Valifiy Privacy Policy
Version: 1.0
Effective date: 19 October 2026
1. Controller and scope
Valifiy LLC is responsible for the personal data it processes in connection with the Valifiy website, app and Service, except where Valifiy processes data on behalf of an Organization under the Valifiy B2B Data Processing Addendum.
This Policy explains what personal data Valifiy collects, why it is processed, how it is shared, where it is processed, how long it is retained and what rights users may have.
2. Summary of data practices
Valifiy collects account, profile, IdeaBoard, organization, payment metadata and technical/usage data.
User-entered business idea text is sent to one or more third-party AI service providers identified in the current Valifiy Vendor and Subprocessor List to generate suggestions and structured Outputs.
Payment-card processing is handled by the payment services provider identified in the Valifiy Vendor and Subprocessor List; Valifiy stores only limited payment metadata and does not store full payment-card numbers.
Access provided through an Organization includes standard sharing with that Organization: the participant's e-mail, whether and when the assigned IdeaBoard was activated, a short business idea description, and IdeaBoard progress. The complete IdeaBoard is not shared by default; additional access may apply if the Participant grants access or where Valifiy is used as an internal company tool under clearly disclosed terms governing the Organization arrangement. Under that internal-company arrangement, the employer can see company-provided IdeaBoards and all related data made available through the Service. Organization access does not extend to other personal IdeaBoards or login credentials.
3. Categories of personal data
3.1 Account and profile data
| Data | Source | Purpose |
|---|---|---|
| Email address | User input or authentication provider | Account creation, authentication, notifications, support and legal notices |
| Full name | User input or authentication provider | Profile display, account administration, identification of Participants using Organization-provided access |
| Password/credentials | User input; authentication provider | Authentication; credential storage handled by the authentication provider, not directly by Valifiy |
| Profile photo URL | Authentication provider, if supplied | Profile display |
| Auth provider information | Authentication provider | Account linking and authentication management |
| Last sign-in and account creation timestamps | Authentication provider / Valifiy systems | Account lifecycle, security, audit, support |
| Board usage counters (total, active, completed) | System | Feature limits, board-usage tracking and product analytics |
| Short business idea description | User input | User homepage, Organization dashboard, internal analytics |
3.2 IdeaBoard content and AI-related data
| Data | Source | Purpose |
|---|---|---|
| Business idea text, title and description | User input | Create and develop an IdeaBoard; generate AI-assisted content; display content to the user; show a limited short description in the Organization dashboard where applicable |
| Target market, persona, value proposition, business model, budget and go-to-market inputs | User input and AI-assisted edits | Provide the Service, develop the IdeaBoard and generate requested AI-assisted content |
| AI prompts and generated outputs | User, Valifiy systems and one or more third-party AI service providers | Send the information needed to one or more third-party AI service providers and provide suggestions, drafts, summaries and structured content |
| User edits and saved progress | User and system | Save progress, support export and allow the user to continue the workflow |
IdeaBoard content is personal data only to the extent that it relates to an identified or identifiable individual. Users should not include personal data unless they are authorized to do so and it is necessary for the requested feature.
3.3 Organization and Participant data
| Data | Source | Purpose |
|---|---|---|
| Company / Organization name | Organization admin / Valifiy admin | Organization account administration and order management |
| Board quota / seats / package | System / admin | Enforce purchased package and usage limits |
| Member e-mail addresses | Organization admin invitations | Invite participants and manage access |
| Member roles and invitation status | System | Access control and dashboard management |
| IdeaBoard activation date (recorded when the Participant presses Submit for the Initial Idea), progress and short idea description | System and user input | Organization dashboard visibility for disclosed lawful purposes; allocation administration, reassignment of unactivated IdeaBoards and related e-mail notifications to affected Participants |
3.4 Payment and access/package data
| Data | Source | Purpose | Retention note |
|---|---|---|---|
| Payment provider customer ID | Payment provider | Payment processing and access package management | Retained while needed to manage payments and access packages, and afterwards only as necessary for refunds, chargebacks, legal recordkeeping or legal claims. |
| Package/tier and access status | Valifiy systems / payment provider | Access control and billing | Retained while needed to manage access and billing, and afterwards only as necessary for refunds, disputes or applicable legal recordkeeping obligations. |
| Billing address | User / payment provider | Tax, invoicing and payment compliance | Retained for 7 years after the end of the calendar year in which the relevant transaction occurred, or longer where required by applicable law or necessary to establish, exercise or defend legal claims. |
| Last 4 digits and card brand | Payment provider | Payment method display and support | Retained while linked to the Account, then only as needed for payment support, disputes or legal recordkeeping. Valifiy does not store full card numbers. |
| Invoice history, payment dates and amounts | Payment provider | Billing records, refunds, disputes, accounting | Retained for 7 years after the end of the calendar year in which the relevant transaction occurred, or longer where required by applicable law or necessary for legal claims. |
3.5 Technical and usage data
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Authentication provider user ID | Authentication provider | Account identification and access control | Account lifetime; permanently deleted from active systems after account deletion and a 30-day grace period, subject to limited legal, security and backup retention |
| Board activity timestamps and current stage | System | Progress tracking, usage limits, support, product analytics | Account lifetime; raw records are permanently deleted from active systems after account deletion and a 30-day grace period, subject to the retention exceptions in Section 11 |
| Analytics data, such as online identifiers, device/browser information and usage events, subject to provider configuration and consent choices | Third-party analytics service providers | Understand use of the website and application, measure performance and improve the Service | Retained in accordance with the applicable provider configuration and consent choices; current technology and provider details are stated in the Valifiy Cookie and Similar Technologies Policy and the Valifiy Vendor and Subprocessor List. |
| IP address and user agent | Cloud and hosting providers / Valifiy logs | Security, abuse prevention, troubleshooting, audit | See the technical-log retention position in Section 11. |
| Error and system logs | Cloud/hosting providers | Debugging, availability, incident response | See the technical-log retention position in Section 11. |
4. Information Valifiy does not request
Full payment-card numbers are entered directly with the payment provider and are not received or stored by Valifiy.
