Privacy Policy

Account data: your name, work email, organization details, and authentication data (a hashed password and, if enabled, two-factor settings). Your content: the compliance statuses, evidence files, and documents you create in the Platform. Usage data: logs of actions taken in the Platform (for security auditing and reliability) and basic operational metadata. We do not run third-party advertising or cross-site tracking in the product.

Your data is hosted in the United States. Evidence files are stored encrypted at rest in private storage and are never publicly accessible. We commit to US-region hosting for the account and evidence data described above.

We use a small set of service providers to operate the Platform; the current list is maintained at valontir.com/legal/subprocessors.

While your subscription is active, your compliance record is retained indefinitely: evidence files, the activity log, and score snapshots are never deleted based on their age. If your subscription ends (by cancellation or lapse), your workspace remains readable and fully exportable for 90 days; reactivating within that window restores everything, and after 90 days the workspace and its data are permanently deleted. You can also permanently delete your workspace yourself at any time (owner-only, with a typed confirmation and a live two-factor code); permanent deletion removes your files, records, and history. On written request we will export your data or delete your account within 30 days. A lightweight Data Processing Addendum (DPA) is available on request.

Depending on where you live, you may have rights to access, correct, or delete your personal data, and to know how it is used. We honor these requests for all customers regardless of jurisdiction, consistent with applicable law (including CCPA). To exercise any right, contact us at the address below.

Security is described in detail on our Security page. For privacy questions or requests, or to report a security concern, email support@valontir.com.