Version 1.2 · Effective 2026-09-06 · Last updated 2026-09-06 · See also our Terms of Service.
This Privacy Policy explains how Verety Inc. ("Verety," "we," "us," or "our") collects, uses, discloses, and protects information when you create an account for, access, or use the Verety platform, including our website, web application, API, and MCP server (together, the "Service"). By using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, do not use the Service. This Privacy Policy is incorporated into and forms part of our Terms of Service at verety.ai/eula.
Verety Inc. is a Delaware corporation and is the controller responsible for the personal information described in this Privacy Policy. You can reach us about privacy matters at legal@verety.ai or through the contact form linked from verety.ai/pricing.
We collect the following categories of information: (a) Account registration information. When you create an account, we collect your name, email address, and a password (if you register with email and password) or an authentication identifier (if you register with a third-party provider — see Sections 7 and 8). (b) Information from third-party sign-in providers. If you choose to sign in with Google or GitHub, we receive a limited set of profile information from that provider, described in Sections 7 and 8. We do not receive your Google or GitHub password. (c) Information you submit when using the Service. This includes the counterparties, companies, individuals, and identifiers you search for or investigate; the parameters of your queries; documents you upload as evidence; and the text and data extracted from those documents. Some of this content may itself contain personal information about third parties that you, not Verety, have chosen to submit. (d) Information collected automatically. When you use the Service we automatically collect log and usage data, including your IP address, approximate location derived from that IP address, browser and device type, operating system, referring and exit pages, the pages and features you use, and the dates and times of your activity. We also use browser local storage and cookies as described in Section 9. (e) Communications. If you contact us, we keep a record of that correspondence.
We use the information we collect to: (a) create, authenticate, and maintain your account; (b) provide, operate, secure, and improve the Service and its features; (c) run the searches and investigations you request, and return results to you; (d) monitor for, detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service; (e) respond to your questions and provide support; (f) send you service-related communications (for example, security alerts, password-reset emails, and material changes to our terms or policies); (g) comply with our legal obligations and enforce our agreements; and (h) in aggregated or de-identified form that does not identify you or any individual, analyze usage and improve our entity-resolution and risk-scoring models. We do not use your personal information, or information received through Google or GitHub sign-in, for advertising or to build advertising profiles.
If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases: performance of our contract with you (to provide the Service and your account); our legitimate interests (to secure and improve the Service, prevent fraud and abuse, and understand how the Service is used), provided those interests are not overridden by your rights; your consent, where we ask for it; and compliance with a legal obligation.
We share information only as described below. We do not sell your personal information, and we do not share it with third parties for their own independent marketing. (a) Service providers (sub-processors). We share information with vendors that process it on our behalf to run the Service, under contracts that require them to protect it and use it only for that purpose: - Vercel Inc. — application hosting and first-party analytics; - Google LLC (Firebase Authentication and Cloud Firestore) — user authentication and storage of your account profile, including your acceptance of our Terms; - AI model providers (Anthropic, PBC and Google LLC) — when the Service analyzes an investigation, the relevant query text and document content is transmitted over encrypted APIs to these providers to generate the analysis you requested. Under the commercial API terms we operate under, this content is not used to train their models. It is not used for advertising. Content submitted through Google sign-in scopes (Section 7) is never sent to these providers. (b) Data sources you query. When you run a search or investigation, the search terms needed to answer your query are transmitted to the relevant third-party registries, sanctions and watchlist providers, and public-record sources. We do not send your account information to those sources. (c) Legal, safety, and compliance. We may disclose information if we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Verety, our users, or the public, or to enforce our Terms. (d) Business transfers. If Verety is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy. (e) With your consent or at your direction.
