Privacy Policy

This policy explains how Veriticity handles personal information when you use our website, the Veriticity dashboard and API, the AI assistants you connect to Veriticity, and Sandbox, our separate environment for testing. It applies to account holders, members invited to an organisation, people who join our waitlist and people who contact us.

The company that operates Veriticity, its registered details and its contact for data protection questions will be named here before this policy is final.

Organisations use Veriticity to set rules for what their AI agents may buy, to check purchase requests against those rules, to record the decisions and to manage who has access. An organisation decides what it puts into its account: its rules, its members and the purchases its agents request. We decide how we run accounts, keep the service secure and handle billing. Which of us is responsible for each kind of information in an organisation's account will be confirmed here before this policy is final.

Account information. Your name, email address and password, the organisations you belong to and your role in each, invitations you send or receive, and your settings, including your notification choices. We keep a record of changes to your email address.

Purchase records. The purchase requests made by your agents or by members: the merchant and its website, the items, amounts and currency, the reason given and any other details included. With each request we keep the decision, the rules it was checked against, any approval or rejection and the comment left with it, whether the approved purchase was used, and any outcome reported afterwards. Anything written into a request is kept with it, so don't include information about other people that the purchase doesn't need.

Veriticity does not make payments for purchases and does not receive or store the card numbers used to pay for them. An approval is permission to buy; the payment happens wherever the agent checks out, under that service's terms.

Credentials and connections. The API keys your organisation creates, the AI assistants and other applications connected to it, and the webhook addresses it sets up, with who created each one and when it was last used.

Billing information. Your plan and subscription, and the billing name, address and tax details you give. Card details are entered into Stripe's checkout and are held by Stripe, not by us. We show the card's brand and last four digits, which we read from Stripe.

Free trial. When you create your first account, we record that you've started a free trial, with a coded form of the email address you verified. The coded form can be matched against an address given to us again, but the address can't be read back from it.

Security and activity records. The network address and browser or device used when you sign in, when an account or organisation setting is changed, and when a purchase is approved or rejected. Your organisation's audit history records who made each change. We also count requests to limit repeated attempts, and record technical errors so we can fix them.

Communications. The emails we send you, the messages you send us, and, if you join the waitlist, your email address and anything you tell us about how you heard of Veriticity.

Information from others. Another member may give us your email address to invite you. A connected assistant sends us the purchase requests it makes for you or your organisation. Stripe tells us whether payments for your subscription succeeded.

We don't ask for sensitive information, such as health or financial account details, and the service doesn't need it.

UK data protection law requires a lawful basis for each way we use personal information. Where we rely on legitimate interests, the interest is set out below, and you can object to that use (see "Your rights and choices").

To provide your account and the service, including checking purchase requests against your rules, recording decisions and sending the emails the service needs, such as verification links, invitations and approval requests. If you hold the account yourself, this is necessary to perform our contract with you. If you are a member of an organisation that holds the account, we rely on our legitimate interest, and the organisation's, in providing the service the organisation signed up for.

To keep Veriticity secure and prevent misuse, including recording the network address and device used for sign-ins and important changes, limiting repeated attempts, keeping audit history and investigating problems. We rely on our legitimate interest in protecting the service, our customers and their accounts.

To find and fix faults, using records of technical errors. We rely on our legitimate interest in running a reliable service.

To bill subscriptions and keep financial records. This is necessary to perform our contract with the account holder, and to meet our legal obligations under tax and accounting law.

To offer each person one free trial, by checking a new account's verified email address against the coded addresses of earlier trials. We rely on our legitimate interest in preventing a trial being started again and again.

To answer your questions and support requests, and to contact people on our waitlist when Veriticity is available to them. We rely on our legitimate interest in responding to people who contact us.

To send product news and offers, only if you agree. You can withdraw your agreement at any time in Settings.

To keep a record of the terms and policy versions you accepted, to comply with the law, and to establish, exercise or defend legal claims. We rely on our legal obligations where they apply, and otherwise on our legitimate interest in being able to show what was agreed and what happened.

Giving us your name, email address and password is necessary to create an account. Without them, we can't provide one.

Your organisation. As their role allows, members of an organisation can see each other's names, email addresses and roles, and its purchase requests, decisions and audit history, including who made or decided each one. Members whose role allows it can download these records.

Applications your organisation connects. A connected AI assistant can read the purchase requests it made, their decisions, and the budgets and rules that apply to it. Whether it can see who decided depends on the role of the person who connected it. A webhook address your organisation sets up receives events about its purchase requests, such as approvals and rejections.

Our service providers, who process information for us under contract. Vercel hosts the application. Neon hosts our database. Upstash stores the short-lived counts we use to limit repeated attempts. An email delivery provider sends our email. Sentry, when we enable it, receives reports of technical errors, without account details, cookies or request contents, and with email addresses removed. We may use other providers for support and routine operations.

Stripe. Stripe processes subscription payments for us. It also uses information for its own purposes, such as preventing fraud and meeting its legal obligations, as described in Stripe's privacy policy.

