Privacy Policy

Controller pursuant to Art. 4 No. 7 GDPR:

verifuse

Operator identity not yet configured

Email: contact@verifuse.app

Represented by: Operator representative not configured

Data Protection Officer (DPO):

The Data Protection Officer can be reached via the privacy email below.

Email: contact@verifuse.app

2.1 Personal data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). This includes both direct identifiers (such as name, work email) and indirect identifiers (such as correlation IDs, IP address, hashed tokens).

2.2 We collect personal data in the following ways:

• Directly from you: When joining the waitlist, booking a demo, contacting us through the contact form, or consenting to receive product-launch updates.
• Automatically: Through your use of our public website, technical data such as IP address, request time, browser and user-agent information, device type and access logs are captured for security and abuse prevention.
• From third parties: From self-hosted identity (ZITADEL), payment processors (Stripe), email delivery (Amazon SES), the AI-Gateway provider and integration partners that you actively connect.
• From public sources: To the extent permitted by law, we may also process data from publicly available sources when verifying counterparty or product information.

2.3 We only process personal data that is strictly necessary for the stated purposes (data minimisation, Art. 5(1)(c) GDPR).

3.1 We process your personal data for the following purposes and on the basis of the stated legal grounds:

3.2 Where we process special categories of personal data (Art. 9 GDPR) — for example because they appear in user evidence — we do so on the basis of Art. 9(2)(a), (b), (f) or (g) GDPR only to the extent strictly required by the service.

5.1 The public verifuse landing is designed to operate without advertising or third-party tracking cookies. We use cookies and similar storage technologies to keep the website functional and, with your consent, to measure aggregated traffic.

5.2 Cookie categories used:

5.3 You can change your analytics choice at any time through the cookie banner on the public landing or via your browser settings. Detailed information about the cookies used can be found in our Cookie Directory.

6.1 We only disclose your personal data to third parties in the following cases:

6.2 We do not sell your personal data and do not disclose it to third parties for advertising purposes.

6.3 A complete list of all sub-processors pursuant to Art. 28(2) GDPR can be requested by sending an email to contact@verifuse.app.

7.1 Core verifuse business data (waitlist, evidence, audit logs, billing) is intended to remain in EU regions. If personal data is transferred to a country outside the EU/EEA, this only happens under Chapter V GDPR safeguards.

7.2 The following third-country transfers may currently occur:

• United States (Vercel, Stripe, AI-Gateway): Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, supplemented by technical and organisational measures.
• United States (Cal.com, LinkedIn): only when you explicitly activate the external link or booking flow.

7.3 For transfers to the USA we rely on the EU Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) in its current version. We additionally implement technical protective measures (TLS 1.3 in transit, AES-256 at rest, pseudonymisation where feasible) and ensure that recipients provide adequate data-protection guarantees.

7.4 A copy of the applicable Standard Contractual Clauses can be requested from us at: contact@verifuse.app.

8.1 We store personal data only as long as necessary to achieve the processing purposes or as required by legal retention obligations.

8.2 Specific retention periods:

• Unconfirmed waitlist entries: 30 days after confirmation token expiry.
• Confirmed waitlist contacts: until you withdraw consent or unsubscribe.
• Unsubscribed contacts: only the minimal suppression record where legally justified.
• Waitlist message audit: approximately 24 months, subject to legal review.
• Account and profile data: for the duration of the subscription and until deletion is complete (max. 90 days after contract end, unless legal retention obligations apply).
• Payment data and invoices: 10 years pursuant to § 147 AO, § 257 HGB.
• Application security logs: generally 30 days unless an incident requires preservation.
• Audit log: 5 years for compliance and documentation purposes.
• AI inputs and outputs: 30 days by default, faster deletion available on request.
• Web Analytics: aggregated according to the retention controls of the configured Vercel plan; the visitor-identification hash resets daily.

8.3 After the retention periods expire, data is routinely and lawfully deleted or blocked. Data that remains necessary for other purposes (for example legal hold) remains stored in blocked form.

8.4 Further information on account deletion can be found in our Terms of Service, Section 12.

9.1 As a data subject, you have the following rights:

9.2 To exercise your rights, please send an email to contact@verifuse.app or a letter to our postal address. We will respond to your request within 30 days.

