Privacy Policy

1. Introduction

VeriPrompt ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our AI Gateway & Agentic Platform ("Service").

2. Data Controller

The data controller responsible for your personal data is VeriPrompt, operated by Axel Weber. Contact details are available on our Impressum page.

Data Protection Officer: Axel Weber has been appointed as Data Protection Officer, contactable at data.protection@veriprompt.tech.

3. Data We Collect

We collect the following categories of personal data:

• Account Information: Name, email address, company name, and password (stored as a secure hash)
• Usage Data: API call logs, prompt metadata (not prompt content unless you opt in), routing decisions, and performance metrics
• Technical Data: IP address, browser type, device information, and session data
• Billing Data: Subscription tier, usage counts, and payment information (processed by third-party payment providers)

4. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the Service
• Authenticate users and manage accounts
• Route prompts to AI providers and optimize performance
• Generate analytics and usage reports
• Process billing and enforce usage limits
• Detect and prevent fraud, abuse, and security threats
• Communicate with you about service updates and support

5. Data Protection (PII Sanitization)

VeriPrompt includes a built-in PII sanitization module that can detect and tokenize personally identifiable information before sending prompts to AI providers. Email addresses are stored using one-way hashing for lookup while personal names are encrypted at rest using AES-256. Companies can configure data protection policies per project, team, or user.

6. Data Sharing and Third Parties

We share data with third parties only as necessary to provide the Service:

• AI Providers: Prompts are routed to configured AI providers (e.g., OpenAI, Anthropic, Google, DeepSeek). PII sanitization is available to strip personal data before routing.
• Infrastructure: We use DigitalOcean for hosting and CloudFlare for CDN/SSL services.
• Payment Processors: Billing is handled by third-party payment processors who have their own privacy policies.

The complete, current list of sub-processors — including purpose, location and DPA status for each — is published at /legal/subprocessors. We notify you before a new one takes effect.

We do not sell your personal data to third parties.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Usage logs are retained for analytics purposes and are automatically purged after the retention period configured by your company administrator. You may request deletion of your account and associated data at any time.

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Restriction: Request restriction of processing
• Portability: Request transfer of your data in a machine-readable format
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact us through the information on our Impressum page.

9. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies. Analytics data is collected server-side without client-side tracking scripts.

10. Security

We implement industry-standard security measures including encrypted data transmission (TLS/SSL), encrypted data at rest (AES-256), role-based access controls, and regular security audits. However, no method of transmission over the Internet is 100% secure.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date.

12. Contact

For questions about this Privacy Policy or to exercise your data protection rights, please contact us through the information provided on our Impressum page.