Privacy policy

1. Data controller

The data controller responsible for personal data processed through this website is:

We are not required to appoint, and have not appointed, a Data Protection Officer; privacy questions go to [email protected].

2. Scope of this policy

This policy explains how we handle personal data in connection with the verain.ai website, the marketing site you are currently reading, including its contact and demo-request form.

It does not govern personal data we process inside our products on behalf of a customer (for example, data you connect to Verain Finance). When you become a customer, that processing is governed by your service agreement and our Data Processing Agreement, under which you are the controller and Verain is the processor.

3. What data we collect

Contact and demo-request data. When you submit our contact form, we collect the information you provide: your name, work email address, company name, the option you select (the Mind you are interested in), and any message you choose to add. These fields are how we reach you and prepare for a useful conversation.

Technical and log data. Like virtually all websites, our servers record standard log data: your IP address, browser user-agent, the pages requested, and timestamps. For contact-form submissions we also record the IP address, user-agent, and a submission timestamp alongside your message, solely to prevent spam and abuse.

Analytics data. We use Umami, a privacy-friendly analytics tool we host ourselves, to understand in aggregate how the website is used (for example which pages are visited, the referring site, and approximate country, browser, and device type). Umami is cookieless and stores nothing on your device. It does not store your IP address (your IP is used only momentarily to derive a coarse, non-identifying value such as country, then discarded), and it builds no cross-site profile. These statistics are aggregate and are not used to identify you.

No accounts, no cross-site tracking. The website has no user accounts or logins. Beyond the cookieless analytics described above, we use no advertising, profiling, tracking pixels, or third-party trackers, and we do not engage in automated decision-making.

Providing this information is voluntary; it is neither a statutory nor a contractual requirement. If you choose not to provide your contact details, we will not be able to respond to your enquiry or arrange a demo.

4. Legal basis for processing

We process your personal data under the following legal bases set out in Article 6 of the GDPR:

• Legitimate interest (Art. 6(1)(f)): when you contact us or request a demo, we process your details to respond and to pursue a possible business relationship at your request. Our legitimate interest is handling inbound business enquiries and growing our business; we have weighed it against your rights and freedoms. You can object to this processing at any time (see Your rights).
• Steps prior to a contract (Art. 6(1)(b)): where you and Verain are actively discussing a specific contract, we process your details to take steps at your request before entering into it.
• Legitimate interest (Art. 6(1)(f)): we process limited technical and log data to keep the website secure, prevent abuse of the contact form, and maintain the integrity of our service.
• Legitimate interest (Art. 6(1)(f)): we process cookieless, aggregate analytics to understand how the website is used and improve it. Because this analytics stores nothing on your device, it requires no consent; you can object at any time (see Your rights).

We do not send marketing email unless you ask us to; if you do, we rely on your consent, which you can withdraw at any time. Customers of Verain Finance receive service email, such as reports their team shares with them.

5. How we use your data

• Responding to you: to reply to your enquiry, schedule a demo, and follow up about the products you expressed interest in.
• Security and abuse prevention: rate limiting, spam filtering, and protecting our infrastructure.
• Improving the website: aggregate, cookieless analytics to see which pages are useful and how visitors navigate.

We do not use your data for advertising, profiling, automated decision-making, or to train any AI model. We never sell, rent, or trade your personal data.

6. Data sharing and sub-processors

We share personal data only with the service providers we rely on to operate this website, and only for the purposes described. Each acts as a processor under a data processing agreement (Art. 28 GDPR):

• Contabo GmbH (a German provider; servers within the European Union): hosting. Our web server, the server logs, and the contact-form submissions are stored on EU-hosted infrastructure. The provider supplies infrastructure only and does not access your data for its own purposes.
• Cloudflare, Inc. (United States; EU-US Data Privacy Framework and/or Standard Contractual Clauses): DNS, content delivery, TLS, and a web application firewall for verain.ai. Cloudflare processes connection metadata (such as your IP address) in transit to deliver and protect the site.
• Google (Google Workspace, provided by Google Ireland Limited): our business email. Messages you send through the contact form are delivered to and stored in our Google Workspace inbox, and our replies are sent from it. Any onward transfer to Google LLC in the United States is governed by Google’s data processing terms and Standard Contractual Clauses.

We host our website fonts and our analytics (Umami) ourselves on our own EU-based infrastructure, so loading a page sends no data to any third-party font, analytics, advertising, or CDN provider beyond those listed above. We use no third-party analytics service, advertising network, or tracking service, and we never sell or share analytics data.

7. Data retention

• Contact and demo-request data: kept only as long as necessary to handle your enquiry and any reasonable follow-up, typically no longer than 24 months after our last contact (unless an ongoing relationship or a legal obligation requires longer). We review and delete enquiry records we no longer need.
• Server logs: rotated regularly and kept only briefly (currently about five weeks), then deleted.
• Analytics data: cookieless, aggregate usage statistics with no identifiers that single you out; retained only as long as useful for understanding website trends.

You can ask us to delete your data sooner at any time (see Your rights).

8. International transfers

Our website and the personal data submitted through it are hosted within the European Union.

Some processing may involve transfers outside the European Economic Area: Cloudflare, Inc. is US-based, and Google may transfer mail data onward to Google LLC in the United States. Such transfers are protected by the EU-US Data Privacy Framework and/or Standard Contractual Clauses, with supplementary measures as appropriate. If the Data Privacy Framework ceases to provide a valid transfer mechanism, we rely on Standard Contractual Clauses. We share only the minimum data necessary for each provider’s function.

9. Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data (“right to be forgotten”).
• Restriction: request that we limit how we process your data in certain circumstances.
• Objection: object to processing based on legitimate interest.
• Portability: receive the data you provided in a structured, machine-readable format.

To exercise any of these rights, email [email protected]. We will respond within one month, extendable where necessary as permitted by Art. 12(3) GDPR.

If you believe your data protection rights have been infringed, you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

10. Cookies

This website sets no cookies of its own and uses no advertising or tracking cookies; our analytics (Umami) is cookieless. Our security provider Cloudflare may, depending on its bot-protection configuration, set a single strictly-necessary security cookie (__cf_bm) that tells human visitors from automated traffic; where set, it expires after about 30 minutes and is not used to track you across sites or to profile you. Because we set no non-essential cookies, no consent banner is required. See our Cookie notice for details.

11. Security

We apply appropriate technical and organisational measures to protect your data:

• All connections are encrypted with TLS (HTTPS).
• Website data is hosted within the European Union.
• The contact form is protected against abuse with rate limiting, a honeypot, timing checks, and disposable-domain filtering.
• We practise data minimisation: we collect only what we need to reply to you.

No system is completely immune to risk. If you discover a security issue, please report it to [email protected].

12. Children

This website and our products are intended for businesses and professional users. They are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective date” at the top of this page indicates when it was last revised. For material changes we will take reasonable steps to make the update visible before it takes effect.

14. Contact

For any privacy question, or to exercise your rights, contact us:

You may also contact the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl.