This beta privacy summary explains how Veridat expects to handle personal and workspace data. It should be reviewed by counsel before paid launch.
Data we process
Veridat may process account details, workspace information, claims, evidence metadata, approval history, uploaded evidence files, and operational logs needed to run the service.
How data is used
Data is used to provide claims governance workflows, authenticate users, enforce workspace access, store evidence, maintain audit history, and improve service reliability.
AI and pasted copy
The Claim Risk Checker runs on Veridat's own engine, built for marketing copy. Your copy is never sent to an AI service, and the same copy always gets the same result. That includes the page text it reads from a web address, and the checker isn't trained on your copy.
Veridat doesn't send your content to AI services. That covers claims, evidence and the files you upload, and anything you paste or type into the app.
The checker's results are advisory only. Your team decides, and Veridat does not provide legal advice or guarantee compliance.
Product analytics
Veridat records limited product events to understand activation, feature usage, reliability, and account operations. Event metadata is designed not to include full pasted copy, uploaded evidence content, or raw evidence files.
Analytics and advertising
Only if you accept them in the cookie banner, and only on our website and the sign-up and log-in pages, never inside the signed-in app, we use:
- Google Analytics 4 (Analytics): which pages are visited and which buttons are used, to improve the site.
- Google Ads (Advertising): whether a Google ad led to a sign-up or a report request.
They receive the page you are on (without any email address or private link in it), the site that sent you, your browser and device type, and these events: a check run (paste or web address, the market and audience chosen, and how many claims were found, as a range), a PDF report requested, the sign-up page viewed, an account created (the method, and whether it was a design partner sign-up), a design partner or free trial button clicked, and the contact form sent. They never receive your email address, name, company name, the copy you check, the web addresses you check or the claims found.
We also keep, on our own systems, where your first visit came from (the campaign in the link, whether it came from an ad, the page you landed on and the site that sent you) with your account or report request, to count which campaigns lead to sign-ups. Without analytics consent we keep only the page you signed up on.
To opt out, choose "Reject all" or switch a category off in Cookie settings (in the footer of every page). You can also use each provider's own controls: Google's browser add-on at tools.google.com/dlpage/gaoptout; Google's ad settings at adssettings.google.com.
Subprocessors and infrastructure
Veridat currently expects to use Vercel for application hosting, Supabase for database and evidence storage, Google Workspace for company email and documents, and Resend for product email if configured. This beta list should be reviewed and formalised before paid launch.
Certifications
Veridat does not currently claim SOC 2, ISO 27001, GDPR certification, or any equivalent formal certification. Future certifications or audit reports will be listed only once completed.
Contact
For privacy questions during beta, contact contact@getveridat.com.