Privacy Policy

Welcome to Vera. We understand that legal documents contain highly sensitive and confidential information. This Privacy Policy explains how we collect, use, process, and protect your personal information and uploaded documents when you use our website, platform, and the Vera Risk Engine™ (collectively, the "Service"). Your privacy and data security are our top priorities.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

We collect several different types of information for various purposes to provide and improve our Service to you.

2.1. Account Information

When you register for an account, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. This includes your first and last name, email address, password (which is hashed and securely stored), and account preferences.

2.2. Uploaded Documents and Contracts

The core function of Vera is to analyze documents. When you upload a PDF file or paste text into the Vera Risk Engine™, we collect that document content. This includes the full text of the agreement, identifying metadata, names of contracting parties, and any financial or legal terms contained within the document.

2.3. Payment Information

If you purchase a scan pack or subscription, Lemon Squeezy processes the transaction. Vera does not receive or store complete card numbers or CVV codes. We retain provider identifiers, purchase credits, and subscription status needed to provide billing access.

When you access our platform, our servers automatically record certain technical data. This information helps us ensure the security of the platform and understand how users navigate the Service.

• Device and Connection Data: We collect your IP address, browser type, browser version, operating system, and unique device identifiers.
• Service Operations: We process request timing, rate-limit counters, and feature events needed to operate and secure the Service. Vera does not currently load a third-party behavioral analytics tag.
• Log Data: In the event of an application error, we collect log data regarding performance metrics, crash reports, and system security flags to troubleshoot the issue.

Vera uses the collected data for various indispensable purposes:

• Providing the Service: To operate the Vera Risk Engine™, parse your documents, and generate accurate risk reports and plain-English summaries.
• Account Management: To maintain your account securely, authenticate your login, and manage your subscription and billing.
• Customer Support: To respond to your inquiries, troubleshoot technical issues, and provide assistance when requested.
• Security and Fraud Prevention: To monitor for unusual activity, detect potential security breaches, and enforce our Acceptable Use Policy.
• Service Improvement: To analyze usage trends and infrastructure load to optimize the speed, reliability, and design of the platform.

Because we handle highly sensitive legal documents, we want to be completely transparent about our processing pipeline. When you upload a document:

• The document is transmitted over HTTPS to Vera's server-side processing route.
• PDF text is extracted and submitted to Google Cloud/Vertex AI for clause analysis; Vera then validates the response and calculates the risk score.
• The normal analysis path is automated. Support staff should only access report information when needed to respond to a request or investigate abuse or reliability issues.

We do not hoard your data. Our retention protocols are designed to minimize risk:

• Raw Uploaded Contracts: Vera processes the PDF or pasted text for the request and does not save the source document to its report database. Contract text is transmitted to the AI provider and is subject to that provider's applicable data-handling terms.
• Generated Reports: The resulting risk reports, risk scores, and extracted clause summaries are saved to our encrypted database so you can access them later via your user Dashboard. You may delete these reports manually at any time.
• Account Data: You may permanently delete your account and its saved reports from Settings. Provider records that must be retained for fraud, tax, billing, or legal compliance may remain with the relevant provider.

Vera does not sell, rent, or trade your personal information or uploaded documents to data brokers or advertising networks. We only share data with trusted third parties necessary to operate the Service:

7.1. Service Providers

We use Vercel, Firebase, Google Cloud/Vertex AI, and Lemon Squeezy to host the application, authenticate users, process contract text, store reports, and process payments. Their handling is governed by their applicable terms and privacy commitments.

7.2. Legal Compliance

We may disclose your information if we are required to do so by law, such as to comply with a valid subpoena, binding court order, or formal request from law enforcement authorities.

7.3. Business Transfers

In the event that Vera is involved in a merger, acquisition, bankruptcy, or sale of assets, user information may be transferred as part of that transaction. We will notify users via email or a prominent notice on our website before personal data is transferred and becomes subject to a different Privacy Policy.

We implement robust technical and organizational measures to protect your data:

• Encryption: Production traffic is sent over HTTPS, and managed infrastructure providers apply their platform encryption controls.
• Access Controls: Authentication, owner-scoped server queries, session-cookie validation, and least-privilege service credentials limit access to reports and production systems.

While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. No method of transmission over the Internet, or method of electronic storage, is 100% secure.

Depending on your jurisdiction (such as the GDPR in Europe or the CCPA in California), you may have specific rights regarding your personal data. Vera extends these core rights to all users globally:

• The Right to Access: You can request a copy of the personal data we hold about you.
• The Right to Rectification: You can request that we correct any information you believe is inaccurate or incomplete.
• The Right to Erasure ("Right to be Forgotten"): You can request that we erase your personal data and account entirely.
• The Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

To exercise any of these rights, please contact us at privacy@verahq.xyz. We will respond to your request within 30 days.

Vera uses cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.

We use Essential Cookies strictly necessary to authenticate users, prevent fraudulent use of user accounts, and maintain secure sessions. We may also use Analytics Cookies to understand how users interact with the platform. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent, but some portions of the Service may not function properly without them.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.