Others where the law requires it. We may share information with professional advisers, or with courts, regulators or law enforcement where the law requires it or where it is needed to establish, exercise or defend legal claims.

We don't sell personal information, and we don't share it with advertisers.

When an agent or a member asks to make a purchase, the Trust Engine checks the request against the rules the organisation or account holder has set. The organisation chooses the rules. The decision itself is made automatically, by applying those rules to the request: it approves the request, refuses it, or asks a person to decide. Veriticity doesn't use criteria of its own, profiles or scores.

Where a rule asks a person to decide, a member whose role allows it approves or rejects the request. Where no rule asks, no person reviews the decision before it takes effect. An automatic refusal can't be overridden in Veriticity: the organisation can review the decision and change its rules, and a new request can then be made.

If an automated decision has a legal or similarly significant effect on you, you have the right to be told about it, to give your views, to ask for a person to review it, and to challenge it. To do this, contact your organisation or us.

Some of our service providers are based in, or process information in, the United States and other countries outside the UK. These include Vercel, Stripe and our email delivery provider. Information may also be processed wherever these providers or their own subcontractors operate.

When personal information is transferred outside the UK, UK law requires it to remain protected. The safeguards we rely on for each provider will be set out here before this policy is final.

We keep personal information only as long as we need it for the purposes in this policy. Some information is short-lived: sign-in sessions and the links in verification, reset and invitation emails expire within days, most request counts expire within an hour, and webhook delivery records are deleted after 30 days.

While your account is open, we keep your account information and the records you and your organisation create. You can close your account in Settings. When you do, we remove your name and email address from your account, sign you out of Live, remove you from every organisation and stop the AI connections you granted. If you were the only member of an organisation, that organisation is closed too, and its API keys stop working. You can't close your account while you are the only owner of an organisation that has other members, or while a paid subscription is active.

Some records outlive your account, because they belong to an organisation's history or are needed to show what happened. These are an organisation's purchase requests, decisions, approvals and audit history, which can still show the name and email address you had when they were made; records of the terms you accepted; your email address history and security records; billing records, including the record that you've had a free trial and the coded form of your email address; and the copy of your name and email address in Sandbox.

We keep these records for up to three years after your account closes. After that, we delete them or anonymise them so they no longer identify you. Where we can, we remove or reduce details that identify you sooner.

Some records may be kept longer where there is a specific reason. Billing and accounting records are kept for as long as tax and accounting law requires. Information needed to establish, exercise or defend a legal claim is kept until that need ends. Deleted information can remain in backups for a limited time until they are replaced. Stripe keeps its own records under its own policy.

Veriticity uses cookies and browser storage that are needed for the service you're using: to keep you signed in and secure your session, and to remember choices you make as you move between pages, such as the plan you picked before signing up, a purchase you're confirming from an email link, or that you've closed our notice about cookies.

We also remember two preferences in your browser: the organisation you last opened in the dashboard, and your light or dark theme. You can turn this off in the dashboard under Settings, Appearance, which deletes both from that browser. On our developer documentation, choosing the System theme deletes the theme saved there.

When you add a payment method, start a checkout or confirm a payment in the Live dashboard, Stripe's payment software loads so that you can pay. Stripe may set its own cookies and use information about your device to prevent fraud. See Stripe's cookie policy for details.

Our notice about cookies is for information only. Closing it records that you closed it and nothing else. "Cookies" at the bottom of our pages lists each cookie and storage item we use, what it's for and how long it lasts.

We don't use analytics, advertising or tracking cookies. You can block or delete cookies in your browser settings. If you block the cookies needed to sign in, you won't be able to use the dashboard.

We protect information with measures suited to the risk, including encrypted connections, access controlled by each member's role, passwords and keys stored so they can't be read back, limits on repeated attempts, and records of security-relevant activity.

No system is completely secure. If you think your account has been used without your permission, contact security@veriticity.com.

You can change your name, email address and notification choices, end sign-in sessions and close your account in Settings.

You also have rights under UK data protection law. You can ask for a copy of your personal information, ask us to correct it, ask us to delete it, ask us to restrict how we use it, and object to our use of it where we rely on legitimate interests. Where we use information you gave us to perform a contract or with your agreement, you can ask for it in a portable format. Where we rely on your agreement, you can withdraw it at any time.

These rights have limits. For example, we may keep information we need for a legal obligation or a legal claim, and we may not be able to delete records that also belong to an organisation's history. If information is held for an organisation, we may refer your request to that organisation.

To exercise a right, email support@veriticity.com. We may ask you to confirm your identity. We'll respond within one month, or tell you within that time if we need longer, as the law allows.

If you're unhappy with how we've handled your information, please contact us first and we'll try to resolve it. We'll acknowledge a complaint within 30 days. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at any time, at ico.org.uk/make-a-complaint.

Veriticity is for organisations and the adults who manage their spending. It is not intended for children. If you believe a child has given us personal information, contact us and we'll look into it.

We may update this policy. Each version has a version number and an effective date, shown at the top of this page.

Questions about this policy and requests about your information go to support@veriticity.com. Security concerns go to security@veriticity.com.