Zurück

Privacy Policy

As of May 15, 2026. We take the protection of your data seriously. This policy describes what data we collect and why.

1. Controller

Market Value Advisory S.A. A sociedad anónima incorporated in Costa Rica Represented by Dennis Bernhard, President Email: office@marketvalueadvisory.com
Email: office@marketvalueadvisory.com

2. Processed data

We process data in the following contexts:

  • Onboarding form: Name, email, company, industry, goal, and free-text description of your situation.
  • Intro call: Notes from the call to prepare the diagnosis.
  • Server logs: IP address, user agent, timestamp — exclusively for security and availability analysis.

3. Legal basis

Processing takes place on the basis of Art. 6 (1) (b) GDPR (contract initiation) and Art. 6 (1) (f) GDPR (legitimate interest in a secure, functional website). For US visitors, processing additionally complies with CCPA/CPRA principles for California residents.

4. Retention period

Onboarding data is stored until completion of the request and afterwards for the statutory retention period. Server logs are deleted after a maximum of 30 days.

5. Sharing with third parties (processors)

We only share your data with the following processors necessary to provide our service:

  • Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. EU edge location preferred; US third-country transfer covered under EU-US Data Privacy Framework.
  • AI module (interactive assistant): OpenAI Inc., 3180 18th Street, San Francisco, CA 94110, USA. Enterprise API contract without training opt-in. Inputs are NOT used to train models.
  • AI module (interactive assistant, alternative): Anthropic PBC, 548 Market Street PMB 90375, San Francisco, CA 94104, USA. Enterprise API contract without training opt-in.
  • Email delivery: likely Resend Inc. or Postmark — final selection will be updated before go-live.

All providers operate under GDPR-compliant data processing agreements (Art. 28 GDPR). US third-country transfer is based on the EU-US Data Privacy Framework. For California residents, we do not 'sell' personal information as defined by CCPA/CPRA.

6. Hosting

This website is hosted by Vercel Inc. Vercel stores technical data (IP, user agent, request time) for platform operation and security. EU server location preferred; edge functions may process at Vercel edge locations worldwide (US third-country transfer under EU-US Data Privacy Framework).

7. AI diagnosis module

The website provides an interactive AI assistant (reachable via the "Ask AI" pill or Cmd+K). When you enter a question, your text is forwarded to an AI provider (e.g. OpenAI, Anthropic), processed there, and the response is sent back to you. Inputs are NOT used to train models (enterprise API contracts without training opt-in).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a working pre-sales tool). Data processing with the respective AI providers; servers partially in the USA (third-country transfer under EU-US Data Privacy Framework). Optional voice recording happens locally in the browser and is only sent to a transcription service with your explicit confirmation.

8. Cookies and local storage

This website uses exclusively technically necessary cookies (e.g. for storing your cookie decision). Optional analytics tools (Vercel Analytics, fully IP-anonymized, no cross-site tracking) are only activated after your consent via the consent banner. You can revoke your consent at any time — the keymva-consent-v1in browser settings under "localStorage".

9. Your rights

You have the right at any time to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR). California residents have additional rights under CCPA/CPRA, including the right to know, delete, and opt out of sale. A request by email to the address above is sufficient.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). US residents may also contact relevant state authorities (e.g. California Attorney General).

11a. California Residents — CCPA/CPRA Disclosures

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), 1798.100 et seq.

Categories of personal information: Categories of personal information we collect: identifiers (name, email), commercial info (your stated business situation), internet activity (IP, user-agent, request times from server logs), inferences drawn from the above. We do not collect sensitive personal information as defined by CPRA § 1798.140(ae).

Sources of collection: Sources of collection: directly from you (onboarding form, intro call notes); automatically (server logs); from public sources (LinkedIn data you choose to share).

Business purposes: Business and commercial purposes: providing our services, communications, security analysis, contract performance. We do not use your data for cross-context behavioral advertising.

Sharing: Sharing: with processors listed in section 5 (Vercel, OpenAI/Anthropic, email provider) — strictly for service delivery, not for sale.

Your rights: Your CCPA/CPRA rights: right to know (1798.100), right to delete (1798.105), right to correct (1798.106), right to opt-out of sale/sharing (1798.120) — we do not sell or share for cross-context advertising, but you may still submit a request, right to limit use of sensitive PI (1798.121, n/a as we collect none), right to non-discrimination (1798.125).

Global Privacy Control: Global Privacy Control (GPC): we honor browser-level GPC signals. If your browser sends a GPC signal, we treat it as a valid opt-out request automatically.

How to exercise: How to exercise rights: email the address in section 1 with subject 'CCPA/CPRA Request'. We will respond within 45 days (extendable by 45 days with notice, per § 1798.130).

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have substantially similar rights and may exercise them via the same channel.

11. Children's privacy

This site is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us at the address above and we will delete it (COPPA, 15 U.S.C. §§ 6501–6506).

This privacy policy is a skeleton. Once tracking tools or marketing-automation tools are deployed, it must be updated accordingly.