Privacy Policy

Last updated: 1 September 2026

1. Who we are

The controller responsible for the processing described in this Privacy Policy is:

BHUTAN IMPORT COMPANY FZC LLC
Trading as: Vurdera / BIC / Business Intelligence Consulting
26th Floor, Amber Gem Tower
Ajman, United Arab Emirates

For privacy questions or to exercise your rights, contact privacy@vurdera.com.

We operate Vurdera as a business-to-business service for investment professionals and organisations. We do not provide the service for personal or household use.

2. The information we collect

The information we collect depends on how you interact with Vurdera.

2.1 Information you provide to us

If you request a demonstration, contact us or otherwise communicate with us, we may collect:

• your work email address;
• your name, if you include it in correspondence;
• your firm's name;
• information you choose to provide about your investment process or the problems you are trying to solve;
• the contents of correspondence and other communications with us; and
• information necessary to administer a commercial relationship with you or your organisation.

Our website's demonstration request form is intentionally limited. We do not require your telephone number, job title or personal address.

2.2 Account information

As Vurdera develops, customers may be able to create user accounts. Where account functionality is available, we may collect:

• work email address;
• name;
• firm name;
• authentication information and authentication events; and
• information necessary to maintain the security of the account.

Vurdera is designed to use passwordless authentication, including Google and Microsoft sign-in and email-based authentication. Enterprise customers may also be offered SAML-based single sign-on. We do not intend to store conventional account passwords.

2.3 Information generated through use of the service

When you use Vurdera, the service may process technical information necessary to provide, secure and operate the service, such as authentication events, administrative events and information generated by the underlying infrastructure.

We do not intentionally collect or retain the contents of your deal documents as application records after the processing request has completed.

2.4 Deal documents

Vurdera is designed to process documents selected by the customer from the customer's own device. These documents may contain personal data relating to founders, employees, management teams, investors, counterparties and other individuals.

Where you use Vurdera on behalf of an organisation, your organisation generally determines why those documents are processed and what analysis is performed. In that circumstance, the organisation is the controller of the relevant personal data and Vurdera acts as its processor.

The processing of customer deal documents is described in more detail in Section 6.

3. How we use personal data

We use personal data for the following purposes:

We do not sell personal data. We do not purchase personal contact lists.

4. Marketing communications

We may use business contact information to send you information about Vurdera, including product developments, events, research, announcements and other information that we believe may be relevant to your professional interests.

Where applicable law requires consent for a particular form of electronic marketing, we will obtain that consent before sending it.

You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting privacy@vurdera.com.

We do not use marketing communications to send confidential deal information.

5. Website analytics, cookies and similar technologies

Our website uses third-party analytics and marketing technologies to understand website usage and measure the effectiveness of our marketing. Depending on your location and the consent choices available to you, these may include:

• Google Analytics;
• Google Tag Manager;
• LinkedIn Insight Tag; and
• Plausible Analytics.

These technologies may collect information such as:

• pages viewed;
• approximate geographic location;
• browser and device information;
• referral source;
• interactions with the website; and
• information used to measure advertising or conversion activity.

Where required by applicable law, non-essential analytics and advertising technologies will only be activated after you have given the relevant consent. You can change or withdraw your consent through the cookie settings available on the website.

Vurdera does not use advertising technologies to analyse or monitor the contents of customer deal documents.

6. How Vurdera processes deal documents

This section describes an important feature of Vurdera's architecture.

Vurdera is designed around a local-first document workflow. When you use the service, you select documents or a folder containing documents on your own device. The selected documents are transmitted securely to Vurdera's processing infrastructure for the purpose of performing the analysis you requested.

6.1 What happens to the documents

The selected documents are:

• selected by you from your device;
• transmitted to Vurdera over an encrypted connection;
• processed by Vurdera to extract and analyse their contents;
• transmitted to our AI service provider where necessary to perform the requested analysis;
• used to generate the requested investment analysis and memorandum; and
• discarded from Vurdera's application processing environment when the relevant request has completed.

Vurdera does not maintain a customer-facing document repository, document database or file-storage system for these documents. Vurdera does not intentionally write customer document contents to persistent application storage. The application also does not create or maintain a customer embedding or vector database.

6.2 Generated memoranda

Generated memoranda and associated citation information may be stored locally in the browser or application environment on the customer's own device so that the user can access the result and continue working with it. Vurdera does not maintain a server-side repository of those memoranda.

Because this information is stored on the customer's device, Vurdera does not control the customer's local storage, device security, backups or deletion of locally stored copies. Customers are responsible for managing information stored locally on their devices in accordance with their own information-security policies.

6.3 What Vurdera does not do

Vurdera does not:

• sell customer deal documents;
• use customer deal documents for advertising;
• use customer deal documents to build marketing databases;
• intentionally retain customer deal documents after processing;
• create an internal database of customer deal documents;
• create embeddings or vector representations of customer deal documents for later retrieval; or
• use customer deal documents as examples in our marketing materials without permission.

7. AI processing

Vurdera uses Anthropic's Claude API to perform AI-assisted analysis. Depending on the processing stage, information extracted from customer documents and the document text itself may be transmitted to Anthropic so that Anthropic can provide the AI processing requested by the customer.

The information transmitted may therefore include:

• document text;
• document filenames or citation labels; and
• information contained within the documents.

We do not intentionally send the customer's account identity, email address or other account information to Anthropic as part of the document-analysis request unless required for the operation of the service.