Valifiy does not ask users to provide government IDs or national identification numbers, precise GPS/location data, or special-category or other sensitive personal data through IdeaBoards, prompts, profile fields or support communications. Users should not submit this information. If a user nevertheless includes it in a free-text field, Valifiy may receive and process it as part of the submitted content in accordance with this Policy.
User-uploaded files; the Service does not currently provide a user file-upload feature.
5. Purposes and legal bases
| Purpose | Data used | Legal basis / role |
|---|---|---|
| Provide the Service / IdeaBoards | Account data, board content, prompts and outputs | Performance of a contract; processor role under the Organization's instructions for Participant data processed on behalf of an Organization where applicable. |
| AI generation | User-entered business idea text, system prompts and selected IdeaBoard elements necessary to provide the Service | Performance of a contract; processor role under the Organization's instructions for Participant data processed on behalf of an Organization where applicable. |
| Authentication and security | Email, UID, auth metadata, IP/user agent, logs | Performance of a contract for authentication; legitimate interests in maintaining security, preventing fraud and abuse, troubleshooting and auditability; compliance with legal obligations where specific security or recordkeeping duties apply. |
| Payments and billing | Payment provider customer ID, package/access status, billing address, invoice/payment metadata | Performance of a contract for payment and billing; compliance with legal obligations for tax and accounting records. |
| Organization dashboard | Participant e-mail, IdeaBoard activation date, progress/status, short idea description | Processor role under the Organization's instructions for the Organization dashboard; where Valifiy acts as controller, legitimate interests in secure access administration and program support. Participants receive the required notice. |
| Support and troubleshooting | Account data, technical logs, support messages, limited board data when needed | Performance of a contract for user support and troubleshooting; legitimate interests in maintaining security, preventing misuse and improving service reliability. |
| Internal analytics / improvement | Usage counters, board stage, third-party analytics usage/event data and aggregated metrics | Legitimate interests in understanding service usage, measuring performance and improving the Service; consent where required for non-essential analytics cookies or similar technologies. |
| Marketing emails | Email, name, preferences | Consent (opt-in), separate from acceptance of the Valifiy Terms of Service. |
The table above is the consolidated statement of the purposes and legal bases or processor roles for the processing activities described in section 3.
6. AI processing
To provide the Service, Valifiy sends user-entered business idea text, Valifiy system prompts and selected IdeaBoard elements to one or more third-party AI service providers identified in the current Valifiy Vendor and Subprocessor List.
Training: Valifiy does not use identifiable User Content to train Valifiy-owned AI models. Current provider-specific training-use settings are stated in the Valifiy Vendor and Subprocessor List.
Retention and logging: Current provider-specific request-content retention, audit-logging, API-call logging and Zero Data Retention settings are stated in the Valifiy Vendor and Subprocessor List.
Users should avoid entering special-category data, confidential third-party information, regulated data or trade secrets unless they have authority and understand the processing implications.
7. Cookies and local storage
Valifiy uses Google Analytics 4 to understand how visitors and users interact with the website and application, measure performance and improve the Service. Google Analytics may use cookies or similar identifiers and process online identifiers, device/browser information and usage events. Where applicable law requires prior consent, non-essential analytics technologies are not loaded until the user has made the relevant consent choice. The current analytics technologies and providers are identified in the Valifiy Cookie and Similar Technologies Policy and the Valifiy Vendor and Subprocessor List. Strictly necessary cookies, local storage or similar technologies may also be used for login, authentication, security, session management, consent records, checkout and basic service functionality.
Current information about cookies and similar technologies used by Valifiy, their purposes and available controls is provided in the Valifiy Cookie and Similar Technologies Policy.
8. Vendors and subprocessors
Valifiy uses third-party providers for cloud infrastructure, authentication, hosting, AI processing, payment services, analytics, e-mail delivery, security monitoring and other functions needed to provide the Service. Current providers, their roles, processing purposes, data categories, processing locations, transfer safeguards and provider-specific retention information are set out in the Valifiy Vendor and Subprocessor List.
