Privacy Policy

This Privacy Policy explains how Vent IT ("we", "us", or "our") collects, uses, stores, and shares information when you use our website and platform (the "Service"). We design Vent IT for privacy-first feedback where submitter identity is hidden from leadership in the dashboard, and we aim to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR where applicable, and other relevant data protection laws.

Vent IT is used by registered organisation users (owners, managers, and seated members). Members sign in to submit vents; leadership sees cleaned transcripts and AI insights without names or emails on those submissions.

For vent submissions processed on behalf of a customer organisation, that organisation is generally the data controller for workplace-related content, and Vent IT acts as a data processor.

For account registration, billing, website operation, and platform security, Vent IT acts as a data controller. Contact details are listed in our Imprint and at the end of this policy.

A. Vent submissions (signed-in members)

• Voice recording — captured locally in your browser and uploaded temporarily to Firebase Storage. Our servers then send the audio to Groq for speech-to-text transcription, and transcript text to xAI (Grok) for analysis. Raw audio is deleted from our Storage after successful processing by default.
• Category tags — optional labels you select from your organisation's business tags (plus Other).
• Recording metadata — duration, submission timestamp, processing status.
• Submitter account reference — your user id may be stored server-side with the vent so only seated members can submit and so we can support abuse handling. Owners and managers do not see your name or email on vents in the dashboard.
• Hashed fingerprint — a one-way hash derived from IP and user agent for abuse forensics. It is not shown in the dashboard.

B. Registered organisation users

• Account data — email address, display name, role (owner, manager, member), organisation membership, authentication identifiers via Firebase Auth.
• Invite data — email address, assigned role, invite token, expiry (invites expire after 7 days).
• Organisation data — organisation name, subscription plan, member count, owner reference.
• Usage and audit data — actions taken in the dashboard, such as team management and exports, where logged for security and support.

C. All visitors

• Local storage — theme preference (vent-theme) stored in your browser only.
• Essential server logs — request timestamps, error logs, and security events maintained by our hosting and infrastructure providers.

We do not use third-party advertising cookies or sell personal data. Cookie choices are described in Cookies and similar technologies.

• Provide member vent submission, transcription, and AI analysis features;
• Display transcripts and insights to authorised managers within an organisation;
• Authenticate users and enforce role-based access;
• Send team invitation emails when configured;
• Enforce rate limits and prevent abuse;
• Maintain, secure, and improve the Service;
• Comply with legal obligations and respond to lawful requests.

Where GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — providing the Service to organisations and registered users under our Terms.
• Legitimate interests (Art. 6(1)(f)) — securing the platform, preventing abuse, improving reliability, and processing vent submissions at the organisation's request. We balance these interests against keeping submitter identity hidden from leadership in product surfaces.
• Consent (Art. 6(1)(a)) — where required, such as optional non-essential communications. Microphone access is requested through your browser and is not stored by us beyond the recording you choose to submit.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with law.

We use carefully selected subprocessors to operate Vent IT. Data may be processed in the EU/EEA or in countries subject to appropriate safeguards.

Speech-to-text procedure (Groq). After a vent is uploaded to Firebase Storage, our application servers download the audio and send it to Groq's transcription API (/openai/v1/audio/transcriptions) over HTTPS as a one-time request. Groq returns transcript text. We do not grant Groq ongoing access to Firebase Storage. According to Groq's published data practices for GroqCloud, API customer data is not used to train models by default; Groq may retain inference inputs and outputs briefly for system reliability or abuse monitoring unless Zero Data Retention is enabled on the Groq account. Organisations should review Groq's current terms and data controls for their deployment.

Firebase for this project is configured in the Europe (europe-west1) region where applicable. Transfers outside the EU/EEA, if any, rely on Standard Contractual Clauses or equivalent mechanisms provided by the relevant vendor.

We retain data only as long as necessary for the purposes described below. Organisations may request deletion or export subject to their plan and applicable law.

Free Trial and unpaid organisations. New organisations may use a time-limited Free Trial. If the organisation remains unpaid after the trial (or after a paid subscription ends without a new paid plan), we remove organisation data — including vents, transcripts, invites, support tickets tied to the organisation, member records, and related Auth accounts — after a short retention window (typically 30 days from Free Trial signup, or about 30 days from the transition to unpaid / upgrade-only access when a paid plan ends). Upgrade before that window to keep your data under the paid retention rules below.

Vent IT is built so managers see insights, not submitter names or emails. However, identity cannot be guaranteed if a recording contains identifying information, if an organisation is legally required to investigate, or if technical support must access server logs. Organisations should communicate clear submission guidelines to staff.

Submissions require a seated member login so only invited people can vent. The dashboard inbox does not display who submitted. A server-side account reference may exist for seat enforcement and abuse handling.

We implement technical and organisational measures including encrypted transport (HTTPS), Firebase security rules that block client-side reads of vent data, server-side processing via authenticated admin services, role-based dashboard access, and least-privilege access for infrastructure.

Dashboard accounts support authenticator-app multi-factor authentication (TOTP) via Firebase Authentication. Owners, managers, and super-admins must enroll MFA before using privileged dashboard areas. Once enrolled, sign-in requires both password and a one-time code. Members may enroll MFA optionally from Profile → Preferences.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately.

Depending on your location, you may have the right to access, rectify, erase, restrict, object to processing, data portability, and withdraw consent where processing is consent-based.

Anonymous submitters who did not provide contact details may be unable to exercise some rights directly; organisations may field requests relating to workplace submissions they control. Registered users may contact us to exercise rights relating to account data.

You may lodge a complaint with your local supervisory authority. In Germany, this is typically your state data protection authority (Landesdatenschutzbehörde).

Vent IT is intended for workplace use and is not directed at children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy to reflect product, legal, or regulatory changes. Material updates will be posted on this page with a revised "Last updated" date. We encourage organisations to review this policy periodically.

Privacy enquiries: privacy@vent.app

General contact details: see our Imprint.