This policy explains how 7INNDC, LLC (“Carvex”, “we”, “us”) collects and uses personal information when you visit this website, contact us through its forms, or sign in to its private area. It is written to reflect what this website actually does today.
1. Who is responsible for your data
| Item | Details |
|---|---|
| Controller | 7INNDC, LLC, operating under the brand Carvex |
| Legal form | Limited liability company (LLC) formed in New Mexico, USA |
| New Mexico filing number | XXX |
| Principal office | San Francisco, California, USA. Street address: XXX |
| Office in Spain | Seville, Spain. Street address: XXX |
| Spanish tax ID (NIF) | XXX |
| Privacy contact | contact@carvexvs.com |
| Data protection officer | XXX (we will state here whether a DPO has been designated) |
| EU representative (Art. 27 GDPR) | XXX (may not be required if our Seville office qualifies as an EU establishment; pending confirmation) |
Scope: this policy covers the public website, its contact and application forms, and the sign-in pages of the private control center. Products in our portfolio are separate services with their own privacy notices.
2. What we collect and where it comes from
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, email address, company or project name, phone number (optional), role (Venture Studio form) | You, when you submit a form |
| Inquiry content | Project description, project type, expected users, budget range, timeline, sector, opportunity type and stage, why you are contacting Carvex, an optional link to a deck or website | You, when you submit a form |
| Communications | Emails and messages we exchange with you; internal notes and status of your inquiry | You and our team |
| Form context | The page from which you sent the form | Automatically, with your submission |
| Campaign attribution (only with consent) | Campaign (UTM) parameters and the referring website of your visit | Your browser, only after you accept analytics |
| Security data | IP address (seen by our hosting provider; we store only a salted one-way hash for abuse prevention), timestamps, technical request data in server logs | Automatically |
| Cookie choice record | A random identifier, your choice, the date, whether your browser sent a Global Privacy Control signal and the page where you chose. No IP address. | Automatically, when you make a choice |
| Private area accounts (authorised users only) | Name, email, role, sign-in session, activity in the audit log | You or the organization that invited you |
We do not ask for special categories of data (such as health, ethnic origin, religious or political views) and ask you not to include them in free-text fields. We do not buy personal data or receive it from data brokers.
3. Why we use it and our legal bases
For visitors in the European Economic Area, Spain and the United Kingdom, each use relies on a legal basis under the GDPR:
| Purpose | Data used | Legal basis |
|---|---|---|
| Reply to your inquiry and evaluate a possible project, engagement or venture | Contact details, inquiry content | Steps taken at your request before a possible contract (Art. 6(1)(b)); our legitimate interest in answering business inquiries and evaluating opportunities (Art. 6(1)(f)) |
| Follow up with you and manage the relationship | Contact details, communications | Art. 6(1)(b) and Art. 6(1)(f) |
| Keep the website secure: spam filtering, rate limiting, abuse prevention | Security data | Legitimate interest in protecting the website and our users (Art. 6(1)(f)) |
| Measure which channels bring real inquiries (campaign attribution) | Campaign attribution data | Your consent (Art. 6(1)(a)) and, for storage on your device, Art. 22.2 of the Spanish LSSI. You can withdraw it at any time. |
| Remember your cookie choice and, if you change it, your language | Cookie choice record, language preference | Strictly necessary storage; legal obligation to be able to demonstrate consent (Art. 6(1)(c) and Art. 7(1)) |
| Operate the private area for authorised users | Account data | Performance of the agreement with the user or their organization (Art. 6(1)(b)); security (Art. 6(1)(f)) |
| Comply with the law and establish or defend legal claims | Any of the above, as needed | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
Marketing: we do not currently send newsletters or marketing emails, and our forms do not subscribe you to anything. If we start, we will ask for separate, optional consent that is never pre-ticked and can be withdrawn with one click.
No automated decisions: we do not make decisions with legal or similarly significant effects based solely on automated processing, and we do not build profiles of visitors. Venture and project inquiries are reviewed by people.
Where we rely on legitimate interests, you can object at any time (see section 7).
4. Who receives your data
We use service providers that process data on our behalf under data processing terms:
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Website hosting, serverless functions, CDN and request logs | United States (global edge network) |
| Supabase Inc. | Database, authentication and file storage | European Union: AWS eu-west-1, Ireland |
| Resend | Delivery of internal notification emails about form submissions. Not active as of the date of this policy; it will only be enabled to notify our team of new inquiries. | United States |
We may also disclose data to professional advisers bound by confidentiality, to public authorities when the law requires it, or to a successor in the event of a merger, acquisition or sale of assets, subject to this policy.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use advertising networks, social media pixels or third-party analytics on this website.
