How we protect your data.

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, phone number, business name, business type, and password when you register.
• Profile and business information: For Vendors, this includes business details, service categories, pricing, portfolio images, service area, bio, and social media links.
• Communications: Messages sent through the Platform between Vendors and Customers, support inquiries, and email correspondence with Viceroy NM.
• Financial information: Billing details processed via Stripe (we do not store raw card numbers). Bank account information for Stripe Connect payouts is held by Stripe directly.
• User content: Portfolio images, gallery photos, proposals, contracts, client records, event data, and any other content you upload to the Platform.
• AI training data: Communications you upload to create your private Brand Voice Profile (stored within your tenant only).

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, clicks, search queries, time spent on pages, and interaction patterns.
• Device and technical data: IP address, browser type, operating system, device identifiers, and referral URLs.
• Cookies and tracking technologies: As described in our Cookie Policy.
• Log data: Server logs including timestamps, request types, response codes, and error messages.

1.3 Information from Third Parties

• Payment processor: Transaction confirmations and payout status from Stripe.
• AI provider: Inference outputs from Anthropic (Claude) in connection with AI features. Anthropic does not return raw prompt content to us beyond what is necessary to complete the inference request, and Anthropic does not train its foundation models on data submitted via the Anthropic API as configured in our integration.
• Analytics providers: Aggregated, de-identified usage analytics.

2. How We Use Your Information

We use your information to provide and operate the Platform, process payments and manage subscriptions, generate AI-powered features (lead scoring, proposals, forecasts, marketplace matching), send transactional communications (invoices, contracts, notifications, California ARL renewal reminders), provide customer support, improve Platform functionality and fix bugs, enforce our Terms and policies, comply with legal obligations, and send marketing communications (only with your consent and only where required).

3. How We Share Your Information

3.1 Marketplace Visibility

Vendor profile information (name, bio, portfolio, service category, starting price, service areas, and reviews) is displayed publicly on the Zennvue marketplace to enable discovery by Customers. Customer information is not displayed publicly except as you choose to share it with a specific Vendor through messaging or booking.

3.2 Service Providers

We share data with service providers who help us operate the Platform:

• Stripe: Payment processing and Stripe Connect payouts
• Anthropic: AI inference (Claude API) for Trunnion AI features
• Cloud infrastructure provider: Application hosting and storage
• Email and SMS providers: Transactional notifications and messages
• Customer support tooling: Help desk and inbox management

These parties are contractually bound to protect your data and may only use it to provide services to us.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.

3.4 Legal Compliance

We may disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of Viceroy NM, our users, or the public. We will challenge overbroad requests where appropriate.

3.5 We Do Not Sell Your Personal Information

Viceroy NM does not sell or share your personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. See Section 6 below for your CCPA rights, including the right to opt out of sale or sharing.

4. Data Retention Lifecycle

We retain your account data for as long as your account is active. After account termination, your data moves through a defined lifecycle to give you a clear window to recover or export, followed by orderly permanent deletion. This lifecycle matches the one in our Terms of Service Section 11.3:

• Day 0 to Day 30 (Grace Period): Your account data remains accessible. You may export everything (CSV, PDF, JSON) and you may reactivate at any time.
• Day 30 (Soft Delete): Account removed from active systems. Data is no longer accessible through the Platform interface.
• Day 30 to Day 60 (Hard Delete in Progress): Data is permanently purged from production databases on a rolling basis.
• Day 60 to Day 90 (Backup Cycle Out): Encrypted backup snapshots cycle out of retention.
• Day 90 (Full Deletion Complete): All copies of your data are permanently deleted, except as required to comply with legal obligations (tax records, accounting, litigation holds).

AI training data (Brand Voice Profile samples) is purged immediately at account termination and does not persist into the backup cycle. Anonymized, aggregated analytics may be retained longer for product improvement purposes; this data is not linked to identifiable individuals.

5. Your Privacy Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Correct inaccurate or incomplete data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• Restriction or objection: Object to or restrict certain processing
• Opt-out of marketing: Unsubscribe from non-transactional emails

To exercise these rights, contact privacy@zennvue.com or use the relevant controls in your account settings. We will respond within 45 days (with a possible 45-day extension where allowed by law). We may need to verify your identity before processing requests to protect against fraudulent access attempts.

