1. Introduction and organisational info
Our primary goals in processing personal information include:
- Enhancing the user experience on our platform by understanding customer needs and preferences.
- Providing timely support and responding to inquiries or service requests.
- Improving our products and services to meet the evolving demands of our users.
- Conducting necessary business operations, such as billing and account management.
It is our policy to process personal information with the utmost respect for privacy and security. We adhere to all relevant regulations and guidelines to ensure that the data we handle is protected against unauthorised access, disclosure, alteration and destruction. Our practices are designed to safeguard the confidentiality and integrity of your personal information, while enabling us to deliver the services you trust us with.
We do not have a designated Data Protection Officer (DPO) but remain fully committed to addressing your privacy concerns. Should you have any questions or require further information about how we manage personal information, please contact us at info@veritome.eu or +353 89 983 6545.
Your privacy is our priority. We are committed to processing your personal information transparently and with your safety in mind. This commitment extends to our collaboration with third-party services that may process personal information on our behalf, such as in the case of sending invoices. All activities are conducted in strict compliance with applicable privacy laws.
For the purposes of the GDPR, Relay Labs Ltd is the data controllerresponsible for the personal information described in this policy.
Data controller: Relay Labs Ltd (Veritome)
Website: veritome.eu
Email: info@veritome.eu
Phone: +353 89 983 6545
Dublin, Ireland
2. Scope and application
Our privacy policy is designed to protect the personal information of all our stakeholders, including website visitors, registered users and customers. Whether you are just browsing our website veritome.eu, using our services as a registered user, or engaging with us as a valued customer, we ensure that your personal data is processed with the highest standards of privacy and security. This policy outlines our practices and your rights related to personal information.
3. Data collection and processing
We gather personal data through various interactions, including but not limited to when you use our services or products such as Veritome EU AI Act and Veritome Academy, or directly provide information to us. The following list details the types of personal information we may process:
- First and last name
- Email address and/or phone number
- Billing details (your billing contact and subscription record — card details are entered directly with our payment processor, Stripe, and are never received or stored by us)
- Device ID
- IP address
- Browser information and language
- Operating system and version
- Browser fingerprint
- IP-based approximate location
- Interaction logs (e.g. clicks, time spent on pages)
- Purchase history
- Payment method and history
We only process information that is essential for delivering our services, complying with legal obligations, or enhancing your user experience. We rely on the following legal bases: performance of our contract with you (account, subscription and support), our legitimate interests (security, fraud prevention, service improvement), your consent (optional cookies, analytics and marketing email), and compliance with legal obligations (tax and accounting records). We keep account and compliance records for the retention period configured for your organisation, seven years by default; technical documentation, conformity records and generated dossiers are kept for at least ten years to meet Article 18 of the EU AI Act; read notifications are removed after one year and webhook delivery logs after 90 days. After your subscription ends you have 30 days to export your content, after which it is deleted from active systems subject to those legal floors., complying with legal obligations, or enhancing your user experience. Your privacy is paramount, and we are dedicated to handling your personal information responsibly and in accordance with all applicable laws.
4. How we use personal information
The data we collect serves multiple purposes, all aimed at enhancing the services we offer. Here are the key ways in which we use the personal information collected:
- Authentication and security
- Content delivery
- Communication efforts
- Processing transactions
- Providing access to exclusive content
- Compliance with legal obligations
- Customer support
- Fraud prevention and risk management
- Payment processing
- User engagement and retention
- User feedback and satisfaction
We process your personal information transparently and in accordance with your preferences and applicable privacy laws. We are committed to ensuring that your data is used solely for the purposes for which it was collected and in ways that you have authorised.
5. Data storage and protection
Data storage
Personal information is stored on secure servers in Germany (Nuremberg and Falkenstein). Some processing takes place elsewhere in the EU — Aria, our AI assistant, is run by Mistral AI in Paris — and a small number of our sub-processors are established in the United States, including Resend, Stripe, Google, Microsoft, GitHub and Atlassian. Those transfers are made under the European Commission's Standard Contractual Clauses, together with supplementary measures including encryption and access controls. The full list is on our Sub-processors page. For services that require international data transfer, we ensure that such transfers comply with all applicable laws and maintain data protection standards equivalent to those in our primary location.
Data hosting partners: We partner with reputable data hosting providers committed to using state-of-the-art security measures. These partners are selected based on their adherence to stringent data protection standards.
