Privacy notice

V1LA Website and Form Global Privacy Notice — v1.1

Effective date: 9 October 2026
Last reviewed: October 9, 2026
Legal sources verified through: 7 October 2026

1. Who is the controller

V1LA is currently a laboratory and development-stage project operated by José Antonio Rivera Vila, a natural person domiciled in Lima, Peru, who acts as the controller of the personal data described in this Notice.

RUC (Peruvian tax ID): 10093880183
Address for notices: Calle Degas 133, San Borja, Lima, Peru
Controller’s email: antoniobarna@protonmail.com
Privacy contact: v1la@proton.me

“V1LA” identifies the project and service. It must not be understood as a legal entity separate from the controller identified above.

2. Scope of this Notice

This Notice covers:

1. Ordinary navigation and use of V1LA’s public website, including pages such as Home, Product, Resources, and Industries; and
2. Use of the “Start investigation” form.

Visiting the website can generate technical processing even if you do not submit the form. Website-navigation and form processing are separated below.

“Start investigation” form

The “Start investigation” form allows a person to request a review of:

• Companies;
• Systems;
• Processes; and
• Artificial intelligence agents.

V1LA accepts only a company, system, process, or AI agent as the review subject. Requests whose actual subject is the investigation of a natural person are rejected during intake. This is a product rule supported by human review; it does not mean that V1LA can technically prevent a user from mentioning a person in free text. The form is intended for people aged 18 or older acting in a professional or business context.

The public dashboard is a demonstration using fictional data: it accepts no visitor free text, puts no visitor-entered information in URLs, and does not persist investigations.

3. Data we collect

A. Website-navigation technical data

When you visit any page, V1LA and Vercel may process technical data needed to deliver, operate, and secure the site, such as IP address, date and time, requested URL or resource, request method and status, HTTP headers, browser and user-agent, approximate location derived from IP, source or referrer, request or deployment identifiers, system configuration, and performance, diagnostic, and security logs.

V1LA will not enable Vercel Web Analytics, Speed Insights, or equivalent behavioral-analytics tools in v1 without a prior assessment and update to this Notice.

B. Data you provide through the form

• The selected subject type from Company, System, Process, and AI Agent;
• The required description of what V1LA should review, limited to 500 characters;
• Your name, limited to 120 characters;
• Your work email address, limited to 200 characters;
• Your organization, optional and limited to 160 characters;
• An additional note, optional and limited to 1,500 characters; and
• Privacy evidence associated with the request: request ID, UTC timestamp, language, Privacy Notice version, Supplements version, and the affirmative-confirmation record.

C. Form technical and security data

When you open or submit the form, V1LA and its providers may process, in addition to the navigation data above, security and delivery logs and Cloudflare Turnstile signals such as IP address, TLS fingerprint, user-agent, sitekey, and origin.

The API temporarily uses the IP address only for a rate limit held in the temporary memory of the server instance, for approximately 10 minutes. Entries are discarded once they have expired, during later processing, or when the platform recycles the instance; deletion at exactly ten minutes is not guaranteed. V1LA has no database and no log of its own for this purpose. When available, the IP address is sent to Turnstile as remoteip. The application does not include the IP address in the Privacy Record or the email sent through Resend and does not use its own logging to record the form body, token, or fields. The existence and retention of platform logs kept by Vercel, Cloudflare, and Resend remain subject to external verification.

Cloudflare states that Turnstile does not access, store, or transmit the information you enter in the form. It does process technical signals needed to distinguish human activity from bots.

4. Data you must not send

V1LA does not accept file attachments. Do not submit in the subject or message:

• Sensitive personal data or special categories of data;
• Identity documents or medical, biometric, financial, or banking information;
• Passwords, credentials, keys, tokens, or access secrets;
• Trade secrets;
• Unnecessary confidential or privileged information;
• Unnecessary personal data about another person; or
• Information intended to investigate, rate, or accuse a natural person.

This prohibition is a policy and UX control, not a guarantee that submitting sensitive data is technically impossible. V1LA locally blocks unequivocal secrets or credentials without sending the content to a third party for classification and may reject, isolate, redact, or delete a request that breaches these rules. If we detect information that we do not need or cannot lawfully retain, we will seek to delete it securely.

5. Why we use the data

We use the data to:

1. Deliver, operate, maintain, diagnose, and secure the website;
2. Measure availability and performance through technical logs, without enabling behavioral analytics in v1;
3. Receive, classify, and verify the integrity of the request;
4. Assess whether the request is within V1LA’s scope;
5. Manage and respond to the communication;
6. Prevent spam, fraud, abuse, and security threats;
7. Retain limited evidence of the request, the Notice displayed, and actions taken;
8. Handle rights requests, questions, and complaints;
9. Comply with legal obligations and valid authority requests; and
10. Establish, exercise, or defend legal claims.

Data obtained through “Start investigation” is not used for marketing.

6. Legal grounds

The applicable legal ground depends on your location and the nature of the request:

• Your request and, where relevant, pre-contractual steps you ask V1LA to take;
• The need to deliver and protect the website and V1LA’s legitimate interests in maintaining its availability, security, and integrity, where that ground is available and after balancing individual rights;
• V1LA’s legitimate interests in receiving and responding to professional communications and securing the form, subject to the same condition;
• Your authorization or consent where applicable law requires it;
• Compliance with legal obligations; and
• The establishment, exercise, or defense of legal claims.

The confirmation next to the submit button records that you have read this Notice and ask V1LA to carry out the processing needed to manage your request. It does not make consent the only legal ground where the law permits or requires another ground.

7. Required and optional fields

Navigation technical data is generated automatically when your browser requests website resources; if all such processing is blocked, the site may not function. It is not used for marketing.