If you choose "Continue with Google," Google shares the following information with us, based on the OAuth scopes we request (openid, email, and profile): your name, email address, profile picture URL, and your Google account identifier. How we use it. We use this information solely to create and authenticate your Verety account, to display your name in the Service, and to contact you about your account. We do not use Google user data for advertising, and we do not sell it. How we store it. Your Google email, name, and account identifier are stored by Google Firebase Authentication (our authentication provider) and in your account profile record in Google Cloud Firestore. How we share it. We share Google user data only with the sub-processors listed in Section 6(a), who act on our behalf, and only as needed to operate the Service — or where you consent or the law requires. Limited Use. Verety's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular: - we use Google user data only to provide and improve the sign-in and account features described above; - we do not use Google user data to develop, train, or improve generalized or standalone machine-learning or AI models, and we do not send it to the AI model providers described in Section 6(a); - we do not transfer or sell Google user data to data brokers, and we do not use it for advertising or to build advertising profiles; - Verety personnel do not access your Google user data except with your explicit consent (for example, for support you have asked us to provide), where necessary to investigate a security incident or abuse, or where required by law. Revoking access and deletion. You can revoke Verety's access to your Google account at any time at https://myaccount.google.com/permissions. You can also delete your Verety account and its associated data by contacting legal@verety.ai (see Sections 10 and 13).
If you choose "Continue with GitHub," GitHub shares with us your name (if set), primary email address, GitHub username and account identifier, and avatar URL. We use this information only to create and authenticate your Verety account and to display your name in the Service, and we store it the same way described for Google user data in Section 7. We do not sell it or use it for advertising. You can revoke Verety's access from your GitHub account settings under Settings → Applications → Authorized OAuth Apps, and you can delete your Verety account by contacting legal@verety.ai.
We use a small number of first-party technologies: - a session cookie (HttpOnly) that keeps you signed in after you authenticate; - browser local storage that remembers your interface preferences, such as your light/dark theme choice, and short-lived UI state; - a first-party analytics script (Vercel Analytics) that helps us understand aggregate, non-identifying usage of the Service. We do not use third-party advertising cookies or cross-site tracking technologies.
We retain your account information for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Search history, investigation results, and uploaded evidence are retained as part of your account's history until you delete them or close your account. When you ask us to delete your account, we delete or de-identify your personal information within a commercially reasonable time, except where we are required or permitted by law to retain it (for example, records needed for tax, accounting, or legal-hold purposes). Backups are overwritten on a rolling basis in the ordinary course. To request deletion, email legal@verety.ai from the address associated with your account.
We use reasonable technical and organizational measures designed to protect personal information, including: - encryption of data in transit using current TLS (1.2 or 1.3); - encryption at rest of credentials and session tokens by our authentication provider; - access controls that restrict internal access to production systems and personal data to Verety personnel on a need-to-know basis; - reliance on established cloud infrastructure providers (Google Cloud and Vercel) for hosting and storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach affecting your information, we will notify you and any applicable regulator as required by law.
Verety is based in the United States, and our sub-processors may process information in the United States and other countries. Where personal information is transferred out of the EEA, the UK, or Switzerland, we rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses and the corresponding UK and Swiss addenda, together with our sub-processors' own transfer safeguards.
Depending on where you live, you may have some or all of the following rights: to access the personal information we hold about you; to correct inaccurate information; to delete your information; to obtain a portable copy; to restrict or object to certain processing; and to withdraw consent where processing is based on consent. To exercise any of these rights, email legal@verety.ai or use the contact form linked from verety.ai/pricing. We will verify your request against your account and respond within the time required by applicable law. We will not discriminate against you for exercising these rights. EEA / UK residents. In addition to the rights above, you have the right to lodge a complaint with your local data protection supervisory authority. California residents. We do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act, and we do not use or disclose sensitive personal information for purposes that would require an opt-out. You have the right to know what personal information we have collected, to delete it, and to correct it, exercisable through the contact points above. Third-party sign-in. You can disconnect Google or GitHub from Verety at any time using the links in Sections 7 and 8; doing so does not delete your Verety account, which you can delete separately.
The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact legal@verety.ai and we will delete it.
We may update this Privacy Policy from time to time. When we make a material change, we will update the "Version" and "Effective" dates above and make reasonable efforts to notify active accounts before the change takes effect, consistent with Section 15.2 of our Terms of Service. Your continued use of the Service after a change takes effect constitutes acceptance of the revised policy.
Verety Inc. Questions, requests, or complaints about this Privacy Policy or your personal information: legal@verety.ai, or the contact form linked from verety.ai/pricing.