Data protection measures
- Encryption: To protect data during transfer and at rest, we employ robust encryption technologies.
- Access control: Access to personal information is strictly limited to authorised personnel who have a legitimate business need to access the data. We enforce strict access controls and regularly review permissions.
- Security audits and monitoring: Regular security audits are conducted to identify and remediate potential vulnerabilities. We also monitor our systems for unusual activity to prevent unauthorised access.
Data processing agreements
When we share your data with third-party service providers, we do so under the protection of Data Processing Agreements (DPAs) that ensure your information is managed in accordance with the GDPR and other relevant data protection laws. These agreements mandate that third parties implement adequate technical and organisational measures to ensure the security of your data. Our current sub-processors are listed on our Sub-processors page.
6. Transparency and control
We believe in transparency and providing you with control over your personal information. You will always be informed about any significant changes to our sharing practices, and where applicable, you will have the option to consent to such changes.
Your trust is important to us, and we strive to ensure that your personal information is disclosed only in accordance with this policy and when there is a justified reason to do so. For any queries or concerns about how we share and disclose personal information, please reach out to us at info@veritome.eu or +353 89 983 6545.
7. User rights and choices
We recognise and respect your rights regarding your personal information, in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. Below is an overview of your rights:
- Right of access (Art. 15 GDPR): to request access to the personal information we hold about you and to obtain information about how we process it.
- Right to rectification (Art. 16 GDPR): to request the correction or completion of personal information that is incorrect or incomplete.
- Right to erasure — ‘right to be forgotten’ (Art. 17 GDPR): to request the deletion of your personal information when it is no longer necessary for the purposes for which it was collected, among other circumstances.
- Right to restriction of processing (Art. 18 GDPR): to request that we restrict the processing of your personal information under certain conditions.
- Right to data portability (Art. 20 GDPR): to receive your personal information in a structured, commonly used and machine-readable format and to transmit it to another controller.
- Right to object (Art. 21 GDPR): to object to the processing of your personal information under certain conditions, including processing for direct marketing.
- Right to withdraw consent (Art. 7(3) GDPR): where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of processing before its withdrawal.
- Right to lodge a complaint (Art. 77 GDPR): to lodge a complaint with a supervisory authority if you believe our processing violates applicable data protection laws.
To exercise any of these rights, use our data request form at veritome.eu/data-request or contact us at info@veritome.eu or +353 89 983 6545. We will respond in accordance with applicable data protection laws and within the timeframes they stipulate. In some cases we may need to verify your identity as part of the process to ensure the security of your personal information.
9. Data breach notification procedures
In the event of a data breach that poses a risk to your privacy rights and freedoms, we have established clear procedures for promptly identifying, assessing and mitigating the impact of the breach, designed to comply with applicable data protection laws including the GDPR.
Detection and assessment
- Internal monitoring: we employ robust security measures and monitoring systems to detect and respond to potential data breaches promptly.
- Assessment of breach impact: upon discovery, we conduct a thorough assessment to determine the nature and scope of the breach, including the types of personal information involved and the potential impact on affected individuals.
Notification obligations
- Regulatory authorities: where required by law, we will notify the relevant data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, following the procedures specified by applicable regulations.
- Affected individuals: if a data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, providing clear information about the breach, the types of personal information affected, and the steps you can take to protect yourself. Where feasible and appropriate, we may notify you by email using the contact information provided to us.
If you have any questions or concerns about a data breach or believe you may have been affected, please contact us immediately at info@veritome.eu or +353 89 983 6545.
10. Policy updates and changes
We may update this privacy policy from time to time to reflect changes in legal requirements, industry standards or our business operations. Any updates will be communicated transparently and in accordance with applicable data protection laws.
Notification process: in the event of significant changes that may affect your rights or the way we handle your personal information, we will provide notice through prominent means, such as email or website notifications, and indicate the effective date of the updated policy at the top of this document.
Opt-in consent for material changes: for material changes that require your consent under applicable data protection laws such as the GDPR, we will seek your explicit opt-in consent before implementing the changes. You will have the opportunity to review the updated policy and provide your consent before any changes take effect.
11. Contact us
Relay Labs Ltd (Veritome)
Email: info@veritome.eu
Phone: +353 89 983 6545
Dublin, Ireland
See also our Legal Notice and Cookie Policy.