Privacy Policy

Welcome to Vera. We understand that legal documents contain highly sensitive and confidential information. This Privacy Policy explains how we collect, use, process, and protect your personal information and uploaded documents when you use our website, platform, and the Vera Risk Engine™ (collectively, the "Service"). Your privacy and data security are our top priorities.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Service.

We collect several different types of information for various purposes to provide and improve our Service to you.

2.1. Account Information

When you register for an account, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. This includes your first and last name, email address, password (which is hashed and securely stored), and account preferences.

2.2. Uploaded Documents and Contracts

The core function of Vera is to analyze documents. When you upload a PDF file or paste text into the Vera Risk Engine™, we collect that document content. This includes the full text of the agreement, identifying metadata, names of contracting parties, and any financial or legal terms contained within the document.

2.3. Payment Information

If you purchase a premium subscription, billing information is required. We use third-party payment processors (such as Stripe) to handle all transactions securely. Vera does not store complete credit card numbers, CVV codes, or full financial data on our servers. We only retain the transaction ID, subscription status, and billing history.

When you access our platform, our servers automatically record certain technical data. This information helps us ensure the security of the platform and understand how users navigate the Service.

• Device and Connection Data: We collect your IP address, browser type, browser version, operating system, and unique device identifiers.
• Usage Analytics: We track the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and interactions with specific features (like the "Scan" button).
• Log Data: In the event of an application error, we collect log data regarding performance metrics, crash reports, and system security flags to troubleshoot the issue.

Vera uses the collected data for various indispensable purposes:

• Providing the Service: To operate the Vera Risk Engine™, parse your documents, and generate accurate risk reports and plain-English summaries.
• Account Management: To maintain your account securely, authenticate your login, and manage your subscription and billing.
• Customer Support: To respond to your inquiries, troubleshoot technical issues, and provide assistance when requested.
• Security and Fraud Prevention: To monitor for unusual activity, detect potential security breaches, and enforce our Acceptable Use Policy.
• Service Improvement: To analyze usage trends and infrastructure load to optimize the speed, reliability, and design of the platform.

Because we handle highly sensitive legal documents, we want to be completely transparent about our processing pipeline. When you upload a document:

• The document is securely transmitted via encrypted TLS/SSL channels to our isolated processing servers.
• The text is extracted and fed into the proprietary Vera Risk Engine™ and our trusted AI infrastructure providers for mathematical risk scoring and clause analysis.
• The analysis is fully automated. No human employee at Vera manually reads or reviews your confidential contracts unless you explicitly request technical support for a specific document issue.

We do not hoard your data. Our retention protocols are designed to minimize risk:

• Raw Uploaded Contracts: The original PDF files and pasted raw text are temporarily processed in memory. We actively delete the raw source files from our processing servers immediately after the analysis report is successfully generated. We do not maintain a permanent archive of your raw documents.
• Generated Reports: The resulting risk reports, risk scores, and extracted clause summaries are saved to our encrypted database so you can access them later via your user Dashboard. You may delete these reports manually at any time.
• Account Data: If you choose to terminate and delete your account, we will permanently purge all your personal information, user metadata, and historical reports from our active databases within 30 days.

Vera does not sell, rent, or trade your personal information or uploaded documents to data brokers or advertising networks. We only share data with trusted third parties necessary to operate the Service:

7.1. Service Providers

We utilize industry-leading cloud infrastructure providers (such as Vercel, Firebase, and Google Cloud) to host the application, securely store the generated reports, and manage user authentication. We use Stripe for payment processing. These providers are bound by rigorous confidentiality and data protection agreements.

7.2. Legal Compliance

We may disclose your information if we are required to do so by law, such as to comply with a valid subpoena, binding court order, or formal request from law enforcement authorities.

7.3. Business Transfers

In the event that Vera is involved in a merger, acquisition, bankruptcy, or sale of assets, user information may be transferred as part of that transaction. We will notify users via email or a prominent notice on our website before personal data is transferred and becomes subject to a different Privacy Policy.

We implement robust technical and organizational measures to protect your data:

• Encryption: All data transmitted between your browser and our servers is encrypted using modern TLS/SSL protocols. Data at rest in our databases is encrypted using AES-256 standards.
• Access Controls: Access to our production databases and AI processing environments is strictly limited to authorized engineering personnel via multi-factor authentication (MFA) and secure VPNs.

While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. No method of transmission over the Internet, or method of electronic storage, is 100% secure.

Depending on your jurisdiction (such as the GDPR in Europe or the CCPA in California), you may have specific rights regarding your personal data. Vera extends these core rights to all users globally:

• The Right to Access: You can request a copy of the personal data we hold about you.
• The Right to Rectification: You can request that we correct any information you believe is inaccurate or incomplete.
• The Right to Erasure ("Right to be Forgotten"): You can request that we erase your personal data and account entirely.
• The Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

To exercise any of these rights, please contact us at privacy@verahq.xyz. We will respond to your request within 30 days.

Vera uses cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.

We use Essential Cookies strictly necessary to authenticate users, prevent fraudulent use of user accounts, and maintain secure sessions. We may also use Analytics Cookies to understand how users interact with the platform. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent, but some portions of the Service may not function properly without them.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.