How Veram handles personal data.

Effective 10 September 2026. The short version is on the data page. This is the full one.

1. Who we are

Veram is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS] (“Veram”, “we”). We are the controller of the personal data described here. Contact: hello@veram.io. [EU/UK REPRESENTATIVE, IF APPOINTED].

2. What we collect and why

• Portrait text you paste or your AI submits. Processed once to build your profile, then deleted. Connector submissions are held for up to 24 hours, only until the link is opened. Basis: performance of a contract (providing the service you asked for).
• Your profile: headline, claims, and the quotes from your own messages that support them, plus counts of what was set aside. Basis: contract.
• Your answers: which claims are right, partly right, or wrong; who you are looking for (relationship type, gender preference, age range, city and distance, dealbreakers, a free-text line). Basis: contract; for matching, consent.
• Account data: email address; with Google sign-in, your Google account email and identifier. Basis: contract.
• Technical data: IP address and request logs held briefly by our hosting provider for security and abuse prevention; a hashed IP for rate limiting connector submissions. Basis: legitimate interest (keeping the service secure).
• Analytics: product usage events. Cookieless by default; one analytics cookie with your consent. Basis: consent for the cookie; legitimate interest for cookieless aggregate counts.

3. Sensitive data we deliberately exclude

Before storing a profile, we filter out content about other people, and content revealing sexual orientation, religion, political opinions, health, or financial details, along with names of employers, companies, or real people. These filters are automated and not perfect; if something slips through, tell us and we will remove it. We do not process special-category data for matching unless you explicitly opt in to a specific topic, which is not yet available.

4. Who we share data with

We share personal data only with processors acting on our instructions:

• Vercel Inc. (hosting and delivery, United States)
• Supabase Inc. (database, authentication, United States)
• Anthropic PBC (language model that reads portrait text; inputs are not used to train models under our agreement)
• Resend Inc. (transactional email)
• PostHog Inc. (product analytics, United States; only with your consent for cookies)
• Google LLC (sign-in, only if you choose it)

We do not sell personal data and do not share it for cross-context behavioural advertising. We never have.

5. International transfers

Our servers are in the United States. If you are in the EU, UK, or Switzerland, transfers rely on the EU-US Data Privacy Framework where a provider is certified, and otherwise on Standard Contractual Clauses. [CONFIRM EACH PROVIDER’S DPF STATUS AT PUBLICATION].

6. Retention

• Portrait text: deleted on processing; connector copies within 24 hours.
• Profile, answers, preferences: for as long as your account exists, and up to 30 days after deletion in backups.
• Account data: for as long as your account exists.
• Security logs: up to 30 days.
• Analytics: [RETENTION PERIOD SET IN POSTHOG].

7. Your rights

Depending on where you live, you can ask to access, correct, delete, or export your data, object to or restrict processing, and withdraw consent at any time without affecting earlier processing. Write to hello@veram.io. We respond within 30 days (45 for California requests, extendable once). You can complain to your data protection authority; in the EU, [LEAD AUTHORITY].

California residents: you have the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal data as defined by the CPRA. We honour Global Privacy Control signals as an opt-out. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CPRA.

8. Cookies

Strictly necessary storage: your sign-in session and the choices you make on this site (consent, wizard progress). Analytics cookie: only after you accept in the banner; you can change your choice by clearing site data in your browser, or by writing to us. We do not use advertising cookies.

9. Children

Veram is for people 18 and over. We do not knowingly collect data from anyone under 18 and delete such accounts when identified.

10. Security

Data is encrypted in transit and at rest. Access to your profile is restricted to you through row-level security; the connector and processing run server-side with keys that are never exposed to the browser.

11. Changes

We will post changes here with a new effective date, and email account holders about material changes.

DRAFT FOR LEGAL REVIEW · HIGHLIGHTED ITEMS TO BE COMPLETED BEFORE PUBLIC LAUNCH