Privacy Policy

This Privacy Policy explains how Foxar Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you use the VeridAI mobile application and the website at veridai.app (together, the "Service"). We are committed to protecting your privacy and handling your data in an open and transparent manner.

VeridAI is an AI-powered tool that helps you understand contracts and other documents. Because you may upload documents that contain sensitive or confidential information, we take particular care over how that content is handled — see the section "Documents you upload" below.

1. Who we are

The data controller responsible for your personal data is:

• Foxar Ltd, a company registered in England and Wales.
• Company registration number: 17160803
• Registered office: 27 Tremayne Road, Nottingham, NG8 4HQ
• Contact: support@veridai.app

2. The information we collect

We collect the following categories of information:

Information you provide

• Account information — the email address you use to register and authenticate. Authentication is handled through our backend provider (Supabase).
• Documents and content — the contracts, agreements and other documents (and any text or images extracted from them) that you submit for analysis or ask questions about.
• Communications — any information you send us when you contact support.

Information collected automatically

• Usage data — how you use the app, including the number of analyses or scans performed and your subscription tier.
• Device and technical data — device type, operating system, app version, language settings, and diagnostic or crash information.
• Advertising identifiers — where ads are shown (see section 6), an advertising identifier and related data may be processed.

Payment information

Subscriptions are processed through the Google Play billing system (and, in future, through our payments provider). We do not collect or store your card or bank details. We receive confirmation of your subscription status and a transaction identifier only.

3. Documents you upload

The documents you submit are the heart of the Service, and we treat them with care:

• Your documents are processed in order to generate the analysis, summary or answers you request.
• To produce an analysis, the text of your document is transmitted to our third-party AI processing provider (see section 5). It is not used to train third-party AI models.
• Where you have an account, your analyses may be saved to your account so you can access them again later. You can delete saved analyses at any time from within the app.
• You are responsible for the documents you upload. Please do not upload content that you are not entitled to share, and be aware that documents may contain personal data relating to other people.

4. How and why we use your information

We use your information for the following purposes, relying on the lawful bases set out under the UK GDPR and EU GDPR:

• To provide the Service — analysing documents, answering your questions and saving your results. Lawful basis: performance of our contract with you.
• To manage your account — registration, authentication and subscription management. Lawful basis: performance of a contract.
• To show advertising on the free tier. Lawful basis: your consent and/or our legitimate interests (see section 6).
• To maintain, secure and improve the Service, including diagnosing faults and preventing abuse. Lawful basis: our legitimate interests in running a reliable and secure service.
• To comply with legal obligations and to respond to lawful requests. Lawful basis: compliance with a legal obligation.

5. AI processing and third-party providers

VeridAI uses third-party artificial intelligence providers to analyse documents and answer questions. When you request an analysis, the relevant text is sent to these providers for processing. We currently route requests through OpenRouter, which in turn passes them to large language model providers (for example, models operated by OpenAI). The specific models used may change over time as we improve the Service.

These providers act as our processors for the purpose of generating your results. Some of them are based outside the UK and the EEA — see section 8 on international transfers.

6. Advertising

On the free tier, we display advertising using Google AdMob. Depending on your settings and consent, AdMob may process device and advertising identifiers to serve and measure ads. Where required by law, we will ask for your consent before personalised ads are shown, and you can change your choice in your device settings. Users on the Ad-Free and Premium tiers do not see ads.

For more information about how Google handles data, see Google's privacy policy at policies.google.com/privacy.

7. Who we share your information with

We do not sell your personal data. We share information only with service providers who help us operate the Service, under appropriate contractual safeguards:

• Supabase — backend, authentication, database and storage.
• OpenRouter and the underlying AI model providers — document analysis and question answering.
• Google (Play billing and AdMob) — subscriptions and advertising.
• Our payments provider, where used in future — subscription management.

We may also disclose information where required by law, to enforce our terms, or to protect the rights, safety and property of our users or others.

8. International transfers

Some of our providers process data outside the United Kingdom and the European Economic Area, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision, to ensure your data remains protected.

9. How long we keep your information

We keep your personal data only for as long as necessary for the purposes described in this policy:

• Account information is kept while your account remains active.
• Saved analyses are kept until you delete them or close your account.
• When you delete content or your account, we remove it from our active systems, and it is deleted from backups within 30 days.
• We may retain limited information for longer where required to comply with legal obligations or to resolve disputes.

10. Your rights

Under the UK GDPR and EU GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data;
• object to, or request restriction of, our processing;
• request portability of the data you have provided;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us at support@veridai.app. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local supervisory authority if you are in the EEA.

11. How we protect your information

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any security incident.

12. Children

The Service is not directed at children and is not intended for anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you within the app. We encourage you to review this policy periodically.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@veridai.app.