Anthropic processes API data under its applicable commercial terms and data-protection terms. Anthropic's current commercial API framework provides specific contractual treatment of customer content and has a standard API retention period. The applicable terms may change over time, and we will update our documentation where material changes affect our processing arrangements.

Vurdera does not use customer documents to train, fine-tune or build its own AI models. We also do not retain customer documents for the purpose of creating our own datasets, benchmarks or examples.

The AI provider is a subprocessor for purposes of customer deal-document processing.

8. Customer controller / Vurdera processor relationship

Where a customer uses Vurdera to process deal documents containing personal data, the customer generally determines:

• which documents are submitted;
• which individuals' information is included;
• the purpose for which the analysis is performed; and
• how the resulting analysis is used.

In those circumstances, the customer is the controller and Vurdera is the processor. Vurdera processes that information only to provide the services requested by the customer and in accordance with the customer's instructions and applicable contractual terms.

Our processing of customer data is governed by a Data Processing Agreement where required by applicable law. The DPA addresses matters including:

• processing instructions;
• confidentiality;
• security;
• deletion;
• assistance with data-subject rights;
• international transfers; and
• subprocessors.

If you are a customer and require a DPA, contact privacy@vurdera.com.

9. Our subprocessors

Vurdera uses a limited number of third-party providers to operate its website and service.

We may add or replace subprocessors as the service develops. We will maintain an up-to-date subprocessor list and will provide appropriate notice of material changes in accordance with applicable data-protection requirements and our contractual commitments.

10. International transfers

Vurdera is established in the United Arab Emirates and provides services to customers in the UAE, United Kingdom and European Economic Area.

Some of our service providers are located outside the jurisdiction in which you are located. Personal data may therefore be transferred to and processed in other countries, including the United States.

Where European data-protection law applies, we use an appropriate lawful transfer mechanism where required, which may include:

• an adequacy decision;
• the EU Standard Contractual Clauses;
• the UK International Data Transfer Addendum or other UK-approved transfer mechanism; or
• another mechanism permitted under applicable data-protection law.

For example, Vercel's current data-processing terms provide for international transfer mechanisms including the EU Standard Contractual Clauses and UK International Data Transfer Addendum.

The exact processing location of a particular service may change as providers update their infrastructure. Our contractual arrangements with relevant providers are intended to ensure that international transfers are subject to appropriate safeguards.

11. Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, accounting and regulatory requirements. Our principal retention periods are:

Where a customer requests deletion of personal data that Vurdera controls, we will ordinarily complete the deletion within 30 days, subject to legal requirements and legitimate requirements to retain particular information.

12. Security

We use technical and organisational measures appropriate to the nature of the personal data we process. These include, as applicable:

• encryption of data transmitted between your device and our processing infrastructure;
• encryption of communications with our AI service providers;
• access controls for administrative systems;
• restricted access to production infrastructure;
• passwordless authentication for supported user accounts;
• minimisation of data retained by our application;
• limiting application processing of customer documents to the purpose requested by the customer; and
• monitoring and maintaining the security of the systems used to provide the service.

Vurdera does not currently maintain a customer document database or customer file-storage system.

We do not currently claim SOC 2, ISO 27001 or another independent security certification. As the service develops, we may introduce additional technical and organisational safeguards and may pursue independent security certifications.

13. Data breaches and security incidents

We maintain procedures for responding to security incidents affecting personal data.

Where Vurdera acts as a processor, we will notify the relevant customer without undue delay after becoming aware of a personal-data breach, in accordance with the applicable Data Processing Agreement and applicable law.

Where we act as a controller, we will assess security incidents and make notifications to regulators and affected individuals where required by applicable law.

14. Your rights

Depending on your location and the law that applies to your personal data, you may have rights including:

• the right to access your personal data;
• the right to correct inaccurate or incomplete personal data;
• the right to request deletion;
• the right to restrict processing;
• the right to object to certain processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent; and
• the right to object to direct marketing.

You may exercise your rights by contacting privacy@vurdera.com. We may need to verify your identity before responding to a request.

Where we process your personal data solely on behalf of one of our customers, we may refer your request to that customer because the customer is the controller responsible for determining how that information is processed.

We will generally respond to valid rights requests within one month, subject to any longer period permitted by applicable law where a request is particularly complex or multiple requests are made.

15. Complaints

If you believe that we have processed your personal data unlawfully or have otherwise failed to comply with applicable data-protection law, please contact us first at privacy@vurdera.com.

You may also have the right to lodge a complaint with the data-protection supervisory authority in the jurisdiction where you live, work or believe that an infringement occurred.

For individuals in the United Kingdom, this is generally the Information Commissioner's Office (ICO). For individuals in the European Economic Area, the relevant supervisory authority will generally be the data-protection authority in the relevant EEA member state.

16. Representatives

Because Vurdera is established outside the European Economic Area and the United Kingdom, we will appoint an EU representative and UK representative where required by applicable law. Details of those representatives will be published here once appointed.

17. Children

Vurdera is intended solely for business and professional use. The service is made available to organisations and their personnel and is not directed at children. We do not knowingly seek to collect personal data from children.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal obligations or data-processing practices.

When we make changes, we will update the “Last updated” date at the beginning of this Privacy Policy. Where a change is material and applicable law requires notification, we will provide additional notice through the website, by email or by another appropriate means.

19. Contact us

If you have questions about this Privacy Policy, our processing of personal data or your privacy rights, contact:

BHUTAN IMPORT COMPANY FZC LLC
Trading as Vurdera / BIC / Business Intelligence Consulting
26th Floor, Amber Gem Tower
Ajman, United Arab Emirates
Privacy: privacy@vurdera.com