Privacy Policy

Effective from · 2026-09-25

Summary

Verne Ltd. (“Verne,” “we,” “us”) is a forward-deployed engineering firm. This policy explains what personal data we collect through our website at vernesystems.com and through commercial engagements, how we use it, who we share it with, how long we keep it, and the rights you have.

We collect the minimum information necessary to respond to inquiries, deliver contracted services, comply with applicable law, and run a small business. We do not sell personal information.

Data Controller

The data controller for processing described in this policy is Verne Ltd., registered at 8/A, Sher-e-Bangla Road, Zighatola, Dhaka-1209, Bangladesh. You can reach our privacy contact at info@vernesystems.com.

For client data processed inside systems Verne builds and operates on a client's behalf, Verne acts as a data processor under the data-processing terms of the engagement. The client is the controller of that data.

What We Collect

We collect personal information in three categories.

Information you give us

Contact intake. When you submit our contact form we collect your name, work email, phone (optional), organization, role, the service / industry / timeline / budget you select, and any message you provide.
Engagement data. If we sign an agreement, we receive professional details about you and your colleagues (name, role, work contact, organizational context) necessary to deliver the engagement.
Correspondence. Emails, calls, and meeting notes connected to a prospective or active engagement.

Information collected automatically

Server logs. When you visit vernesystems.com our infrastructure receives standard server-log information: IP address, user agent, referring URL, request path, and timestamps. These are used for security, abuse prevention, and aggregate diagnostics.
Cookies and similar. We use strictly necessary cookies for site operation. We do not run third-party advertising trackers. See our Cookie Notice for the full list.
Website analytics. With your consent, PostHog analytics records pages viewed, time on page, scroll depth, where you click (aggregated into heatmaps), clicks that get no response, JavaScript errors, referring site and campaign tags, approximate location derived from your IP address, device and browser, page-load performance, and session recordings with the contents of form fields masked. If you decline, PostHog still records the pages you view, page-load performance, and certain interactions under a privacy-preserving hash that changes daily, without analytics cookies and without a recording; only a cookie recording your choice is kept. Analytics does not load when your browser sends Do Not Track or Global Privacy Control. When you submit our contact form, PostHog receives a record that a submission occurred with the service, industry, timeline, and budget you selected; we never send your name, email, phone, company, or message to PostHog, and we never identify visitors to PostHog.

Information from third parties

Where you reach us via a professional network (LinkedIn, X, GitHub) or are introduced by a mutual contact, we may receive your public profile information in that context. We keep only what is necessary to respond.

How We Use Information

To respond to inquiries and schedule strategy calls.
To deliver, support, and improve the systems we build.
To maintain audit trails and meet our legal, accounting, and tax obligations.
To detect, prevent, and respond to abuse, fraud, and security incidents.
To understand, in aggregate, which pages and articles are useful and improve the site.
To send transactional communications related to an engagement.
With your explicit opt-in, to send occasional editorial updates (Insights essays, announcements). You can unsubscribe at any time.

Legal Bases

Where the GDPR or analogous regimes apply, we rely on the following legal bases:

Performance of a contract, to deliver an engagement we have agreed to.
Legitimate interests, to respond to inbound inquiries, operate the website and its consent banner securely, measure page activity without cookies when analytics is declined, and run our business. We balance these interests against your rights and freedoms.
Consent, for analytics cookies and session recordings, optional editorial communications, and any other non-essential processing. You can withdraw consent at any time with Cookie settings in the site footer.
Legal obligation, for accounting, tax, and similar regulatory requirements.

We share personal information only where necessary to deliver a service, comply with law, or operate the business. Our standing categories of recipients include:

Cloud and infrastructure providers hosting our website, email, calendaring, document storage, and engagement platforms.
Analytics provider: PostHog, Inc. (United States) processes website analytics on our behalf.
Professional advisors (accountants, legal counsel) bound by professional secrecy.
Authorities when compelled by valid legal process, after assessing the request.

We do not sell personal information, and we do not share it with advertising networks.

Retention

Contact-form submissions are retained for up to 24 months from last contact, then deleted or anonymized. Engagement records are retained for the longer of (a) the duration of the engagement plus seven years for accounting and audit purposes, or (b) the period required by applicable law. Server logs are rotated within 90 days. Website analytics events are kept for up to 12 months and session recordings for up to 30 days.

International Transfers

Verne is based in Bangladesh. Our infrastructure providers may process data in the United States, the European Union, and other regions. Where personal data is transferred outside its jurisdiction of origin, we rely on appropriate safeguards, including Standard Contractual Clauses, equivalent mechanisms, or your explicit consent, and we contractually require sub-processors to apply the same standards.

Your Rights

Subject to your jurisdiction, you have the right to:

Access the personal information we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of personal information we no longer need to retain.
Object to or restrict processing based on legitimate interests.
Withdraw consent where processing is based on it.
Receive your data in a portable, machine-readable format.
Lodge a complaint with your supervisory authority.

To exercise any of these rights, email info@vernesystems.com. We respond within 30 days.

Security

We engineer security into every system we build and operate. For our own information systems we apply role-based access control, encryption in transit and at rest, append-only audit logging, regular vulnerability review, and least-privilege sub-processor relationships. No system is perfectly secure; we take reasonable steps proportionate to the sensitivity of the data we process, and we will notify you and the relevant authorities of a personal-data breach as required by law.

AI Systems We Build

For AI systems Verne builds for a client, the following principles apply by default unless otherwise contracted:

We do not train foundation models on client data.
Inference runs in tenant-isolated environments with role-aware access enforced at the data and action layer.
Every prompt, retrieval, tool call, and decision is logged to an append-only audit store with cryptographic chain-of-custody, reconstructable for the contracted retention period.
High-stakes actions remain behind human approval gates. The client controls what is autonomous and what requires review.

Changes

We may update this policy as our practices, infrastructure, or applicable law evolves. We post the current version at this URL with the “Effective from” date above. Material changes will be communicated to active clients through the engagement.

Contact

Privacy questions, rights requests, and complaints: info@vernesystems.com. Postal address: 8/A, Sher-e-Bangla Road, Zighatola, Dhaka-1209, Bangladesh.