XPCO Inc. ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Ventura Machina platform and services (collectively, the "Service").
Please read this Privacy Policy carefully. By using the Service, you consent to the practices described in this policy.
1. Information We Collect
1.1 Personal Information You Provide
Account Information:
- Email address
- Username
- Full name
- Phone number (optional)
- Location (optional)
- Password (stored in hashed form)
Profile Information:
- User role and permissions
- Profile settings and preferences
Vehicle Information:
- Vehicle details (year, make, model, VIN, color, mileage)
- Purchase and financial information (purchase price, current value)
- Restoration project details (status, dates, budget)
- Owner information
- Notes and tags
1.2 Content You Upload
Images and Media:
- Photographs of vehicles and components
- Original filenames
- Image dimensions and file sizes
- User-provided titles, descriptions, and tags
EXIF Metadata:
When you upload images, we may extract embedded metadata including:
- Date and time the photo was taken
- Camera make and model
- GPS coordinates (location where photo was taken)
- Technical camera settings
Voice Data:
If you use voice features:
- Voice transcripts from speech-to-text conversion
- Voice commands and search queries
1.3 Information Collected Automatically
Usage Data:
- Pages and features accessed
- Actions taken within the Service
- Search queries performed
- Time spent on pages
- Referring URLs
Device Information:
- Browser type and version
- Operating system
- Device type and identifiers
- Screen resolution
Technical Information:
- IP address
- User agent string
- Session identifiers
- Cookies and similar technologies (see Cookie Policy)
Classification and Validation Data:
- AI-generated classifications
- Your validation decisions (approve, correct, reject, skip)
- Validation timing and statistics
- Correction notes
1.4 Information from Third Parties
We may receive information from:
- Authentication providers if you use single sign-on
- Payment processors for billing information
- Analytics services for aggregated usage data
2. How We Use Your Information
We use the collected information for the following purposes:
2.1 Providing and Improving the Service
- Create and manage your account
- Process and store your uploaded content
- Provide AI-powered image classification
- Enable search and retrieval features
- Generate validation statistics and reports
- Improve and optimize the Service
2.2 Communication
- Send service-related notifications
- Respond to your inquiries and support requests
- Provide updates about the Service
- Send marketing communications (with your consent)
2.3 Security and Compliance
- Detect and prevent fraud and abuse
- Enforce our Terms of Service
- Comply with legal obligations
- Protect our rights and property
2.4 AI and Machine Learning
- Train and improve our classification algorithms
- Develop new features and capabilities
- Analyze usage patterns to enhance user experience
2.5 Analytics and Research
- Understand how users interact with the Service
- Generate aggregated statistics
- Conduct research to improve automotive restoration documentation
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:
| Purpose | Legal Basis |
|---|---|
| Account management and service delivery | Performance of contract |
| AI classification and feature provision | Performance of contract |
| Security and fraud prevention | Legitimate interests |
| Service improvement and analytics | Legitimate interests |
| Marketing communications | Consent |
| Legal compliance | Legal obligation |
| Training AI models with your data | Legitimate interests (with opt-out) |
4. How We Share Your Information
4.1 Service Providers
We share information with third-party service providers who assist us in operating the Service:
| Provider Category | Purpose | Data Shared |
|---|---|---|
| Cloud Storage (AWS S3 / Backblaze B2) | Image storage | Uploaded images and metadata |
| AI Services (OpenAI / vLLM) | Image classification | Images for analysis |
| Vector Database (Qdrant) | Image similarity search | Image embeddings |
| Voice Services (Picovoice) | Wake word detection | Audio data |
| Hosting (Vercel) | Application hosting | Technical data |
| Analytics | Usage analysis | Aggregated usage data |
4.2 Business Transfers
If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
4.3 Legal Requirements
We may disclose your information if required by law, legal process, or government request, or to:
- Comply with applicable laws and regulations
- Respond to lawful requests from public authorities
- Protect our rights, privacy, safety, or property
- Enforce our Terms of Service
4.4 With Your Consent
We may share your information with third parties when you have given us explicit consent to do so.
4.5 Aggregated Data
We may share aggregated, anonymized data that cannot reasonably be used to identify you.
5. Data Retention
We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 30 days after deletion |
| Uploaded images | Duration of account + 30 days after deletion |
| EXIF metadata | Same as associated images |
| Classification data | Duration of account + 90 days (for AI training) |
| Validation history | Duration of account + 90 days |
| Usage logs | 12 months |
| IP addresses | 90 days |
| Voice transcripts | 30 days |
After the retention period, data is securely deleted or anonymized.
6. Your Rights and Choices
6.1 Account Settings
You can access and update your account information through the Service settings.
