Privacy Policy

Effective Date: March 22, 2026
Last Updated: March 22, 2026

Inventa AI Solutions ("Inventa," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at inventasolutions.ai (the "Site"), use our AI assistant Leo, complete our AI Maturity Assessment, subscribe to our newsletter, or otherwise interact with our services.

This policy is designed to comply with the Texas Data Privacy and Security Act (TDPSA) and the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), reflecting our commitment to serving clients across the United States and Mexico.

1. Identity of the Data Controller

Inventa AI Solutions
Austin, Texas, United States
Email: howdy@inventasolutions.com
Website: inventasolutions.ai

Inventa AI Solutions is the data controller responsible for the processing of your personal data as described in this Privacy Policy.

2. Data We Collect

We collect personal data only when it is necessary to provide our services or when you voluntarily provide it. We do not process payments on the Site and therefore do not collect billing, credit card, or financial account information. We do not collect member profiles, GICS classifications, or directory data.

2.1 Contact Information

When you submit our contact form, you may provide your name, email address, company name, phone number, and the content of your message. This data is collected solely to respond to your inquiry.

2.2 AI Assistant (Leo) Data

When you interact with Leo, our AI-powered assistant, we collect:

• Conversation content (your messages and Leo's responses)
• Session identifier (a unique ID assigned to each conversation session)
• Timestamps of each message
• Language preference (English or Spanish)

Conversation content is processed by Anthropic's AI models to generate responses and is stored in our PostgreSQL database for service improvement and continuity. Anthropic processes this data as a sub-processor under its data processing terms. We recommend you do not share sensitive personal information, financial details, or trade secrets in your conversations with Leo.

2.3 AI Maturity Assessment Data

If you complete our AI Maturity Assessment, we collect your responses to assessment questions and the computed maturity level result. This data is used to provide you with a personalized assessment of your organization's AI readiness.

2.4 Newsletter Subscription

When you subscribe to our newsletter, we collect your email address. Newsletter delivery is managed through Resend. You may unsubscribe at any time using the link provided in each email.

2.5 Technical and Analytics Data

We automatically collect certain technical information when you visit the Site:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and navigation patterns
• Referring URL

This data is collected through Google Analytics 4 (GA4) and PostHog for usage analytics and product improvement. See Section 6 (Cookies) for details.

3. Purposes of Data Processing

3.1 Primary Purposes

We process your personal data for the following primary purposes:

• Responding to inquiries submitted through our contact form
• Providing the Leo AI assistant service, including generating responses and maintaining conversation context
• Processing and delivering AI Maturity Assessment results
• Sending newsletter communications to subscribers
• Operational communications related to our services (e.g., service updates, security notifications)

3.2 Secondary Purposes

With your consent or based on legitimate interest, we may also process data for:

• Analytics and statistical analysis to understand how our Site and services are used
• Service improvement, including training and refining our AI assistant's capabilities
• Content development and generation based on aggregated, anonymized usage patterns

If you object to secondary processing, you may contact us at howdy@inventasolutions.com and we will cease such processing without affecting your access to primary services.

4. Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you voluntarily submit information through our forms, interact with Leo, complete the AI Maturity Assessment, or subscribe to our newsletter. You may withdraw consent at any time.
• Legitimate Interest: For analytics, security monitoring, service improvement, and fraud prevention, where such processing does not override your fundamental rights and freedoms.
• Legal Obligation: When required to comply with applicable laws, regulations, or legal processes.

5. Third-Party Service Providers

We share personal data with the following third-party service providers who act as data processors on our behalf. We do not sell, rent, or trade your personal data to any third party for marketing or any other purpose.

Each provider is contractually bound to process data only for the purposes specified and to implement appropriate security measures. For international transfers (including data processed in Mexico), we ensure adequate protections are in place consistent with LFPDPPP requirements.

6. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies to enhance your experience and collect analytics data. Below is a summary of the cookies we use:

Essential cookies are required for the Site to function properly and cannot be disabled. Analytics cookies are only activated after you provide consent. You may manage cookie preferences through your browser settings or by contacting us.

