Privacy Policy

1 Who we are

Veritio Cloud is a hosted audit-trail and compliance-evidence service operated from Germany. For account and security data described in this policy, we act as the data controller under the EU General Data Protection Regulation (GDPR).

The controller within the meaning of Art. 4(7) GDPR for the personal data described in this policy is Yan Malinovskiy(sole proprietor), Belchenstraße 2, 79276 Reute, Germany,hello@getveritio.com. No Data Protection Officer is appointed; the thresholds of Art. 37 GDPR and § 38 BDSG are not met at the current scale of processing. Direct all privacy inquiries to the controller at the address above. See also the Imprint.

2 Two roles: controller and processor

It matters which data we mean. For the personal data in youraccount — the data needed to run the service and keep it secure — Veritio is the controller, and this policy governs it. For the evidence records your applications and agents send into your tenant, Veritio is a processoracting on your instructions; you are the controller of that data, and our Data Processing Agreement governs it.

3 Account data we process

As controller, we process:

• Identity and contact data — your email address, your name if you provide it, and your membership in an organization — processed to create and operate your account, verify your email, send team invitations, and communicate with you about the service.
• Authentication data — a securely hashed password and email-verification state — processed to authenticate you and protect your account.
• Security audit data — including IP addresses and timestamps of sign-in and sensitive account actions — processed to detect and investigate abuse, secure the service, and keep a security record. We keep this to what is needed for that purpose.
• Billing data — once billing is live, subscription and payment status. Card details are handled by our payment processor, Polar, and are not stored by Veritio.

Consistent with how the product is designed, we prefer stable identifiers over unnecessary personal data and do not seek freeform personal data we do not need.

4 Why we process it (legal bases)

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the service under our Terms, including creating your account, authenticating you, and handling invitations and billing.
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure the service, prevent and investigate abuse, and keep security audit records, balanced against your rights.
• Legal obligation (Art. 6(1)(c) GDPR) — to meet retention, tax, and lawful-request obligations that apply to us.

5 Subprocessors

We use a small set of infrastructure providers to run the service. Each is bound by data-protection terms, and each processes data only to provide its part of the service.

We maintain this list current and give notice of material changes as described in the Data Processing Agreement.

6 International processing

The service uses the subprocessors listed above. Their processing locations depend on the services configured for the account and their applicable terms. Where a transfer of personal data outside the EEA requires safeguards, we rely on an available lawful transfer mechanism, including Standard Contractual Clauses where applicable. This public policy does not promise a specific storage region unless that commitment appears in a separate signed agreement.

7 Cookies & website analytics

Veritio Cloud uses only strictly necessary cookies to keep you signed in and to secure the session. We do not use advertising cookies or cross-site tracking.

On this website (getveritio.com) we measure aggregate traffic withUmami (Umami Software, Inc., EU-hosted). Umami is cookieless and stores no personal identifiers; we see only aggregate statistics such as page views, referrers, and approximate location derived from your IP address (country and city — the IP address itself is not stored).

With your consent — asked once via the cookie banner — we additionally use Google Analytics 4 (Google Ireland Limited, with Google LLC in the US as sub-processor under the EU-US Data Privacy Framework). Google Analytics sets cookies and processes usage data to report how visitors use the site. It does not load unless you accept, and you can withdraw consent at any time via “Cookie settings” in the footer. Withdrawal updates Google consent to denied and removes the site's Google Analytics cookies. Google may still receive cookieless consent-status pings after the tag has loaded; no Google Analytics tag is requested before you accept.

8 Retention

We keep account data for as long as your account is active and for a limited period afterward to meet legal obligations and resolve disputes, then delete or de-identify it. Security audit data is kept only as long as needed for security and legal purposes. Retention of tenant evidence data is governed by your instructions and theData Processing Agreement.

9 Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to lodge a complaint with a supervisory authority. Where we act as processor for tenant evidence data, please direct data-subject requests to the customer who controls that tenant; we will assist that customer as described in the Data Processing Agreement.

10 Not legal advice

Veritio supports compliance evidence workflows. It does not provide legal advice and does not guarantee that your use of the service is compliant with the GDPR or any other framework.

11 Contact

To exercise a right or ask a privacy question, contacthello@getveritio.com.