6.2 Data Export
You can export your data using the export feature in the Service.
6.3 Account Deletion
You can request deletion of your account by contacting us at privacy@venturamachina.com.
6.4 Marketing Communications
You can opt out of marketing emails by clicking "unsubscribe" in any marketing email or updating your preferences.
6.5 Location Data
You can prevent collection of GPS data by removing location information from photos before upload or disabling location services on your device.
7. Rights for EEA, UK, and Swiss Residents (GDPR)
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:
7.1 Right of Access
You can request a copy of the personal data we hold about you.
7.2 Right to Rectification
You can request correction of inaccurate or incomplete personal data.
7.3 Right to Erasure
You can request deletion of your personal data in certain circumstances.
7.4 Right to Restrict Processing
You can request that we limit how we use your data.
7.5 Right to Data Portability
You can request a machine-readable copy of your personal data.
7.6 Right to Object
You can object to processing based on legitimate interests, including for direct marketing.
7.7 Right to Withdraw Consent
Where processing is based on consent, you can withdraw consent at any time.
7.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority in your country of residence.
7.9 How to Exercise Your Rights
To exercise these rights, contact us at:
- Email: privacy@venturamachina.com
- Data Protection Officer: privacy@venturamachina.com
We will respond to requests within one month, which may be extended by two months for complex requests.
8. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
8.1 Right to Know
You have the right to know:
- Categories of personal information collected
- Sources of personal information
- Purposes for collecting or selling personal information
- Categories of third parties with whom we share personal information
- Specific pieces of personal information collected about you
8.2 Right to Delete
You have the right to request deletion of your personal information, subject to certain exceptions.
8.3 Right to Correct
You have the right to request correction of inaccurate personal information.
8.4 Right to Opt-Out of Sale/Sharing
You have the right to opt out of the "sale" or "sharing" of your personal information.
We do not sell your personal information.
We may share personal information with service providers for business purposes as described in Section 4.
8.5 Right to Non-Discrimination
We will not discriminate against you for exercising your privacy rights.
8.6 Categories of Information Collected
In the preceding 12 months, we have collected the following categories of personal information:
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, email, IP address | Yes |
| Personal Information (Cal. Civ. Code § 1798.80) | Name, address, phone number | Yes |
| Protected Classifications | None | No |
| Commercial Information | Purchase history, vehicle financial data | Yes |
| Biometric Information | None | No |
| Internet Activity | Usage data, search queries | Yes |
| Geolocation Data | GPS coordinates from images | Yes |
| Sensory Data | Voice recordings, photographs | Yes |
| Professional Information | Business name (if applicable) | Yes |
| Education Information | None | No |
| Inferences | AI classifications, preferences | Yes |
| Sensitive Personal Information | None | No |
8.7 How to Exercise Your Rights
To exercise your California privacy rights:
- Email: privacy@venturamachina.com
- Online: privacy@venturamachina.com
We will verify your identity before processing your request.
8.8 Authorized Agent
You may designate an authorized agent to submit requests on your behalf. We may require verification of the agent's authority.
8.9 Do Not Sell My Personal Information
California residents can opt out of the sale of personal information (if applicable) by:
- Emailing privacy@venturamachina.com
- Using the "Do Not Sell My Personal Information" link on our website
9. International Data Transfers
9.1 Transfer Mechanisms
If you are located outside the United States, your information may be transferred to, stored, and processed in the United States and other countries. We use appropriate safeguards including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements with service providers
- Adequacy decisions where applicable
9.2 Data Storage
Primary data storage is located in:
- United States (AWS us-west-2 region)
10. Data Security
We implement appropriate technical and organizational measures to protect your personal information, including:
- Encryption of data in transit (TLS/SSL)
- Hashed passwords using industry-standard algorithms
- Access controls and authentication requirements
- Regular security assessments
- Employee training on data protection
However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
11. Children's Privacy
The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.
12. Third-Party Links
The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Posting the updated policy on our website
- Updating the "Last Updated" date
- Sending an email notification (for material changes)
Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.
14. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
XPCO Inc.
1112 Montana Avenue Suite 642, Santa Monica CA 90403 USA
Email: privacy@venturamachina.com
Data Protection Officer:
Email: privacy@venturamachina.com
15. Additional Disclosures
15.1 Do Not Track
Some browsers have a "Do Not Track" feature. We currently do not respond to Do Not Track signals.
15.2 Analytics
We use analytics services to help us understand how users interact with the Service. These services may collect information about your use of the Service.
15.3 Social Features
If we add social features in the future, information you share through these features may be visible to other users.
This Privacy Policy was last updated on March 9, 2026.