Privacy Policy

1. Information We Collect

We collect information you provide directly, including your name, email address, phone number, billing information, and any messages you submit. When you register using Google OAuth, we receive your name and email from Google. We also automatically collect usage data such as pages visited, features used, IP address, browser type, and device information.

2. How We Use Your Information

• To create and manage your account
• To deliver the services you have purchased or requested
• To process payments and send receipts and invoices
• To send transactional emails (order confirmations, renewal reminders, support responses)
• To improve and develop our platform and services
• To comply with legal obligations

3. Payment Processing

All payment transactions are processed by Stripe, Inc. (stripe.com), a PCI-DSS-compliant payment processor. Winvestour LLC does not store, access, or process credit card numbers directly. By completing a purchase, you also agree to Stripe’s Terms of Service and Privacy Policy. We retain transaction records including amounts, dates, and invoice references for accounting and legal compliance.

4. Data Storage & Security

Your personal data is stored on Neon PostgreSQL, a cloud database hosted in the United States. We use industry-standard encryption for data in transit (HTTPS/TLS) and at rest. Passwords are hashed using bcrypt and are never stored in plain text. We implement reasonable security measures to protect against unauthorized access, disclosure, or destruction of your data. No internet transmission is 100% secure.

5. Third-Party Services

We work with the following providers, each subject to their own privacy policy:

• Google OAuth – Account authentication
• Stripe – Payment processing
• Resend – Transactional email delivery
• Vercel – Platform hosting and CDN
• Neon – Database hosting

6. Children’s Privacy (COPPA)

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at support@winvestour.com and we will promptly delete it.

7. Data Retention

We retain your personal data for as long as your account remains active or as needed to provide our services. After account deletion, we retain certain records for up to 7 years for accounting, tax, and legal compliance. Payment transaction records may be retained longer as required by applicable law.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to correction: Request correction of inaccurate or incomplete data
• Right to deletion: Request deletion of your personal data (subject to legal retention requirements)
• Right to portability: Request your data in a portable format
• California residents (CCPA): You have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information (we do not sell your data)
• To exercise these rights, contact us at: support@winvestour.com

9. Cookies

We use only essential session cookies required for authentication and platform functionality. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. International Users

Winvestour LLC is operated from the United States. If you access our services from outside the United States, your data will be transferred to and processed in the United States. By using our services, you consent to this transfer.

11. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of the State of Wyoming, United States, without regard to its conflict of law provisions. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Sheridan County, Wyoming.

12. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the “Last Updated” date and, where required, notify you by email. Your continued use of our services after any changes constitutes your acceptance of the revised policy.

13. Contact

For questions about this Privacy Policy or to exercise your data rights: support@winvestour.com | Winvestour LLC, Wyoming, United States

14. Legal Bases for Processing (GDPR Art. 6)

Where the EU/EEA or UK General Data Protection Regulation, the Turkish KVKK, or similar laws apply, we process your personal data only where a legal basis exists: (a) performance of a contract — to create your account and deliver the products and services you purchase (Art. 6(1)(b)); (b) legal obligation — accounting, tax and bookkeeping records (Art. 6(1)(c)); (c) our legitimate interests — securing the platform, preventing fraud and abuse, maintaining tamper-evident audit logs, and improving our services, balanced against your rights (Art. 6(1)(f)); and (d) your consent — for analytics and marketing cookies and for marketing communications, which you may withdraw at any time with effect for the future (Art. 6(1)(a), Art. 7(3)).

15. Your Rights under GDPR / KVKK

Subject to the conditions and exemptions of applicable law, you have the right to:

• Access — obtain confirmation of whether we process your personal data and receive a copy of it (Art. 15). A self-service export is available in your account settings.
• Rectification — have inaccurate personal data corrected and incomplete data completed (Art. 16). Most profile data can be corrected directly in your settings.
• Erasure ("right to be forgotten") — request deletion of your personal data (Art. 17). On account deletion your personal fields are irreversibly anonymized after a 90-day safety window; transactional records we must keep by law are retained in anonymized form.
• Restriction of processing (Art. 18) and objection to processing based on legitimate interests, including direct marketing (Art. 21).
• Data portability — receive the personal data you provided in a structured, commonly used, machine-readable format (Art. 20). The self-service export provides this.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
• Lodge a complaint with a supervisory authority — in the EU/EEA, the authority of your habitual residence or place of work; in Türkiye, the KVKK Board (Kişisel Verileri Koruma Kurulu).
• To exercise any of these rights, contact privacy@winvestour.com. We respond within one month (extendable by two further months for complex requests, in which case we will inform you). We may need to verify your identity before acting on a request.

16. Data Retention Schedule

We keep personal data no longer than necessary for the purposes described in this policy. In particular: account data is kept for the life of the account and irreversibly anonymized 90 days after deletion; cookie-consent records are kept for 3 years as evidence of consent; expired verification codes are purged automatically; financial and order records are retained for the statutory accounting period (personal fields anonymized on erasure); identity-verification (KYC) documents are kept only for the duration of the relevant business relationship plus a dispute window, then deleted. An automated daily retention job enforces these periods.

17. International Data Transfers

Winvestour LLC is established in the United States and our subprocessors primarily process data in the United States. Where data of individuals in the EU/EEA, the UK, Switzerland or Türkiye is transferred internationally, we rely on the safeguards offered by our subprocessors — in particular the European Commission’s Standard Contractual Clauses (SCCs) and equivalent mechanisms — together with technical and organizational measures such as TLS encryption in transit, encryption at rest, and application-level encryption of highly sensitive fields. A current list of subprocessors and their locations is published on our Subprocessors page.

18. Subprocessors

We use a limited set of vetted service providers to operate the platform, each bound by a data-processing agreement: Anthropic (AI features), Stripe (payments — card data never touches our servers), Vercel (hosting and file storage), Neon (database), Resend (email), Google (sign-in), Twilio (SMS), NameSilo (domain registration) and Upstash (rate limiting). The authoritative, always-current register — including purpose and location for each provider — is available at winvestour.com/subprocessors. We will update that page before adding a new subprocessor.

19. Automated Decision-Making and AI

Some features of the platform use artificial intelligence (Anthropic Claude) — for example generating site content and designs, assisting the in-app assistant, and pre-assessing influencer applications, identity documents and campaign content. These AI outputs assist and accelerate decisions; they do not produce legal effects concerning you without human oversight: our review endpoints allow a human administrator to override every automated assessment, and you may contest an automated outcome by contacting privacy@winvestour.com. Content you submit to AI-powered features is processed by Anthropic as our subprocessor under a data-processing agreement and is not used by us to build advertising profiles.

20. Demonstrable Consent & Cookie Records

Where we rely on your consent (analytics or marketing cookies, marketing communications), we keep a server-side record of the consent decision — the choices made, the policy version shown, a timestamp, and technical metadata — so that consent can be demonstrated as required by GDPR Art. 7(1). You can change or withdraw your cookie choices at any time from the cookie banner or your settings; withdrawal takes effect immediately for future processing.

21. Data Protection Contact

For all privacy and data-protection matters (including exercising your rights under Sections 14–20), contact: privacy@winvestour.com, or by post: Winvestour LLC, Sheridan, Wyoming, United States. If we appoint a Data Protection Officer or an EU/UK representative, we will publish their contact details in this policy.