Roles and scope
The customer controls the site content it publishes and the sources it enables for indexing. Venture VD processes it solely on the customer's behalf to read published blog posts, regular pages, selected dynamic collection items, and, where the customer enables it, visible Wix Stores products (read-only); build and maintain a search index of that content; serve search results and a zero-results report; apply the customer's synonyms and redirects; support the service; secure it; and delete data. Data subjects are whoever the customer's published content concerns. Data may include blog post text, page titles and URLs, dynamic collection item fields the customer has configured for indexing, store product catalog data (name, description, SKU, price, product page URL, main image), and search query text. Special-category data is prohibited without prior agreement.
Processor obligations
Venture VD processes only documented instructions, binds authorized personnel to confidentiality, maintains the measures below, controls subprocessors, assists with rights requests and impact assessments, and notifies the Controller without undue delay and within 72 hours after confirming a breach. The Controller warrants a lawful basis, adequate notices, and lawful instructions for any personal data placed in published site content it chooses to index.
Subprocessors and deletion
Subprocessors are listed in the Privacy Notice. Material changes receive advance notice and a 30-day objection period. Venture VD remains responsible for their obligations. Indexed content is kept current while a source is enabled and removed within one reconciliation cycle after it is unpublished or deleted; account data is deleted within 30 days of uninstall.
Territory
The service is offered only to Controllers established in the United States or Canada and processes data in Fly.io's Chicago region. The parties do not adopt EU SCCs, the UK Addendum, or an Article 27 representative. Canadian Controllers acknowledge US processing and lawful-access exposure under PIPEDA accountability.
Audit, liability, and acceptance
Venture VD will answer one written security questionnaire per twelve months within 30 days. Legally required on-site audits are scoped in advance, normally limited to once yearly, and paid by the Controller. Liability follows the Terms except where law forbids that limitation. This Addendum is accepted electronically with the Terms; a countersigned copy is available from support@venturevd.com.
Schedule A: security measures
- Database connections travel only over Fly.io's private, WireGuard-encrypted network; the database is not reachable from the public internet.
- The search engine (Typesense) is self-hosted on the same private network with no public address and is filtered per site/tenant on every query.
- Separated owner, runtime, and purge database roles; the runtime role cannot delete account data.
- Append-only search query log enforced by database permissions.
- Signature-verified Wix requests, including webhook deliveries.
- Short-lived, signed, site-bound tokens for widget search access.
- Structured, redacted logs that exclude credentials and secrets.
- Encrypted database storage with daily volume snapshots retained for 14 days; no point-in-time recovery.