6. California Consumer Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"). This section applies to personal information of California residents subject to the CCPA.

6.1 Categories of Personal Information Collected

In the preceding 12 months, Viceroy NM has collected the following categories of personal information about California residents:

• Identifiers: Name, email address, phone number, IP address, account ID
• Customer records: Business name, business address, billing information (processed by Stripe; we do not store raw card numbers)
• Commercial information: Subscription tier, transaction history, contracts, proposals
• Internet/network activity: Browsing history within the Platform, search queries, interaction patterns
• Geolocation data: Approximate location derived from IP address (for service-area matching and security)
• Professional information: Vendor service categories, portfolio, pricing, reviews
• Inferences: AI-derived attributes such as lead scores, brand voice profiles, churn predictions

We collect this information from the sources described in Section 1 above and use it for the purposes described in Section 2.

6.2 Categories of Personal Information Disclosed

In the preceding 12 months, Viceroy NM has disclosed the categories of personal information listed in Section 6.1 to the service providers listed in Section 3.2 for business purposes. Each disclosure is governed by a written contract that prohibits the service provider from using the information for any purpose other than performing services for us.

6.3 Sale or Sharing of Personal Information

Viceroy NM does not sell personal information. Viceroy NM does not share personal information for cross-context behavioral advertising (as those terms are defined under the CCPA).

6.4 Your CCPA Rights

California residents have the right to:

• Right to know: Request the categories and specific pieces of personal information we have collected, used, disclosed, and (if applicable) sold or shared in the preceding 12 months.
• Right to delete: Request deletion of your personal information, subject to exceptions for legal compliance, security, fraud prevention, completion of transactions, and certain internal uses.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale or sharing: Direct us not to sell or share your personal information (see the "Do Not Sell or Share" link above).
• Right to limit use of sensitive personal information: Direct us to limit the use and disclosure of sensitive personal information (we do not currently use sensitive PI for purposes that would trigger this right, but you may submit a request to confirm).
• Right to non-discrimination: Exercise of any of these rights will not result in denial of service, different prices, or reduced quality.

6.5 How to Submit a CCPA Request

Submit a CCPA request by emailing privacy@zennvue.com with the subject line "CCPA Request" and a description of the right you wish to exercise. We will verify your identity using the email address and account information on file, and we will respond within 45 days (with a possible 45-day extension where allowed by law).

6.6 Authorized Agents

You may designate an authorized agent to submit a CCPA request on your behalf. The authorized agent must provide signed written permission from you, and we may require you to verify your identity directly with us before processing the request.

6.7 Complaints

If you believe we have not responded adequately to your CCPA request, you may contact the California Attorney General's office at oag.ca.gov/privacy/ccpa.

6.8 Non-California Residents

Privacy rights under U.S. state law are evolving rapidly. We currently provide CCPA rights to California residents. Where other U.S. state privacy laws apply, we apply substantially equivalent rights. Zennvue does not currently market to or serve customers in the European Union or United Kingdom. If our footprint expands to those jurisdictions, this Policy will be updated to reflect applicable rights under the GDPR, UK GDPR, and other applicable frameworks.

7. Security and Copyright

7.1 Security

We implement industry-standard security measures including encryption of data in transit (TLS) and at rest, session tokens validated at edge middleware, tenant-scoped database queries preventing cross-account data access, role-based access controls, and routine security reviews. Details are described on our Security page. Despite these measures, no system is perfectly secure. We cannot guarantee absolute security.

7.2 Copyright Notices (DMCA)

If you believe content on the Platform infringes your copyright, please follow the procedures in our DMCA Policy and direct notices to the Designated Agent identified in Terms of Service Section 14.

8. Children's Privacy

The Platform is not directed to individuals under 18. We do not knowingly collect personal information from minors. If we learn we have collected data from a minor, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal information, contact privacy@zennvue.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address on file or in-Platform notice at least 14 days before the effective date. For California residents, material changes that affect categories of personal information collected or shared will also be reflected in this Section 6 (CCPA) before they take effect. Your continued use constitutes acceptance of the updated Policy.

10. Contact

For privacy-related questions, CCPA requests, or to designate an authorized agent:

Email: privacy@zennvue.com (subject line should include "CCPA Request" or "Privacy Request")

Mail: