Privacy notice

Controller

NeuraTech AG, Schürmattstrasse 4b, 6331 Hünenberg, Switzerland, is responsible for operating Venbona and for provider account data. Privacy enquiries can be sent to info@venbona.com.

For participant and process data, the respective property provider determines the purpose, scope and content. NeuraTech AG processes this data on its behalf as the technical platform operator.

Data we process

• Provider, contact, billing and brand details;
• process, property, participant and invitation data;
• offers, confirmations, audit events and result documents;
• private property documents and voluntarily uploaded proof of financing;
• necessary technical security, session and delivery data.

Purposes and legal bases

We process data to initiate and perform contracts, to conduct and document an offer process securely, to prevent misuse and to comply with legal obligations. Where the GDPR applies, we rely in particular on performance of a contract, legitimate interests and legal obligations.

Infrastructure and recipients

We use Vercel for hosting and server-side processing, Neon for relational data storage and Vercel Blob for private files. The selected execution and storage regions for the application, database and private files are in Europe. Provider companies can make process data available to their invited participants.

For transactional emails, the recipient address and message content are transmitted to Resend. The selected European delivery region controls routing and delivery only. Resend stores account data in the USA, including email metadata, logs and API records. Transfers from Switzerland or the EEA to the USA are subject to the standard contractual clauses incorporated into Resend’s data processing agreement.

We do not sell personal data, use advertising or tracking cookies, or integrate external analytics or font providers. Technically necessary session cookies protect signed-in access.

Retention and security

Proof of financing is generally scheduled for deletion 90 days after the process ends. Process documents and result data are generally scheduled for deletion after twelve months. Documented statutory retention obligations or legal holds may require longer retention.

Access is invitation- or link-based, tokens are stored only in hashed form, and private files are delivered only after server-side authorisation.

Your rights

Within the applicable law, you may request access, correction, deletion, restriction, data provision or object to processing, and you may contact the competent data protection authority. For process data, the inviting property provider is generally the first appropriate contact.