Privacy Policy

This Privacy Policy describes how [VERITY LEGAL ENTITY] (“we”) processes information in connection with Verity, an AI-powered contract analysis and decision-support product.

Controller/operator contact for privacy: [PRIVACY CONTACT EMAIL]. Legal entity, registration, and address (to be completed by Verity’s operator): [VERITY LEGAL ENTITY]; [COMPANY REGISTRATION NUMBER]; [REGISTERED ADDRESS].

This policy is written to be compatible with the Israeli Privacy Protection Law, 5741-1981, as amended, and related regulations, for Israeli operations and Israeli users. Other laws may also apply depending on where you and we are located. We do not claim that Verity is automatically compliant in every jurisdiction.

This policy covers personal data and related information processed when you visit public pages, create an account, upload documents, run analysis, pay for a plan, or contact us.

It does not cover third-party sites linked from the Service. Those sites have their own policies.

We collect:

• name
• email address
• login and account information (including a hashed password and session identifiers)
• workspace information (workspace name, membership, role, optional legal-entity label you enter)

Purpose: creating and securing your account, authentication, workspace administration, and communicating about the Service.

We collect:

• subscription information (plan, status, period, cancellation flags)
• payment status
• billing identifiers received from the payment provider (for paid plans, currently PayPal customer/subscription identifiers when PayPal checkout is used)

We do not store full payment-card numbers in Verity’s application database. Card or wallet details, if any, are handled by the payment provider.

Purpose: billing, invoicing, entitlement, fraud and abuse prevention, and accounting.

When you upload contracts we process:

• the files and associated content
• extracted text
• analysis results (findings, financial estimates, legal-context results drawn from the configured source registry, workflow metadata)
• metadata required to operate the Service (file names, page counts, timestamps, workspace linkage)

Purpose: providing contract analysis, displaying results to authorized workspace members, security, support, and service operation.

Customer Content is used to provide the Service to your workspace. Verity does not currently use Customer Content to train a Verity-owned model. Uploaded text may be sent to AI/model providers solely to generate analysis. We do not claim a universal rule that those providers never use inputs for their own purposes; that depends on our then-current provider contracts and settings, which qualified counsel should verify. We also do not claim that documents are always permanently deleted the moment you leave a page.

We may collect:

• IP address, where received by our host or application (including when stored with legal-acceptance records)
• browser and device information (for example User-Agent)
• logs and security information
• usage information (for example that an analysis ran, billing events, operator logs)

Purpose: security, debugging, abuse prevention, measuring service reliability, and (in production) limited page-view analytics via Vercel Analytics.

We do not currently run advertising or marketing cookies. See the Cookie Policy for the live inventory.

We process information to:

• provide Verity
• authenticate users
• perform contract analysis you request
• provide customer support
• secure the Service
• bill and collect fees
• prevent fraud and abuse
• improve the Service where legally permitted (for example reliability and interface), without a claim that we mine Customer Content for unrelated product training
• comply with legal obligations
• record Terms, Privacy, and billing acceptances and optional marketing consent

Depending on the relationship and jurisdiction, we may process data because it is needed to perform the contract (providing the Service), because we have a legitimate operational interest in security and billing, because you consented (for optional marketing), or because the law requires it.

For Israeli operations: the Privacy Protection Law and regulations may require a database to be registered, or may not, depending on the types of data, the nature of the processing, and the current statutory and regulatory tests. We do not state that Verity is automatically exempt from Israeli database obligations. We do not state that registration is always required. The actual obligation depends on the data processing and current law, and should be confirmed by Verity’s operator with qualified counsel.

If you are in Israel, you may have rights of access and correction, and other rights under that law, subject to statutory exceptions.

We share information with service providers who process it on our instructions to host, store, analyze, bill, authenticate, email, or measure the Service.

Providers actually used in this product (categories and names):

• Vercel (hosting): Application hosting and deployment.
• Vercel Blob (storage): Object storage for uploaded PDFs when blob credentials are configured; otherwise local filesystem on the host.
• PostgreSQL (database): Account, workspace, document metadata, analysis results, billing, and legal-acceptance records.
• Verity first-party accounts (authentication): Email and password registration, session cookies. No third-party identity provider is wired in the current codebase..
• PayPal (payments): Paid-plan checkout and subscription billing when BILLING_PROVIDER is paypal (the default).
• Internal entitlement ledger (payments): Free-plan activation and zero-price plans; not a card processor.
• Anthropic (ai): Model inference when ANTHROPIC_API_KEY is configured.
• OpenAI (ai): Model inference when OPENAI_API_KEY is configured and Anthropic is not selected.
• Resend (email): Transactional email when a Resend API key is configured; otherwise messages are logged and not sent.
• Vercel Analytics (analytics): Production page-view measurement.

We do not sell Customer Content. Workspace members you invite can see packets in that workspace.

We may disclose information if required by law, to protect the Service, or in a reorganization of [VERITY LEGAL ENTITY] where the successor is bound to comparable protections.

Infrastructure providers may process data outside Israel, including in the United States or the European Economic Area, depending on how those providers operate.

Where a transfer restriction applies, we rely on appropriate contractual, technical, and organizational measures available from those providers and on our own access controls. We do not claim a single transfer mechanism that covers every provider and every country.

We keep account data while the account is open and for a reasonable period afterward for security, billing, and legal claims.

Customer Content remains while the workspace retains it. Workspace settings may keep original PDFs after analysis; turning that setting off affects new retention behavior and does not by itself prove that every historical copy is gone.

Backups, logs, and billing records may last longer than the live workspace copy.

On account closure we delete or de-identify Customer Content from live systems within a reasonable period, except:

• billing and tax records
• acceptance and consent records that we keep as proof of agreement
• security logs
• data we are legally required to keep
• residual backup copies until they cycle out

We do not promise instantaneous or universal erasure from every backup.

We use reasonable technical and organizational measures appropriate to a hosted SaaS product, including hashed passwords, session cookies marked HttpOnly, access scoped to workspaces, and private object storage when blob storage is configured.

No method of transmission or storage is completely secure. Report suspected incidents to [PRIVACY CONTACT EMAIL] and [LEGAL CONTACT EMAIL].

Subject to applicable law, you may request access, correction, deletion, or restriction of personal data, and you may withdraw optional marketing consent.

Workspace administrators may manage member access.

To exercise rights, email [PRIVACY CONTACT EMAIL]. We may need to verify your identity.

You may also have the right to lodge a privacy complaint with the relevant authority in your country. For Israel, complaints concerning the Privacy Protection Law may be directed to the Israeli Privacy Protection Authority, in addition to contacting us first at [PRIVACY CONTACT EMAIL].

The Service is not directed to children and is intended for organizational and professional use. We do not knowingly collect personal data from children.

Optional product updates and offers are collected only if you separately opt in. That consent is not required to create an account and is stored apart from Terms acceptance. You can withdraw it later from account settings or by emailing [PRIVACY CONTACT EMAIL].

We may update this policy. The version, effective date, and “Last updated” date appear on the legal page. Material changes will be notified in-product where appropriate.

Privacy: [PRIVACY CONTACT EMAIL] Legal: [LEGAL CONTACT EMAIL] Operator: [VERITY LEGAL ENTITY], [COMPANY REGISTRATION NUMBER], [REGISTERED ADDRESS]