9.3 In case of reasonable doubts about your identity, we may request additional information to verify your identity.

10.1 We do not use automated decision-making on the public landing or the waitlist that produces legal effects or similarly significantly affects you (Art. 22(1) GDPR).

10.2 Within the invite-only product we may draft AI-assisted proposals (control mappings, evidence triage, vulnerability classification). These drafts are always subject to policy evaluation and an accountable human approval before any consequential business-state change.

10.3 Whenever profiling is used, you have the right to human intervention, to express your point of view and to contest the decision (Art. 22(3) GDPR). Please contact contact@verifuse.app.

11.1 The verifuse website and waitlist are exclusively aimed at persons who have reached the age of 18 and are authorised to act on behalf of a business or organisation.

11.2 We do not knowingly collect personal data from persons under 18. If we become aware that data from minors has been inadvertently collected, we will delete it without undue delay.

11.3 If you are a parent or guardian and become aware that your child has provided us with personal data without your consent, please contact us immediately at contact@verifuse.app.

12.1 We implement appropriate technical and organisational measures (TOMs) pursuant to Art. 32 GDPR to ensure a level of security appropriate to the risk for personal data.

12.2 The implemented security measures include, but are not limited to:

• Encryption: TLS 1.3 for all data transmissions; AES-256 encryption for stored data.
• Identity & access control: invite-only identity (ZITADEL), invite-only provisioning, role-based access control (RBAC), membership-backed tenant context.
• Row-level security: database RLS with a runtime role that cannot bypass tenant policies.
• Network security: firewall, DDoS protection, network segmentation, mTLS or signed tokens between apps.
• Storage safety: S3-compatible bucket versioning, Object Lock retention, off-host backups.
• Operational monitoring: OpenTelemetry, Prometheus, Grafana, Loki; documented incident-response procedure.
• Audit: correlation identifiers, append-only audit events, regular penetration tests later in the release plan.

12.3 Despite all security measures, no 100% guarantee can be given for the absolute security of data transmissions over the internet. We cannot fully guarantee the security of data you transmit to us electronically.

13.1 The verifuse product uses an AI-Gateway that wraps a single LLM provider. The processing of your data by this provider occurs under the provider's responsibility as an independent controller.

13.2 When AI is used, the following data is processed:

• Your inputs (prompts, instructions, evidence excerpts, context information)
• Outputs and reviewable proposals generated by the model
• Re-prompt, redaction and policy-filter metadata

13.3 We have entered into contractual agreements with the AI provider to ensure that:

• Your data is not used for training the model (except with explicit consent)
• Adequate security measures are implemented
• Applicable data-protection laws are complied with

13.4 Important: You should avoid including personal data or confidential information in AI inputs that you are not prepared to share with the AI provider. While we filter inputs and outputs through the policy engine, ultimate responsibility for the content you send to the AI remains with you.

14.1 The verifuse product enables integration with third-party services that you actively connect. When using these integrations, the data-protection provisions of the respective provider also apply.

14.2 The following integration patterns are subject to additional terms:

• OAuth authorisation: when connecting with OAuth-enabled services, you will be asked to grant verifuse access to specific data. The scope is limited to the minimum required by the integration.
• API keys: API keys you provide for third-party providers are stored encrypted and used only for the specified integration.
• Webhook data: when using webhooks, data is transmitted to the endpoints you specify. Please ensure that your endpoints are secured.

14.3 We assume no responsibility for the data-protection practices of integrated third-party providers. We recommend reading the privacy policies of the respective services.

16.1 We reserve the right to update this Privacy Policy from time to time. Significant changes will be communicated to you by email at least 30 days before they take effect.

16.2 The current version is available at /privacy.

16.3 If changes may materially affect the processing of your data, we will additionally inform you of the most important changes and give you the opportunity to object or close your account.

17.1 For questions about data protection or to exercise your data subject rights, please contact:

Email: contact@verifuse.app

Postal address: verifuse, Privacy Team, Operator identity not yet configured

17.2 You have the right to lodge a complaint with a data-protection supervisory authority regarding our processing of your personal data. The supervisory authority responsible for us must be supplemented with the registered seat once the legal entity is finalised.

17.3 You may also contact the supervisory authority of your country of residence or any supervisory authority in the EU.