7. Your Data Rights

Depending on your jurisdiction, you have specific rights regarding your personal data. We honor rights under both the Texas Data Privacy and Security Act (TDPSA) and the Mexican Federal Law on Protection of Personal Data (LFPDPPP).

7.1 Rights Under the TDPSA (Texas Residents)

If you are a Texas resident, you have the right to:

• Access: Confirm whether we are processing your personal data and obtain a copy of such data.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your personal data.
• Data Portability: Obtain a copy of your data in a portable, readily usable format.
• Opt-Out: Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. Note: Inventa does not sell personal data and does not engage in targeted advertising or automated profiling.

To exercise your TDPSA rights, contact us at howdy@inventasolutions.com. We will respond within 45 days. If we deny your request, you may appeal by contacting us, and we will respond to the appeal within 60 days. If the appeal is denied, you may file a complaint with the Texas Attorney General.

7.2 ARCO Rights Under the LFPDPPP (Mexico)

If your personal data is subject to Mexican law, you have ARCO rights:

• Acceso (Access): Know what personal data we hold about you and the conditions of its processing.
• Rectificación (Rectification): Request correction of inaccurate or incomplete data.
• Cancelación (Cancellation): Request deletion of your data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.
• Oposición (Opposition): Object to the processing of your data for specific purposes, particularly secondary purposes.

To exercise your ARCO rights, send a written request to howdy@inventasolutions.com including:

1. Your full name and contact information
2. A clear description of the data and rights you wish to exercise
3. Any documentation supporting your request

We will respond within 20 business days of receiving your complete request. If you are unsatisfied with our response, you may file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).

8. Data Retention

We retain personal data only as long as necessary for the purposes described:

• Contact form submissions: Retained for up to 24 months after the last interaction, then deleted.
• Leo conversations: Retained for up to 12 months for service improvement, then anonymized or deleted.
• AI Maturity Assessment data: Retained for up to 12 months, then anonymized or deleted.
• Newsletter subscriptions: Retained until you unsubscribe.
• Analytics data: Retained per the retention policies of GA4 (up to 14 months) and PostHog (configurable, typically session-based).

Upon expiration of the retention period, data is securely deleted or irreversibly anonymized. You may request earlier deletion by exercising your rights under Section 7.

9. Security Measures

We implement commercially reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Web Application Firewall: Cloudflare WAF protects against common web attacks, including SQL injection, cross-site scripting (XSS), and DDoS attacks.
• Rate limiting: API endpoints are rate-limited to prevent abuse and protect service availability.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.
• Secure infrastructure: Our hosting provider (Vercel) maintains SOC 2 Type II compliance, and data is stored in secure, managed database environments.

While we take extensive precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but will promptly notify affected individuals and relevant authorities of any data breach as required by law.

10. Children's Privacy

Our Site and services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data promptly. If you believe a minor has provided us with personal data, please contact us at howdy@inventasolutions.com.

11. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. There is currently no uniform standard for interpreting DNT signals. Our Site does not currently respond to DNT signals. However, you may manage your tracking preferences through cookie settings as described in Section 6, or by using browser-level privacy controls.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law, provide additional notice (such as a prominent notice on the Site or an email notification).

We encourage you to review this Privacy Policy periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

13. Contact Information & Complaints

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Inventa AI Solutions
Email: howdy@inventasolutions.com
Website: inventasolutions.ai

You may also use our contact form.

13.1 Complaints

If you are unsatisfied with our response to a privacy-related request:

• United States (Texas): You may file a complaint with the Office of the Texas Attorney General.
• Mexico: You may file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).

14. Relationship with Terms of Service

This Privacy Policy is part of, and subject to, our Terms of Service. By using the Site, you agree to both this Privacy Policy and our Terms of Service. In the event of a conflict between this Privacy Policy and the Terms of Service regarding data privacy matters, this Privacy Policy shall prevail.

© 2026 Inventa AI Solutions. All rights reserved.