Privacy Policy

1. Scope

This Privacy Policy explains how Indavera handles personal information in connection with its website, account creation, hosted compliance platform, onboarding and document-generation tools, customer support, billing, and related services.

For customer-controlled compliance data, Indavera may act as a processor/service provider on behalf of the business customer, while the customer determines why and how that data is used. For account, billing, security, website, and business-contact information, Indavera may act as a controller/business depending on applicable law. Contractual data-processing terms define these roles more precisely.

2. Information collected

• Account and business information — legal business name, business type, jurisdiction, licensing status and license number where provided, user name, email address, and optional phone number.
• Onboarding/KYC-KYB information — uploaded business documents, beneficial-ownership information, expected business activity, and review notes.
• Transaction and compliance information — transaction records imported or transmitted by API, counterparty information derived from those records, alerts, cases, evidence, investigation notes, screening information, regulatory-report data, and generated compliance documents.
• Files — transaction imports, onboarding documents, case evidence, policies, and other documents uploaded by authorized users.
• Technical and security information — login/session metadata, access tokens, audit events, and technical error/crash data.
• Billing information — processed through Stripe. Indavera receives relevant subscription and plan status information; payment-card or other payment details are handled by Stripe according to Stripe's own services.

3. How information is used

Indavera uses information to provide and operate the Services; authenticate users; maintain tenant access controls; ingest and monitor transactions; perform screening; support onboarding; manage alerts, investigations, cases, evidence, and reports; generate compliance documents; provide AI-assisted features; process subscriptions; communicate with users; maintain security and audit records; troubleshoot errors; comply with law; and protect the rights and security of Indavera, its customers, and users.

4. Artificial intelligence processing

Certain product features send information relevant to the requested function to integrated AI providers. Depending on the feature, this may include transaction data, case information, policy content, or uploaded onboarding documents.

Indavera's software includes controls intended to request restricted provider use and data-region handling. Indavera does not promise that a specific provider contract guarantees zero retention or no training unless that contractual commitment has been verified and is current.

AI output is used as advisory assistance and remains subject to customer review. See our AI Transparency Notice.

5. Service providers / subprocessors

Current platform integrations include:

• Auth0 — identity and authentication. On termination, user identities are anonymized, blocked from login, and active sessions revoked while a non-identifying placeholder may remain so historical audit events stay attributable.
• Stripe — payment processing and subscription billing. Indavera can delete the customer payment-profile object and stored payment methods; Stripe may retain invoice/transaction records under its own financial-recordkeeping obligations.
• Amazon Web Services / S3 — storage of uploaded files, encrypted at rest. Supported document files are deleted when the associated document record is purged.
• Anthropic and OpenAI — AI-assisted features where invoked. Indavera uses stateless calls and does not use provider persistent-memory/file-storage features for these workflows; provider-side request-log retention remains governed by the applicable provider terms and contract.
• NameScan — sanctions and PEP screening. Indavera does not currently have a self-service deletion API for provider-held scan history; applicable retention/deletion depends on the vendor arrangement.
• Sentry — technical error monitoring, configured not to receive default personal information.
• Transactional email — provider to be confirmed; vendor-specific deletion handling will be established when the production provider is selected.

This list may change as vendors or services change. See Security & Subprocessors for the current maintained version.

6. Cookies and local/browser storage

The current platform uses strictly necessary authentication/ session mechanisms. A short-lived prospect-session credential is stored during the self-service document-generation flow and is cleared when the browser tab closes. Logged-in use includes an access token/session mechanism.

As of the codebase review dated September 23, 2026, no Google Analytics, Meta Pixel, Hotjar, Mixpanel, Intercom, or comparable advertising/behavioral tracking scripts were present. See our Cookie Notice for details.

7. Legal bases

[COUNSEL TO LOCALIZE.] Depending on jurisdiction and processing context, Indavera may rely on performance of a contract, legitimate interests, compliance with legal obligations, consent where required, and other lawful bases. Customer-controlled compliance data is generally processed under the customer's instructions and applicable data-processing agreement.

8. International transfers

Indavera and its service providers may process information in countries other than your own. Where required, Indavera implements an appropriate transfer mechanism and contractual safeguards. [COUNSEL / OPERATIONS TO CONFIRM DATA HOSTING LOCATIONS, TRANSFER MECHANISMS, AND REGIONAL CONFIGURATION.]

