Privacy Policy

1. Who we are

Verdatir AB is the operator of the Verdatir service. Registered address: Stockholm, Sweden. For privacy inquiries, contact support@verdatir.com.

2. Roles and scope

This policy covers personal data processed in connection with our public website (verdatir.com) and the Verdatir SaaS platform (app.verdatir.com).

Roles: Verdatir AB acts as (i) Controller for our website, accounts, billing, and support; and (ii) Processor for customer-uploaded content under our Data Processing Addendum (DPA).

3. Personal data we collect

• Account data: name, email, organization, role.
• Authentication data: password hashes, tokens.
• Content: files and documents you or your organization upload.
• Contact and newsletter data: the details you submit through our contact form or newsletter signup (name, email, organization, role, message).
• Usage and diagnostics: IP address, device/browser, logs, performance and error reports.
• Payment metadata: payer ID, subscription status from processors; no full card data stored by us.
• Sensitive data: we do not require it; if you upload it you are responsible for lawfulness and minimization.

4. Sources of data

• You provide data directly when you sign up, upload content, submit a form, or contact support.
• Automatically via the service (cookies, logs, device signals).
• Third parties such as payment processors or identity providers.

5. Why we process your data

• Provide and operate the service, including authentication and account management.
• Respond to inquiries and demo requests.
• AI-assisted analysis of the documents you upload, which is how the service works (see the subprocessors below).
• Billing and subscription management.
• Support and troubleshooting.
• Security, fraud prevention and legal compliance.
• Product improvement and aggregated, anonymous website analytics.
• Service and transactional communications, and newsletters you opt in to.

6. Legal bases (EU/UK)

We rely on: (a) contract performance, (b) legal obligations, (c) legitimate interests (product improvement, security, responding to inquiries, anonymous aggregate analytics), and (d) consent for newsletters and for any non-essential cookies.

7. Third parties and subprocessors

We use trusted providers to operate the website and the service. Key subprocessors:

We will provide at least 30 days' notice of subprocessor changes. We disclose data to regulators or others where required by law.

8. Data transfers outside the EEA/UK

Where transfers occur to countries without an adequacy decision, we rely on EU Standard Contractual Clauses (SCCs) and the UK IDTA/Addendum for transfers from the UK. Where vendors participate in the EU-US Data Privacy Framework we note participation as supplemental assurance.

9. Cookies and analytics

Website (verdatir.com): we do not set analytics or advertising cookies. We measure how the site is used with PostHog in cookieless mode, hosted in the EU: no identifier is stored on your device, IP addresses are not retained, and the data is aggregated. We honour Global Privacy Control and Do Not Track signals by not loading analytics at all. The contact form uses Cloudflare Turnstile to block spam, which loads a script from Cloudflare on that page only and shares your IP address and browser signals with Cloudflare for that purpose (legitimate interest in preventing abuse). Fonts are served from our own domain.

Platform (app.verdatir.com): we use only necessary cookies, for authentication and security.

10. Data retention

Deletion SLA: we aim to delete personal data within 30 days of a confirmed request; backups are purged within 90 days.

11. Security

We use TLS in transit, encryption at rest (including backups), role-based access controls, and periodic security reviews.

If a security incident is likely to pose a risk to your rights and freedoms, we will notify you without undue delay and notify regulators where required by law.

12. Your rights and choices

Depending on your jurisdiction you can request access, correction, deletion, restriction, portability, or objection. Email support@verdatir.com. We respond within legal timelines (typically 30-45 days, extendable).

Verification: We may request additional information to verify identity and authority for CCPA/CPRA requests.

Appeals: If you disagree with our decision, email support@verdatir.com with "Appeal" in the subject; we will review and respond.

13. Automated decision-making

We do not use automated decision-making that produces legal or similarly significant effects without human involvement.

14. Marketing communications

We may send product or transactional messages (for example, service updates). Newsletters are sent only to people who opted in. You can opt out at any time via in-message links or by emailing support@verdatir.com.

15. Minors

Our services are not intended for minors. You must be at least 16 years old to use the service. We do not knowingly collect personal data from children.

16. CPRA Do-Not-Sell/Share and GPC

We do not "sell" or "share" personal information as defined by the CPRA and do not engage in targeted advertising. We honor Global Privacy Control (GPC) signals as valid opt-out preferences.

17. Data incidents

We will assess incidents promptly and notify affected users and regulators where required. We maintain logs and access controls to support investigations.

18. Changes to this policy

We may update this policy. Material changes will be notified by email or in-product notice before they take effect.

19. Contact

Contact Verdatir AB at support@verdatir.com. Postal address: Stockholm, Sweden.