5. International transfers
7INNDC, LLC is a US company with an office in Spain. Our database is hosted in the European Union (Ireland), but our hosting provider processes requests in the United States and on a global edge network, our providers are US companies, and our team in the United States and in Spain can access inquiry data. Personal data from the EEA may therefore be processed in the United States.
When that happens we rely on appropriate safeguards provided by law, such as the EU–US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses included in our providers' data processing terms. Confirmation of the specific safeguard used by each provider: XXX.
You can ask us for more information about these safeguards using the contact details below.
6. How long we keep data
| Data | Retention |
|---|---|
| Inquiries that do not lead to an engagement | Deleted automatically 24 months after the last activity on the inquiry |
| Submissions identified as spam | Deleted automatically after 90 days |
| Inquiries that become a client relationship | For the duration of the relationship and then for the periods required by commercial, tax and accounting laws or to handle legal claims |
| Form security log (with IP hash) | Deleted automatically after 12 months |
| Cookie choice records | Deleted automatically after 24 months; we ask again every 12 months |
| Campaign attribution in your browser | Stored in session storage and removed when you close the browser tab or session, or when you reject analytics |
| Hosting request logs | According to our hosting provider's log retention: XXX |
| Private area accounts and audit log | While the account is active; the audit log is kept for security and accountability for a period XXX |
7. Your rights (EEA, Spain and UK)
- Access: obtain confirmation and a copy of your data.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data.
- Objection: object to processing based on legitimate interests.
- Restriction: ask us to limit how we use your data.
- Portability: receive data you provided in a structured, machine-readable format.
- Withdraw consent: at any time, without affecting earlier processing. For cookies, use Cookie settings.
To exercise them, email contact@carvexvs.com or write to our postal address (XXX). We reply within one month, which can be extended by two further months for complex requests. We may ask for information to verify your identity.
You also have the right to complain to a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (aepd.es). We would appreciate the chance to address your concern first.
8. United States and California privacy notice
The California Consumer Privacy Act (CCPA, as amended by the CPRA) applies to businesses that meet thresholds set by law, such as annual revenue above a statutory amount or processing the personal information of 100,000 or more consumers. Based on our current size we do not believe these thresholds are met. We provide this notice as a precaution and will honour the rights below for California residents while we review our status.
Notice at collection
| CCPA category | What it covers here | Disclosed to |
|---|---|---|
| Identifiers | Name, email address, salted hash of IP address, random cookie-choice ID | Hosting and database providers |
| Customer records (Cal. Civ. Code § 1798.80) | Phone number, company name | Hosting and database providers |
| Commercial information | Project needs, budget range, timeline, venture stage | Hosting and database providers |
| Professional information | Company and role | Hosting and database providers |
| Internet or network activity | Form page, campaign parameters and referrer (only with consent) | Hosting and database providers |
| Sensitive personal information | Not collected intentionally | Not applicable |
Purposes, sources and retention are described in sections 2, 3 and 6. We do not sell or share personal information (as those terms are defined in the CCPA), including that of consumers under 16, and we do not use sensitive personal information.
Your rights if the CCPA applies
- Right to know what personal information we collect, use and disclose, and to access it.
- Right to delete and right to correct personal information.
- Right to opt out of sale or sharing. We do not sell or share, so there is nothing to opt out of; we still honour Global Privacy Control signals.
- Right to limit use of sensitive personal information. Not applicable, because we do not collect it.
- Right not to be discriminated against for exercising these rights.
Submit a request by email to contact@carvexvs.com. We will verify your request by matching information you provide with what we hold. You may use an authorised agent, who must provide your signed permission. We respond within 45 days, which can be extended as allowed by law.
Do Not Track and third-party tracking (CalOPPA)
Our website does not change its behaviour in response to “Do Not Track” browser signals, because it does not track visitors across third-party websites. We do honour Global Privacy Control as an opt-out of optional technologies. We do not allow third parties to collect personally identifiable information about your online activities over time and across different websites when you use our website.
Shine the Light
We do not disclose personal information to third parties for their own direct marketing purposes.
Other US states
Residents of other US states with consumer privacy laws may have similar rights. Contact us and we will respond as required by the law that applies to you.
9. Children
This website is intended for businesses and professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.
10. Security
We use reasonable technical and organisational measures appropriate to the data we handle: encryption in transit (HTTPS), database access controls with row-level security, least-privilege access for our team, one-way hashing of IP addresses and API keys, rate limiting and audit logging of administrative actions. No system is completely secure; if a breach affects your data, we will notify you and the authorities when the law requires it.
12. Changes to this policy
We will update this policy when our practices change and show the new date at the top. If a change is material, we will make it visible on the website before it takes effect and, where required, ask for your consent again.
13. Contact
Privacy questions and requests: contact@carvexvs.com. General contact: contact@carvexvs.com. Postal address: XXX. You can also use the contact page.