Privacy Policy

Summary

Verne Systems (“Verne,” “we,” “us”) is a forward-deployed engineering firm. This policy explains what personal data we collect through our website at vernesystems.com and through commercial engagements, how we use it, who we share it with, how long we keep it, and the rights you have.

We collect the minimum information necessary to respond to inquiries, deliver contracted services, comply with applicable law, and run a small business. We do not sell personal information.

Data Controller

The data controller for processing described in this policy is Verne Systems, registered at 8/A, Sher-e-Bangla Road, Zighatola, Dhaka-1209, Bangladesh. You can reach our privacy contact at info@vernesystems.com.

For client data processed inside systems Verne builds and operates on a client's behalf, Verne acts as a data processor under the data-processing terms of the engagement. The client is the controller of that data.

What We Collect

We collect personal information in three categories.

Information you give us

• Contact intake. When you submit our contact form we collect your name, work email, phone (optional), organization, role, the service / industry / timeline / budget you select, and any message you provide.
• Engagement data. If we sign an agreement, we receive professional details about you and your colleagues (name, role, work contact, organizational context) necessary to deliver the engagement.
• Correspondence. Emails, calls, and meeting notes connected to a prospective or active engagement.

Information collected automatically

• Server logs. When you visit vernesystems.com our infrastructure receives standard server-log information: IP address, user agent, referring URL, request path, and timestamps. These are used for security, abuse prevention, and aggregate diagnostics.
• Cookies and similar. We use only strictly necessary cookies for site operation. We do not run third-party advertising trackers. See our Cookie Notice for the full list.

Information from third parties

Where you reach us via a professional network (LinkedIn, X, GitHub) or are introduced by a mutual contact, we may receive your public profile information in that context. We keep only what is necessary to respond.

How We Use Information

• To respond to inquiries and schedule strategy calls.
• To deliver, support, and improve the systems we build.
• To maintain audit trails and meet our legal, accounting, and tax obligations.
• To detect, prevent, and respond to abuse, fraud, and security incidents.
• To send transactional communications related to an engagement.
• With your explicit opt-in, to send occasional editorial updates (Insights essays, announcements). You can unsubscribe at any time.

Legal Bases

Where the GDPR or analogous regimes apply, we rely on the following legal bases:

• Performance of a contract, to deliver an engagement we have agreed to.
• Legitimate interests, to respond to inbound inquiries, operate the website securely, and run our business. We balance these interests against your rights and freedoms.
• Consent, for optional editorial communications and any non-essential processing.
• Legal obligation, for accounting, tax, and similar regulatory requirements.

Sharing & Sub-processors

We share personal information only where necessary to deliver a service, comply with law, or operate the business. Our standing categories of recipients include:

• Cloud and infrastructure providers hosting our website, email, calendaring, document storage, and engagement platforms.
• Professional advisors (accountants, legal counsel) bound by professional secrecy.
• Authorities when compelled by valid legal process, after assessing the request.

We do not sell personal information, and we do not share it with advertising networks.

Retention

Contact-form submissions are retained for up to 24 months from last contact, then deleted or anonymized. Engagement records are retained for the longer of (a) the duration of the engagement plus seven years for accounting and audit purposes, or (b) the period required by applicable law. Server logs are rotated within 90 days.

International Transfers

Verne is based in Bangladesh. Our infrastructure providers may process data in the United States, the European Union, and other regions. Where personal data is transferred outside its jurisdiction of origin, we rely on appropriate safeguards, including Standard Contractual Clauses, equivalent mechanisms, or your explicit consent, and we contractually require sub-processors to apply the same standards.

Your Rights

Subject to your jurisdiction, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal information we no longer need to retain.
• Object to or restrict processing based on legitimate interests.
• Withdraw consent where processing is based on it.
• Receive your data in a portable, machine-readable format.
• Lodge a complaint with your supervisory authority.

To exercise any of these rights, email info@vernesystems.com. We respond within 30 days.

Security

We engineer security into every system we build and operate. For our own information systems we apply role-based access control, encryption in transit and at rest, append-only audit logging, regular vulnerability review, and least-privilege sub-processor relationships. No system is perfectly secure; we take reasonable steps proportionate to the sensitivity of the data we process, and we will notify you and the relevant authorities of a personal-data breach as required by law.

AI Systems We Build

For AI systems Verne builds for a client, the following principles apply by default unless otherwise contracted:

• We do not train foundation models on client data.
• Inference runs in tenant-isolated environments with role-aware access enforced at the data and action layer.
• Every prompt, retrieval, tool call, and decision is logged to an append-only audit store with cryptographic chain-of-custody, reconstructable for the contracted retention period.
• High-stakes actions remain behind human approval gates. The client controls what is autonomous and what requires review.

Changes

We may update this policy as our practices, infrastructure, or applicable law evolves. We post the current version at this URL with the “Effective from” date above. Material changes will be communicated to active clients through the engagement.

Contact

Privacy questions, rights requests, and complaints: info@vernesystems.com. Postal address: 8/A, Sher-e-Bangla Road, Zighatola, Dhaka-1209, Bangladesh.