9. Security

Indavera uses technical and organizational measures intended to protect data, including tenant-level database isolation using PostgreSQL row-level security, encryption at rest for uploaded files, Auth0-based authentication, multi-factor authentication for sensitive actions, and append-only audit logging.

No security measure can eliminate all risk. Indavera does not claim SOC 2 Type II certification or attestation unless a current report or completed examination exists.

10. Retention and deletion

Indavera has implemented a Retention Policy Engine for supported record categories. The engine assigns retention at the record level, evaluates applicable jurisdiction/regulatory rules, allows a tenant to extend but not shorten an approved regulatory minimum, supports legal holds, and records an audit trail of retention and deletion events. Where a retention period cannot be resolved, the platform marks the record as unresolved for human/legal determination rather than inventing a period.

Records can move through active, soft-deleted, retention-locked, purge-eligible, and purged states. Soft deletion removes a record from ordinary operational views but does not necessarily destroy the underlying content. A record remains retention-locked while an applicable regulatory minimum or legal hold prevents deletion. When no such restriction remains, supported records may become purge-eligible and be permanently purged. For STR/SAR records, sensitive content can be scrubbed while a minimal tombstone is retained to evidence the filing history without retaining the report narrative.

As of September 2026, KYC/KYB and STR/SAR are the two data categories connected end-to-end to the automated retention/deletion engine. Other categories — including account/profile data, transactions, screening results, alerts, cases, general onboarding records, generated compliance documents, audit logs, security logs, billing, prospect data, support data, backups, and AI-generated artifacts — are classified in the retention schema but do not yet all have automated timers and purge hooks. We therefore do not state a universal automatic deletion period for those categories.

When a customer subscription ends, Indavera automatically suspends the workspace and begins a controlled termination process. After the applicable configured grace periods, tracked records are evaluated for deletion. Records subject to an unexpired regulatory requirement or legal hold are isolated and preserved; supported records that are eligible are purged; relevant third-party deletion/anonymization actions are initiated where technically available; and an audit record documents the process. Exact grace periods and backup-expiry estimates are not stated here until approved as formal business/legal commitments. Backup expiry is treated as an estimate rather than a verified deletion event.

Retention periods may also be affected by applicable law, regulatory obligations, litigation, law-enforcement or regulator requests, audits/examinations, preservation notices, disputes, and other lawful holds. Specific regulatory retention periods will be published only after the applicable rule and citation have been verified and activated for production use. See the dedicated Data Retention & Deletion page for a fuller explanation.

11. Rights and choices

Depending on applicable law and Indavera's role, individuals may have rights to request access, correction, deletion, restriction, portability, objection, or other privacy rights. For personal data that Indavera processes on behalf of a business customer, the individual should ordinarily submit the request to that business customer. The customer's authorized compliance staff can use Indavera tools to locate supported records and request access or deletion actions. Records that remain subject to a regulatory retention period or legal hold are reported as not yet deletable rather than treated as deleted.

Certain suspicious-activity reporting information is subject to special confidentiality and anti-tipping-off restrictions. Indavera's data-subject tooling structurally excludes STR/SAR-classified records from subject-access output and does not permit that exclusion to be disabled. Where applicable law prohibits disclosure, Indavera and its customers may be unable to confirm or deny the existence of such records.

Indavera's current tooling does not independently verify the identity of a person making a data-subject request. The relevant customer/controller must apply an appropriate identity-verification process before fulfilling a request.

Privacy requests relating directly to Indavera as controller: support@indavera.com. Requests relating to data processed by Indavera for a business customer should normally be directed to that business customer.

12. Children

The Services are designed for business/professional use and are not directed to children. [COUNSEL TO SET APPROPRIATE AGE LANGUAGE.]

13. Regulatory and legal disclosures

Indavera may disclose information where required by law, legal process, court order, or governmental authority, or where reasonably necessary to protect security, rights, users, or the integrity of the Services, subject to applicable law and contractual obligations.

14. Changes

Indavera may update this Privacy Policy as its Services, vendors, and legal obligations change. The current version identifies its effective date, and material updates are communicated where required.

15. Contact

Privacy: support@indavera.com
Legal entity: Centrico Technologies LLC
Address: Miami, Florida, USA
Data Protection Officer / representative, if applicable: [DETAILS]