the browser.
  • Telnyx LLC (United States) and Meta Platforms Ireland Ltd (WhatsApp): sending new-enquiry alerts to your WhatsApp, including the enquirer's name, phone number and request.
  • Our email provider (European Union): delivery of sign-in links, lead notifications, confirmations to your customers and reports.
  • Stripe Payments Europe Ltd (Ireland) and Stripe, Inc. (United States): taking your subscription and advertising-budget payments, holding your payment details and issuing your invoices.

7. Other recipients

Beyond those providers we share data with our accountants, lawyers and insurers where needed, with authorities and courts where the law requires it, and with an acquirer if the business behind Valeno is sold or restructured. In that case this policy continues to apply until the acquirer's own policy replaces it, and you are told before that happens.

8. Transfers outside the EEA

Some of our providers are based in the United States or process data globally. Where personal data is transferred there, we rely on the European Commission's standard contractual clauses, on the EU–US Data Privacy Framework where the provider is certified, or on another legal transfer mechanism, together with technical measures such as encryption in transit. You can ask us for details of the mechanism used for a specific provider.

9. How long we keep it

  • Account and business data: for as long as the agreement runs, then up to 30 days before deletion, apart from what we must keep longer.
  • Invoices and accounting records: for the statutory retention periods, currently up to seven years in Austria and six in the United Kingdom.
  • Lead data: for as long as our customer instructs us to keep it. It is deleted 30 days after their agreement with us ends unless they ask for deletion earlier.
  • Server, security and email delivery logs: normally up to 90 days.
  • Backups: overwritten on a rolling basis, normally within 30 days.
  • Data we need to defend a legal claim: until the claim is settled or time-barred.

10. How we protect it

The portal and its database run on servers in the European Union. Traffic is encrypted with TLS, secrets are stored encrypted, access to production data is limited to the people who need it, and third-party keys are scoped to the least access that works. No system is completely secure, so we also keep backups and monitor for problems.

11. Your rights

Under the GDPR you may ask us for access to your personal data, for it to be corrected or deleted, for processing to be restricted, and for a copy in a portable format. You may object to processing based on legitimate interests, including direct marketing, which we stop on request, and you may withdraw a consent at any time with effect for the future.

Write to [email protected]. We may ask you to confirm your identity, and we answer within one month; if a request is complex we may extend that and will tell you why.

If you are unhappy with how we handled your data you can complain to a supervisory authority: in Austria the Datenschutzbehörde (dsb.gv.at), in the United Kingdom the Information Commissioner's Office (ico.org.uk), or the authority where you live or work.

12. Children

Valeno is a service for businesses and is not directed at children. We do not knowingly collect data from anyone under 16 through the portal.

13. Changes to this policy

We update this policy when the Service or the providers behind it change. The current version is always on this page with its effective date, and we tell our customers by email before a material change takes effect.

14. Contact

Gradient Insight Ltd (registered in England and Wales, no. 13730284), 100 Copythorn Road, Portsmouth PO2 0DZ, United Kingdom. Email: [email protected].