Valeno

Privacy Policy

Effective 20 August 2026

This policy explains how Gradient Insight Ltd, Portsmouth, United Kingdom (“we”, “us”) handles personal data in Valeno: our website at valeno.at, the portal our business customers sign in to, and the lead pages we build and host for them.

For anything in it, write to hello@valeno.at.

1. Who is responsible for what

We are the controller for our own website, for the accounts and business data of our customers, and for our communications with them. Contact: Gradient Insight Ltd, Portsmouth, United Kingdom, hello@valeno.at.

For the details someone submits through a customer's lead page, such as an inquiry, a photo or a phone number, that customer is the controller and we act only as their processor, under a data processing agreement and on their instructions. If you sent an inquiry to a business through a page we host, that business decides how your data is used; contact them, or write to us and we will pass your request on.

2. What we collect

  • Account data: your name, email address, sign-in and session records. If you sign in with Google we receive your name, email address and profile picture from Google, and nothing else from your Google account.
  • Business data: what you enter during onboarding and in settings: business name, address, contact details, website, services, service area, opening hours, budget, preferred contact channel, and the company details required for a legal notice such as VAT number, company register entry and trade authority.
  • Content you upload or approve: photos, text, logos and the versions of your page.
  • Usage and technical data: IP address, browser and device information, timestamps, pages viewed, actions in the portal, and security and error logs.
  • Lead data, as processor for our customer: the name, phone number, email address, answers and photos an inquirer submits, plus the Google click identifier, campaign parameters and referrer that came with the visit, and aggregated page-view counts.
  • Communications: emails you send us, and the delivery status of the mail we send you.
  • Billing data: invoicing details, payment references and the invoices themselves.

3. Why we use it, and on what legal basis

  • To provide the Service (build and host your page, run the form, generate summaries, send notifications and reports, run and report on campaigns, manage your account): performance of our contract with you, Art. 6(1)(b) GDPR.
  • To keep the Service secure and working (logging, abuse and fraud prevention, backups, debugging, aggregated statistics on how the Service is used, improving what we offer): our legitimate interests, Art. 6(1)(f) GDPR.
  • To send our own business customers information about the Service and similar offerings, and to name them as references as agreed in our terms: our legitimate interests, Art. 6(1)(f) GDPR. You can object at any time.
  • For analytics, session replay and advertising measurement on lead pages: your consent given through the cookie banner on that page, Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future.
  • To keep accounting and tax records and answer lawful requests from authorities: our legal obligations, Art. 6(1)(c) GDPR.
  • To establish, exercise or defend legal claims: our legitimate interests, Art. 6(1)(f) GDPR.

4. AI processing

We use AI models to draft page text and images, ad copy, form questions and lead summaries. To do that we send the relevant business information, uploaded content and lead answers to model providers through OpenRouter. Those providers act for us as processors and, where the provider offers the option, we use the setting that excludes our data from training their models.

No decision producing legal effects or similarly significant effects is taken automatically about anyone. A lead summary is a suggestion for the business owner who receives it, and they decide what to do with it.

5. Cookies

The portal sets only what it needs to work: a session cookie that keeps you signed in and a cookie that remembers your language. No advertising or tracking cookies are set in the portal.

Published lead pages show a consent banner. Google Analytics, Google Ads conversion tracking and PostHog session replay (hosted in the EU, with form inputs masked) load only after consent is given, and clearing the page's cookies withdraws it.

6. Who we share data with

We do not sell personal data and do not share it for other companies' advertising. We use the following service providers, who process data for us under contract and, where relevant, under Art. 28 GDPR:

  • Portal hosting and database (European Union): the application servers and the PostgreSQL database that store accounts, businesses and leads.
  • Amazon Web Services, S3 (European Union): storage of photos and other media used on your lead page.
  • Netlify, Inc. (United States, global CDN): building and serving published lead pages, including TLS certificates for custom domains.
  • OpenRouter, Inc. (United States): routing our requests to the AI models that draft pages, ad copy and lead summaries.
  • Model providers reached through OpenRouter, currently OpenAI and Google (United States): generating that text and those images.
  • Google Ireland Ltd and Google LLC (European Union and United States): Google Ads campaigns, Google Analytics and Google Ads conversion tracking on lead pages, and sign-in with Google if you use it.
  • PostHog, EU Cloud (European Union): consent-gated product analytics and session replay on lead pages, with form inputs masked.
  • Our email provider (European Union): delivery of sign-in links, lead notifications, confirmations to your customers and reports.

7. Other recipients

Beyond those providers we share data with our accountants, lawyers and insurers where needed, with authorities and courts where the law requires it, and with an acquirer if the business behind Valeno is sold or restructured. In that case this policy continues to apply until the acquirer's own policy replaces it, and you are told before that happens.

8. Transfers outside the EEA

Some of our providers are based in the United States or process data globally. Where personal data is transferred there, we rely on the European Commission's standard contractual clauses, on the EU–US Data Privacy Framework where the provider is certified, or on another legal transfer mechanism, together with technical measures such as encryption in transit. You can ask us for details of the mechanism used for a specific provider.

9. How long we keep it

  • Account and business data: for as long as the agreement runs, then up to 30 days before deletion, apart from what we must keep longer.
  • Invoices and accounting records: for the statutory retention periods, currently up to seven years in Austria and six in the United Kingdom.
  • Lead data: for as long as our customer instructs us to keep it. It is deleted 30 days after their agreement with us ends unless they ask for deletion earlier.
  • Server, security and email delivery logs: normally up to 90 days.
  • Backups: overwritten on a rolling basis, normally within 30 days.
  • Data we need to defend a legal claim: until the claim is settled or time-barred.

10. How we protect it

The portal and its database run on servers in the European Union. Traffic is encrypted with TLS, secrets are stored encrypted, access to production data is limited to the people who need it, and third-party keys are scoped to the least access that works. No system is completely secure, so we also keep backups and monitor for problems.

11. Your rights

Under the GDPR you may ask us for access to your personal data, for it to be corrected or deleted, for processing to be restricted, and for a copy in a portable format. You may object to processing based on legitimate interests, including direct marketing, which we stop on request, and you may withdraw a consent at any time with effect for the future.

Write to hello@valeno.at. We may ask you to confirm your identity, and we answer within one month; if a request is complex we may extend that and will tell you why.

If you are unhappy with how we handled your data you can complain to a supervisory authority: in Austria the Datenschutzbehörde (dsb.gv.at), in the United Kingdom the Information Commissioner's Office (ico.org.uk), or the authority where you live or work.

12. Children

Valeno is a service for businesses and is not directed at children. We do not knowingly collect data from anyone under 16 through the portal.

13. Changes to this policy

We update this policy when the Service or the providers behind it change. The current version is always on this page with its effective date, and we tell our customers by email before a material change takes effect.

14. Contact

Gradient Insight Ltd, Portsmouth, United Kingdom. Email: hello@valeno.at.