Privacy Policy

Introduction & Scope

Vorenthic Labs ("Company", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy describes our practices concerning the personal data we collect from users ("you" or "your") of our websites, applications, APIs, and all related products and services (collectively, the "Services").

This Policy applies to all Services operated under the vorenthic.pages.dev domain and its subdomains, including but not limited to:

• Alpanzo AI — our flagship conversational AI platform
• Alpanzo Code Suite — our desktop IDE and developer tooling
• Vorenthic Accounts — our unified identity and authentication system
• Vorenthic Landing Pages — our public-facing informational websites

This Policy is designed to comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"), and other applicable data protection laws worldwide.

Data Controller

For the purposes of data protection legislation, the data controller responsible for your personal data is:

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), Vorenthic Labs acts as the data controller with respect to the personal data processed through the Services. If you have questions about our data practices or wish to exercise your rights, please contact us using the details above or see Section 17.

Personal Data We Collect

We collect personal data in the following categories:

3.1 Data You Provide Directly

3.2 Data Collected Automatically

3.3 Data from Third Parties

We may receive limited personal data from third-party authentication providers (e.g., OAuth providers) if you choose to link a third-party account. We receive only the data you authorise the third-party provider to share, typically limited to your email address and display name.

Legal Basis for Processing (GDPR)

If you are located in the EEA or UK, we process your personal data on the following legal bases:

How We Use Your Data

We use the personal data we collect for the following purposes:

1. Service Delivery: To provide, operate, maintain, and improve the Services, including generating AI responses, processing your requests, and managing your Account.
2. Authentication & Security: To verify your identity, manage session tokens, prevent unauthorised access, detect and mitigate fraud, and protect against malicious activity.
3. Communication: To send you service-related notices, security alerts, account notifications, and respond to your inquiries and support requests.
4. Analytics & Improvement: To understand how the Services are used, identify trends, diagnose technical issues, and improve the performance, reliability, and user experience of the Services.
5. Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
6. Safety & Abuse Prevention: To enforce our Terms of Service, detect violations of our acceptable use policies, and protect the rights, property, and safety of Vorenthic Labs, our users, and the public.

AI Services & Conversation Data

Our AI features process your inputs (prompts, queries, uploaded images and files) to generate responses. We handle this data with particular care:

• No Model Training: We do not use your individual prompts, conversation histories, or uploaded content to train or fine-tune our foundational AI models. Our AI models are provided by third-party vendors and are not trained on user-specific data collected through our Services.
• Session-Based Processing: Conversation data is processed in real-time to generate responses. Conversation history within a session is maintained temporarily to provide contextually coherent multi-turn interactions.
• Temporary Caching: Responses and session data may be temporarily cached in memory for performance optimisation. Cached data is automatically purged at the end of each session or within twenty-four (24) hours, whichever is shorter.
• Content Safety Logging: In limited circumstances, we may log metadata (not content) related to inputs that trigger content safety filters, solely for the purpose of maintaining and improving our safety mechanisms.
• Third-Party AI Providers: AI responses are generated by third-party model hosting providers. When your prompts are transmitted to these providers, they are processed in accordance with those providers' data processing agreements with us, which prohibit the use of your data for model training.

Cookies & Tracking Technologies

We use cookies and similar technologies to operate and improve the Services. A cookie is a small data file stored on your device that helps us recognise your browser and capture certain information.

You can manage your cookie preferences through the cookie consent banner displayed on first visit, or through your browser settings. Disabling essential cookies may impair core functionality of the Services.

We do not use third-party advertising cookies or cross-site tracking pixels. We do not sell your data to advertisers.

Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:

• Service Providers & Data Processors: We engage trusted third-party service providers who process data on our behalf to deliver the Services. These processors are contractually bound to process data only as instructed by us and to implement appropriate security measures. Our current categories of processors include:
  • Cloud infrastructure and hosting (Cloudflare)
  • AI model hosting and inference (third-party AI providers)
  • Payment processing (for paid subscriptions)
  • Database services (Cloudflare D1)
• Legal Requirements: We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government investigation).
• Protection of Rights: We may disclose personal data when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this Policy.

International Data Transfers

Your personal data may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from those in your jurisdiction. Specifically, our servers and third-party service providers may be located in:

• The United States
• The European Economic Area
• India
• Other jurisdictions where Cloudflare operates edge infrastructure

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements (DPAs) with our processors that incorporate GDPR-compliant terms
• Adequacy decisions where available

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements.

When personal data is no longer required, we securely delete or anonymise it. Anonymised data that cannot be re-identified may be retained indefinitely for analytical purposes.

Security Measures

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256 or equivalent encryption standards.
• Password Hashing: User passwords are hashed using bcrypt with appropriate salt rounds. We never store plaintext passwords.
• Session Security: Authentication tokens are cryptographically signed and expire after a configurable duration. Session validation occurs on every authenticated request.
• Access Controls: Internal access to personal data is restricted to authorised personnel on a need-to-know basis, with role-based access controls and audit logging.
• Infrastructure Security: Our Services are hosted on Cloudflare's global edge network, benefiting from DDoS protection, Web Application Firewall (WAF), and Bot Management capabilities.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, please contact us at privacy@vorenthic.pages.dev. We will respond to your request within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA). We may request verification of your identity before processing your request.

You also have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.

Children's Privacy

Our Services are not directed to children under the age of thirteen (13). We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at privacy@vorenthic.pages.dev, and we will take steps to delete such data from our systems.

For users in the EEA, we comply with the age requirements set by applicable Member State law. In jurisdictions where a higher age threshold applies (e.g., 16 in Germany), we apply that higher threshold.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

• Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share (as defined under CCPA/CPRA) your personal information for cross-context behavioural advertising. Therefore, there is no need to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To make a verifiable consumer request, please contact us at privacy@vorenthic.pages.dev. You may designate an authorised agent to make a request on your behalf.

Do Not Track: Some browsers transmit "Do Not Track" (DNT) signals. As there is no industry consensus on how to respond to DNT signals, we do not currently respond to them. However, we do not engage in cross-site tracking of our users.

India-Specific Provisions (DPDP Act)

If you are located in India, the following provisions apply in addition to (and, where conflicting, take precedence over) the general provisions of this Policy, in accordance with the Digital Personal Data Protection Act, 2023:

• Consent: We process your personal data based on your free, specific, informed, unconditional, and unambiguous consent, obtained through clear and affirmative action (e.g., accepting our terms, submitting a registration form).
• Legitimate Uses: We may process your personal data without consent for legitimate uses as defined under the DPDP Act, including voluntary provision of data for a specified purpose and performance of functions under applicable law.
• Data Principal Rights: As a Data Principal, you have the right to: (a) obtain information about processing; (b) seek correction and erasure; (c) grievance redressal; and (d) nominate another person to exercise your rights.
• Grievance Officer: Complaints may be directed to our Grievance Officer at privacy@vorenthic.pages.dev. We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days.
• Data Protection Board: If you are unsatisfied with our response, you may approach the Data Protection Board of India as constituted under the DPDP Act.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

1. Update the "Effective Date" at the top of this page.
2. Post the revised Policy on our website.
3. Where practicable and required by law, notify you via email or through a prominent notice within the Services.

We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any changes constitutes your acceptance of the updated Policy.

Contact & Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, you may contact us at: