Privacy Policy
At Deventura, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, and safeguard your information in compliance with the General Data Protection Regulation (GDPR) and other applicable laws.
Last updated: September 2026
1. Roles and Responsibilities
Data Processor
When you use our platform, Deventura acts as a Data Processor on behalf of your organization (the Data Controller). We process personal data according to your instructions and solely for the purpose of providing our services.
Data Controller
Deventura acts as a Data Controller when processing data for our own purposes, such as managing customer relationships, marketing communications (with consent), and improving our services.
2. Information We Collect
We collect information necessary to provide and improve our services. This includes data you provide directly and data collected automatically through your use of our platform.
Information You Provide
- Account Data: Name, email address, company name, and role
- Team Information: Team structure and member details
- Repository Access: Connection to your version control systems
- Support and Communication Data: Messages and requests you send us
Information Automatically Collected
- Git Metadata: Commit history, merge request data, and code review activity
- Performance Metrics: Delivery patterns and workflow data
- Platform Usage: How you interact with our dashboard and features
- Technical Data: Browser type, IP address, and device information
Product analytics in the Deventura portal
To improve the portal and fix errors, we collect which pages and features are used, error reports, and technical information such as browser and screen size. We link this to a pseudonymous internal user number and your organization, never to your name or email address. We do not record your screen, never collect the performance data the portal displays, and store nothing on your device (no cookies or similar technologies).
Legal basis: our legitimate interest in improving our service and keeping it reliable (Art. 6(1)(f) GDPR). Our product analytics provider processes the data on our behalf in the EU (see deventura.com/subprocessors). The data is retained for up to 7 years.
Your right to object: you can object at any time by contacting your organization's administrator or dpo@deventura.com. We will stop the processing for your account, normally within 5 working days, and confirm to you when it is done.
3. How We Use Your Information
We use the information we collect for the following purposes:
- Deliver and maintain our services: Provide the Deventura platform and its features
- Analyze developer performance: Generate insights and metrics for engineering teams
- Offer personalized coaching: Provide AI-powered recommendations for growth
- Communicate with you: Send service updates, respond to inquiries, and provide support
- Monitor and address problems: Detect, prevent, and resolve technical issues
- Detect and prevent fraud or misuse
- Fulfill legal obligations: Comply with applicable laws and regulations
4. Data Security
We implement robust security measures to protect your data:
Key Security Measures
- Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.2+)
- No Code Retention: We do not store source code; only metadata and diff-based metrics are processed
- Access Control: Role-based access with authentication via username/password or SSO
- Hosting: Infrastructure hosted on Google Cloud Platform with enterprise-grade security
- Audits: Regular security assessments and vulnerability testing
5. Data Retention
We only retain personal data as long as necessary to:
- Provide the Service
- Comply with legal obligations
- Enforce agreements or resolve disputes
Retention periods include:
- Account data: Retained until end of contract plus 60 days for final processing
- Support communications: Retained up to 3 years
- Git and technical data: Retained for 60 days after processing
- Portal usage data (product analytics): Retained up to 7 years
- HR applications: Retained for 6 months after rejection unless consent is given for longer
After the retention period, data is securely deleted or anonymized.
6. Sharing of Data
We may share your information in the following circumstances:
- Service Providers: With trusted third-party vendors who assist in delivering our services
- Legal Entities: When required by law or to respond to legal process
- Business Transfers: In connection with a merger, acquisition, or sale of assets
- With Consent: When you have given explicit consent to share your data
Our subprocessors
We engage a limited number of subprocessors to deliver our services. The current list, including the purpose, the categories of personal data and data subjects concerned, and the processing location for each subprocessor, is maintained at deventura.com/subprocessors. Customers are notified of any changes to this list and may object within fourteen (14) days, as set out in our Data Processing Addendum. All subprocessors are bound by written agreements imposing data protection obligations equivalent to those in our DPA.
7. International Data Transfers
Our primary data storage is located within the European Union (EU) / European Economic Area (EEA). When we transfer personal data outside the EU/EEA, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable
- Additional technical and organizational measures as needed
8. Your Rights Under GDPR
As a data subject, you have the following rights under GDPR:
- Right of Access: Request a copy of the personal data we hold about you
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure: Request deletion of your personal data under certain conditions
- Right to Restriction: Request limitation of processing in specific circumstances
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests or for direct marketing
To exercise any of these rights, please contact us at privacy@deventura.com.
10. Job Applicants
If you apply for a position at Deventura, we collect and process your application data including your CV, cover letter, and any other information you provide. This data is used solely for recruitment purposes and is retained for 6 months after the recruitment process ends, unless you consent to longer retention for future opportunities.
11. Contractors and Suppliers
We process personal data of contractors and suppliers to manage our business relationships. This includes contact information, payment details, and contract-related data. Processing is based on contractual necessity and our legitimate business interests.
12. No Sale of Personal Data
Deventura does not sell personal data. We do not share personal information with third parties for monetary or other valuable consideration, as defined under the California Consumer Privacy Act (CCPA) and similar regulations. Your data is used exclusively to provide and improve our services for your organization.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by email. The "Last updated" date at the top of this policy indicates when it was last revised.
Contact Information
If you have any questions about this Privacy Policy or our data practices, please contact us:
Privacy inquiries: privacy@deventura.com
Data Protection Officer: dpo@deventura.com
General inquiries: info@deventura.com
Ready to understand how AI is changing delivery?
Book a demo to see how Deventura connects AI adoption to software delivery outcomes, quality signals, and investment return.
Book a demo