For the form, the subject type, the description of what V1LA should review, your name, your work email, and the reading/request confirmation are required. If you do not provide them, V1LA cannot receive or respond to the request.

Your organization and additional note are optional. Limits are also validated server-side; over-limit content is rejected and is not truncated. You should not provide information beyond what is necessary to explain the request.

8. Providers and recipients

V1LA uses a limited set of providers to operate the form:

• Vercel: website and application hosting, delivery, and execution;
• Cloudflare Turnstile: bot and abuse detection and blocking;
• Resend: transmission and delivery of the form message in plain text; and
• Proton: receipt and storage in V1LA’s mailbox.

These providers may use subprocessors for infrastructure, security, delivery, and support. V1LA must maintain data-processing contracts and restrict processing to documented purposes, except for activities where a provider lawfully acts as an independent controller. For example, Cloudflare states that it acts as a controller when improving its bot-detection capabilities.

Resend states that ordinary sending through the Emails API is not sent to Anthropic. Anthropic receives content only if AI Editor is used or a user voluntarily shares it with AI Support; V1LA must not enable those features for this flow. RunPod processes a small sample of emails for trust and safety on dedicated infrastructure operated by Resend. Resend states that neither Resend nor those subprocessors use customer content to train or fine-tune models.

We may also disclose data, only to the extent necessary, to professional advisers bound by confidentiality, security providers, courts, authorities, or other persons when legally required or authorized.

9. International transfers

Using Vercel, Cloudflare, Resend, and Proton may involve processing in the United States, Switzerland, and other countries where their subprocessors operate. Some countries may provide a different level of protection from your jurisdiction.

V1LA will use the mechanisms required by applicable law, which may include processing contracts, standard contractual clauses, the UK Addendum, local clauses or safeguards, and transfer assessments. You may request information about the relevant mechanism at v1la@proton.me.

Pre-publication control: this section may be published only after the mechanisms it describes have been executed and archived.

10. Retention

Unless a legal obligation, claim, or authorized hold applies:

• Valid request that does not become a V1LA relationship: 12 months from the last substantive contact;
• Rejected or out-of-scope request: 90 days from the final decision;
• Failed or blocked attempt (for example, one that does not pass validation or the security check): V1LA keeps no record of its own;
• Spam received in the mailbox: 30 days;
• Request with prohibited content identified after reception: deleted as soon as it is identified and, in any case, within 30 days;
• Turnstile token: discarded after validation; V1LA does not store the Turnstile result;
• IP address used for the rate limit: held only in the temporary memory of the server instance (see section 3.C); V1LA keeps no log of it;
• Logs kept by providers (Vercel, Cloudflare, Resend, Proton): the period is set by each provider and is pending verification; V1LA does not state a period for them;
• Logical-interaction records required by Peruvian law, where they apply to V1LA: at least 2 years, limited and separated from message content. Whether this requirement applies to V1LA is pending legal confirmation;
• Request converted into a client relationship: necessary information is moved to the relevant file and the intake duplicate is deleted within 90 days;
• Privacy Record —request ID, UTC timestamp, language, Notice and Supplements versions, and affirmative confirmation—: it has no separate period because it exists only inside the email. It follows the containing email’s period: 12 months from the last substantive contact for a valid request that does not become a relationship; 90 days from final rejection for an out-of-scope request; and no more than 30 days, normally sooner, for prohibited content. If a request becomes a relationship, only necessary information is migrated to the relevant file and the intake duplicate is deleted within 90 days. No independent three-year period applies; and
• Backups: planned maximum rotation of 90 days, without permanently restoring data that should already have been deleted.

Client files are governed by a separate policy, using six years after closure as a starting point and adjusting it to the legal duties of the relationship. A documented legal hold may temporarily suspend deletion.

11. Security

V1LA applies measures proportionate to the risk, including encryption in transit, access controls, strong authentication, log minimization, server-side validation, rate limits, information segregation, and deletion processes. No system is completely invulnerable, so we maintain procedures to detect, assess, and respond to incidents.

12. Your rights

Depending on applicable law, you may request information and access, correction or updating, deletion or cancellation, objection, restriction, portability, withdrawal of authorization or consent, and review of certain automated decisions. You may also lodge a complaint with the relevant authority.

Send your request to v1la@proton.me. Identify the right you wish to exercise and provide the information needed to locate your request. V1LA may request reasonable additional information to verify your identity but will not request excessive documentation. Requests are handled without charge unless a legal exception applies.

Specific rights and deadlines appear in the Jurisdictional Supplements. If applicable law gives you greater protection, that law and its supplement prevail.

13. Cookies and similar technologies

V1LA does not use advertising, marketing pixels, or behavioral analytics on the website or form. V1LA’s code does not create cookies or use localStorage, sessionStorage, or IndexedDB. Vercel may process technical request data and logs to host, deliver, and secure the site; this is not the same as enabling Vercel Web Analytics. The form uses Turnstile for an essential security function. The intended configuration must not use pre-clearance or the cf_clearance cookie and must not enable Ephemeral IDs; those Cloudflare settings must be verified before production.

If a technical audit detects non-essential storage, or V1LA later adds analytics, advertising, or another technology, this section and the consent mechanism must be updated before activation.

14. Children

The form is not directed to anyone under 18. If V1LA learns that it received a minor’s data, it will assess and delete the information unless there is a lawful reason to retain it.

15. Changes

V1LA will maintain the version, effective date, last review, legal-source verification date, and a changelog. Material changes will be communicated prominently. A new and incompatible purpose will not be introduced through a silent edit; a new affirmative choice will be requested when required.

The contact email may later change from v1la@proton.me to a V1LA domain. The change will be reflected in this Notice and the changelog before the former channel stops being monitored.

Changelog