Privacy Policy

We do not engage additional sub-processors beyond those listed above. We will update this list as our operations expand and notify users of any material additions through the policy update mechanism described in Section 13.

5. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected or as required by law:

• Inquiry data (engagement did not proceed): Retained for 24 months from date of submission for legal compliance, OFAC recordkeeping, and audit purposes, then securely deleted.
• Inquiry data (engagement proceeded to NDA stage): Retained for the duration of the NDA and for 5 years following NDA expiry or termination, consistent with standard commercial legal retention.
• Web server logs: Retained for 90 days for security and operational purposes, then deleted.
• Active client engagement data: Governed by the applicable Master Services Agreement. Upon engagement conclusion, all client workload data is erased per NIST SP 800-88 guidelines, and a certificate of erasure is issued to the client.

6. International Transfers

Verde Compute, Inc. is headquartered in the United States. If you are submitting an inquiry from outside the United States — including from the European Economic Area, United Kingdom, or Switzerland — your personal data will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland to the United States, we rely on the following legal mechanisms: (a) Standard Contractual Clauses (SCCs) as adopted by the European Commission where applicable; and (b) legitimate interest in conducting OFAC compliance screening as required by US law. We implement appropriate safeguards to ensure personal data receives protection equivalent to that required under GDPR.

By submitting an inquiry, individuals located in the EEA or UK acknowledge that their data will be processed in the US under the conditions described above.

7. Security

We implement technical and organizational measures appropriate to the sensitivity of the information we process. All inquiry submissions are transmitted over TLS. Internal access to inquiry data is restricted to authorized personnel on a need-to-know basis.

In the event of a confirmed security incident affecting personal data, we will notify affected parties within 72 hours of discovery, consistent with GDPR, CCPA, and NY SHIELD Act requirements.

8. Cookies & Web Technologies

This website uses no cookies of its own. We do not deploy analytics, advertising, or session cookies. No consent banner is displayed because no non-essential cookies are used.

Google Fonts are loaded from Google's servers. This is a standard web font delivery mechanism; your browser sends an IP address request to Google's servers as a technical byproduct. This occurs without any action from us and is governed by Google's Privacy Policy. If you prefer to block this, you may configure your browser to block third-party font requests.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to processing. To exercise any of these rights, contact [email protected]. We will respond within 30 days (or within any shorter period required by applicable law).

EEA/UK residents may also lodge a complaint with the relevant data protection supervisory authority in their member state. In the US, California residents may submit a verified consumer rights request under CCPA. See Section 10 for full regional detail.

10. State & Region-Based Data Rights

European Economic Area, United Kingdom & Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, the following rights apply under GDPR (Regulation (EU) 2016/679) or equivalent national legislation. Our lawful basis for processing inquiry data is legitimate interests (evaluating and responding to enterprise engagement inquiries) and legal obligation (OFAC/EAR compliance screening). We do not process personal data for marketing, automated profiling, or behavioral advertising.

• Right of Access — request a copy of personal data we hold about you
• Right to Rectification — request correction of inaccurate personal data
• Right to Erasure — request deletion of your personal data (“right to be forgotten”)
• Right to Restriction — request that we limit processing of your data
• Right to Data Portability — receive your data in a structured, machine-readable format
• Right to Object — object to processing based on legitimate interests
• Verde Compute, Inc. · Incorporated in the State of Delaware, United States
• For written correspondence: [email protected] (Electronic notice accepted)
• Response time: Within 30 calendar days for data subject requests (GDPR Art. 12)

Supervisory Authority. EEA residents have the right to lodge a complaint with the data protection supervisory authority in their EU member state. UK residents may contact the Information Commissioner's Office (ICO). Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC). You may also contact us directly at [email protected] before lodging a complaint, and we will endeavor to resolve your concern promptly.

California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the following rights:

• Right to Know — request disclosure of what personal information we collect, use, and share
• Right to Delete — request deletion of personal information we have collected
• Right to Opt-Out — we do not sell or share personal information for advertising; no opt-out required
• Right to Non-Discrimination — exercising your rights will not affect the quality of services you receive
• Right to Correct — request correction of inaccurate personal information

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising.

Other Jurisdictions

Residents of other jurisdictions with applicable data protection laws (including Canada PIPEDA, Brazil LGPD, Australia Privacy Act) may contact us at [email protected] to exercise applicable rights. We will respond within 30 days and apply the most protective applicable standard.

11. Automated Decision-Making

Verde Compute does not make any automated decisions about individuals that produce legal or similarly significant effects. Our inquiry evaluation process involves human review. No profiling, scoring, or automated rejection is applied to engagement inquiries.

12. Children

Our website and services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be noted by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

14. Contact & Data Protection

For privacy-related inquiries, data subject access requests, or to report a data protection concern:

• Email: [email protected]
• Legal: [email protected]
• [email protected]
• Verde Compute, Inc. · Delaware, United States

Verde Compute, Inc. does not currently have a designated Data Protection Officer (DPO), as our processing activities do not trigger mandatory DPO appointment under GDPR Article 37 at this stage of operations. As our processing activities expand, this position will be reviewed. Privacy inquiries are handled directly by legal counsel.