How Veridect handles personal data

1. Who we are

Veridect is based in the United States and led by Lisa Russell, CEO. For the personal data described here, Veridect is the controller. You can reach us about anything in this notice at lrussell@veridect.ai or through the contact page.

This notice covers veridect.ai and the pages under it, including the narrated tour and the live system pages, and nothing else.

2. Visiting the site

Reading the site does not require an account, and we do not run advertising or third-party analytics on it. What is processed when you visit:

• Server logs. Our hosting platform records the IP address, browser type, requested page, and time of each request, as every web server does. We use these only to keep the site running and secure.
• One technical cookie. The hosting platform sets a load-balancing cookie so your requests reach the same server. It identifies a session, not you, and we set no analytics or advertising cookies of our own.
• Fonts. Pages load typefaces from Google Fonts, so your browser sends Google the request for the font files, which includes your IP address.
• Tour experience beacon. If a step of the narrated tour fails to load, your browser tells us which step failed, the kind of failure, and whether you were on a phone or a desktop, tagged with a random page identifier. No IP address, name, or account is attached to it.
• Contact form. If you write to us, the name, email address, company, and message you enter are delivered to our mailbox as an email (through Resend, an email delivery service) and kept there so we can reply.

3. Using the live system

The live pages let you put your own scenario through Veridect: a question to the consensus engine, an action through the pre-action gate, or a step in the tour. When you do, this is what happens to the text you enter:

• It is sent to the frontier model providers the system consults (currently Anthropic, OpenAI, Google, and Perplexity), some of them through our hosting platform's model gateway or through OpenRouter. Each provider processes it under its own terms.
• Formatted identifiers such as email addresses, phone numbers, and card numbers are stripped from consensus questions before they reach a model. That is a safeguard, not an invitation.
• A consensus question and its answer may be held in a short-lived cache so a repeated question returns the same checked answer. Actions put through the pre-action gate, and the decisions shown in the tour, are written to a tamper-evident, hash-chained record in our database so the demonstration can show a real, verifiable trail. Those records are kept as part of the running demonstration.

4. If we emailed you

We write to senior leaders at large companies about a matter directly connected to their role: one email, and at most one follow-up. If you received one, here is how we came to have your details and what we hold:

• Source. Your name, job title, employer, work email address, and public professional profile link came from a business contact database (Apollo.io) or from your public professional profile. We do not buy consumer data and we do not use personal email addresses.
• What we add. To write something relevant rather than generic, we research your company from public sources (news, filings, its own website) and use software tools, including AI models, to help draft the message. The research is about the company and the role; we do not build profiles of you as a person, and no decision with legal or similarly significant effects is made about you automatically.
• What we record. Whether the email was sent, bounced, or answered, and any reply you send.
• How to stop it. Reply with the word unsubscribe, or write to lrussell@veridect.ai. Your address goes on a do-not-email list that every send is checked against, and we keep that entry so the objection holds.

We do not sell personal data, and we do not share contact data with other companies for their marketing.

5. Legal bases (EU, EEA, and UK)

If you are in the European Union, the European Economic Area, or the United Kingdom, we rely on these bases under the GDPR and UK GDPR:

• Legitimate interests for running and securing the site, for recording live-system decisions so the demonstration is real, and for contacting business leaders about a matter connected to their professional role. We weigh those interests against your rights before we rely on them, and you can object at any time (see section 8).
• Your request when you write to us through the contact form or by email and we respond.
• Legal obligations where a law requires us to keep or disclose something.

6. Where data goes

We are based in the United States, and the site, the live system, and our database run there. If you are outside the United States, your personal data is processed there, outside your jurisdiction. The providers below act on our behalf under their own published data-processing terms, and we do not currently operate a European-hosted instance of the live system.

We disclose personal data beyond this only if a law or a valid legal process requires it, or to protect the security of the service.

7. How long we keep it

• Server logs: for a short period, for security and troubleshooting.
• Contact messages: for as long as the conversation is live and for a reasonable time afterwards.
• Outreach contact data: until you object, or until we no longer have a reason to hold it, which we review periodically. Do-not-email entries are kept indefinitely so the objection continues to be honoured.
• Live-system decision records: for as long as the demonstration runs; they contain whatever text was entered, which is why we ask you not to enter personal data.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable form, and to withdraw any consent you have given. To exercise any of these, email lrussell@veridect.ai. We will respond within one month, and we may ask you to confirm your identity first.

If you are in the EU, EEA, or UK and believe we have handled your data unlawfully, you can lodge a complaint with your national data protection authority. We would appreciate the chance to resolve it directly first.

This site and the live system are for business use and are not directed at children.

9. Security

Traffic to the site and the live system is encrypted in transit. Access to our systems and mailboxes is limited to the people who need it. Gate decision records in the live system are hash-chained so that any alteration is detectable, which is the same mechanism customers rely on in production. No system is perfectly secure, and we do not claim ours is; if you believe you have found a weakness, please tell us at the address below.

10. Contact and changes

Questions, requests, and objections: lrussell@veridect.ai, or the contact page. When we change this notice we update the date at the top; material changes to how we use data will be explained on this page.

This notice explains our practices in plain language. It is not legal advice, and it does not describe the contractual terms, data processing agreements, or deployment arrangements that apply to a production customer, which are agreed directly with each customer.