Valifiy uses Google Fonts to deliver website and application fonts. Requests to Google include the visitor's IP address, user-agent and referrer. Google Fonts does not set cookies for this purpose. Further details are in the Valifiy Vendor and Subprocessor List.
9. International transfers
Valifiy is a Wyoming LLC, and its operations and service providers involve processing in the EEA, United States and other jurisdictions identified in the Valifiy Vendor and Subprocessor List. Where applicable data-protection laws require transfer safeguards, Valifiy relies on appropriate mechanisms such as adequacy decisions, Standard Contractual Clauses, data processing terms or other lawful mechanisms.
10. Sharing of personal data
With cloud, hosting, authentication, payment, AI, e-mail, support, security and monitoring vendors as needed to provide the Service.
With Organizations for Organization-provided access, the participant's e-mail, whether and when the assigned IdeaBoard was activated, a short business idea description, and IdeaBoard progress. Complete IdeaBoard content is shared only at the Participant's direction or under a clearly disclosed internal-company access model covering company-provided IdeaBoards and all related data made available through the Service. This does not give the Organization access to other personal IdeaBoards or login credentials.
With professional advisers, auditors, insurers, legal counsel and authorities where legally required or necessary to protect rights.
In connection with corporate transactions such as merger, acquisition, financing, restructuring or sale of assets, subject to appropriate safeguards.
With consent or at the user’s direction.
11. Retention
| Category | Retention position |
|---|---|
| Account/profile data | While the account is active. After account deletion and a 30-day grace period, account/profile data and associated IdeaBoards are permanently deleted from active systems, subject only to limited legal, billing, security and backup retention. Data retained under an applicable exception is permanently deleted when the relevant retention period ends. |
| IdeaBoard content | While an activated IdeaBoard remains in the Participant's individual account, unless deleted earlier. The end of the Organization's package, allocation period, program or relationship with the Participant does not by itself trigger deletion, including under an internal-company arrangement. Account or IdeaBoard deletion remains subject to the applicable retention rules described in this Policy. |
| Organization dashboard data | For the duration of the Organization program or agreement and reasonable post-program administration period. |
| Technical logs | Technical logs are retained for 90 days or, where retained by a service provider, for the period applied by that provider as stated in the Valifiy Vendor and Subprocessor List. |
| Website server logs | Visitor IP address, date/time, requested URL, HTTP method/status, response size, referer and user-agent are retained for 30 days. Logs are automatically deleted and are not included in backups. |
| Website hosting backups | Daily website backups are retained for 7 days under the current hosting service; the applicable plan and data center are stated in the order. |
| Google Analytics event and user data | Retained for 14 months; retained data resets when the user has new activity. |
| Billing/invoice/payment records | Retain for 7 years or as long as required or permitted by applicable tax, accounting, audit and legal obligations. |
| Support requests | Retained while needed to resolve the request and for 3 years from closure, or a shorter period if the product risk profile permits, unless longer retention is needed for disputes, security or legal obligations. |
| Backups | Deleted or overwritten through normal backup cycles; not used for new purposes. |
12. User rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, opt-out of marketing, complaint to a supervisory authority, and other rights under applicable law.
Requests may be sent to privacy@valifiy.com. Valifiy may need to verify identity and may decline or limit requests where permitted by law, for example to protect security, rights of others, legal obligations or records needed for disputes.
13. Marketing communications
Valifiy sends marketing e-mails only where the user has opted in. Marketing consent is separate from acceptance of the Valifiy Terms of Service and is not pre-ticked. Each marketing e-mail includes an unsubscribe mechanism.
14. Children and minors
Users must be at least 18 years old to use the Service independently. Users under 18 may create an Account and use the Service through access provided by a school, university, educational or startup program, hackathon or other Organization under an arrangement approved by Valifiy.
The Organization providing access is responsible for ensuring that participation is legally permitted and for obtaining any parental or guardian consent or other authorization required under the laws applicable to the user.
The full eligibility requirements and the circumstances in which access may be refused, suspended or terminated are stated in the Valifiy Terms of Service.
15. Security
Valifiy uses administrative, technical and organizational measures designed to protect personal data, including account controls, vendor management, access restrictions, encryption in transit where applicable, authentication controls, logging, backups, incident response processes and least-privilege access.
16. US state privacy disclosures
Valifiy does not sell personal information or share personal information for cross-context behavioral advertising.
Where state privacy laws such as California privacy law apply to Valifiy, eligible users may have rights to know/access, delete, correct, opt out of sale/share, limit certain sensitive-data uses, and non-discrimination. Valifiy will provide any additional state-specific notices or controls required by applicable law.
17. Changes to this Policy
Valifiy may update this Policy as the product, vendors, legal requirements or business model change. Material changes will be communicated through the website, app, e-mail or renewed acknowledgement where required or appropriate.
18. Contact
| Field | Information |
|---|---|
| Controller | Valifiy LLC |
| Address | 701 Tillery Street, Austin, Texas 78702, United States |
| Privacy contact | Marko Ložajić, privacy@valifiy.com |
| Security/breach contact | privacy@valifiy.com |
| Support | support@valifiy.com |