Privacy, by construction.

1.1 Scope. This Policy applies to verdict.systems, its subdomains, our APIs, our MCP endpoints, the verdict-bench CLI in its telemetry-enabled mode, and our sales and support communications.

1.2 Our role. When you visit our website, sign up, or buy a subscription, we act as a Controller of your Personal Data under GDPR / UK GDPR (and the comparable role under U.S. state privacy laws). When a Customer uses the Service to seal evidence that contains Personal Data of a third party, the Customer is the Controller and Verdict is the Processor; our processing is governed by the Data Processing Addendum.

From you directly, when you visit our site, sign up, or contact us:

• Identifiers: name, email, company, role, country, postal address (if provided).
• Account & billing: account credentials (hashed), API key metadata, plan, invoices, payment last-4 (via Stripe — full card data is never transmitted to or stored by Verdict).
• Commercial: the products and tiers you purchased; support tickets; sales calls and meeting notes you provide.
• Communications: emails to evidence@, privacy@, legal@, security@, and replies to our newsletter (Field Notes).

Automatically, when you use the Service:

• Technical: IP address (truncated for analytics), user-agent, device class, referrer, language, timezone, page-load timing.
• Service telemetry: API call counts, latencies, error codes, rate-limit events, batch sizes — used to operate the Service and bill you on metered tiers.
• Cookies and similar: see Section 12 and the Cookie Policy.

From third parties:

• Payment processor (Stripe): billing details limited to what we need to issue invoices and prevent fraud.
• Authentication providers (if you sign in via a third party): account identifier, name, email.
• Business contact databases (sales prospecting): name, business email, role, company, public LinkedIn — used only for B2B outreach with opt-out in every message.

Sources are summarized above and include: (a) you, (b) your device when you interact with our properties, (c) our service providers (subprocessors) acting on our instructions, and (d) public or licensed business directories for prospecting.

We process Personal Data for the following purposes, with the indicated legal bases under GDPR / UK GDPR.

We do not knowingly process special-category data (GDPR Art. 9) at the website or marketing layer.

5.1 Who controls it. When you, the Customer, submit Customer Content to be sealed and that content contains Personal Data of a third party, you are the Controller. Verdict acts as Processor on your instructions under the DPA.

5.2 Minimization. We encourage you to minimize Personal Data in payloads. The integrity guarantees of the Service do not require us to read the payloads — we hash them.

5.3 Erasure and sealed records. A Sealed Evidence Record cannot be partly redacted: removing or changing any field breaks its commitment, and the Service does not offer redaction of sealed records. Today the Service runs as a public sandbox that does not store Evidence Records; you hold the records you create and can delete them. If a data subject asks you to erase Personal Data inside an Evidence Record, delete the record and every copy you hold. The public Rekor entry for a record cannot be deleted by anyone (see § 6.0). It holds a hash of the record's commitment, not the record, but anyone who holds the record can match the two, so treat the entry as pseudonymous data (GDPR Recital 26). Keep Personal Data out of records where you can by sealing hashes (prompt_hash, output_hash) and short summaries instead of raw text. See Terms § 6.5.

By design, Verdict anchors only a hash of each Sealed Evidence Record's commitment (the record's merkle_root field, a single-record commitment) to the public Sigstore Rekor transparency log. The Rekor entry holds that hash, the log's timestamp, a signature and the public key that made it; in the public sandbox the key is generated fresh for each request. No Customer Content is written to Rekor, only the hash; § 5.3 explains how that hash is treated. The existence of a Sealed Evidence Record becomes a public, immutable fact; the content does not.

We share Personal Data only as described here:

• Subprocessors acting on our written instructions under a DPA (see Section 8 and /subprocessors).
• Professional advisors (auditors, lawyers, accountants) under confidentiality.
• Business transfers: in a merger, acquisition, financing, or sale of assets, subject to commercially reasonable confidentiality and continuity of this Policy.
• Lawful process: see Legal Inquiries; we challenge overbroad demands and notify users by default unless legally prohibited.
• To protect rights and safety of Verdict, our customers, or third parties.
• With your consent.

Our current subprocessors and the categories of data they process are published at /subprocessors. We give Customers at least thirty (30) days' notice before adding or replacing a subprocessor and provide an objection window as described in the DPA.

Personal Data may be transferred to and processed in the United States and other countries where Verdict or our subprocessors operate. For transfers from the EEA, the UK, and Switzerland to the U.S. or other "third countries," we rely on:

• EEA → EU Standard Contractual Clauses (Commission Decision 2021/914), with Module 2 (controller-to-processor) or Module 3 (processor-to-processor) as applicable, and a Transfer Impact Assessment.
• UK → the UK International Data Transfer Addendum (IDTA) or the UK Addendum to the EU SCCs.
• Switzerland → the EU SCCs with FDPIC-recognized adaptations (references to the GDPR read as references to the Swiss FADP; references to EU member states read as references to Switzerland).
• Adequacy decisions where applicable.

You may request a copy of the SCCs in place by emailing privacy@verdict.systems.

We keep Personal Data only as long as needed for the purpose for which it was collected, plus the period required by law or to defend legal claims.

Our security architecture is described at /security. In short: TLS 1.3 in transit, AES-256 at rest, Sigstore Rekor anchoring for Merkle roots, role-based access with least privilege, mandatory MFA on production access, and a documented incident-response plan. Public surfaces sign with an ephemeral key generated per request; a hardware-backed production signing tier, with scheduled key rotation, is planned. No security program is perfect; we operate the one your CISO can audit.

We use only strictly-necessary cookies by default. Optional analytics (Google Analytics 4 with IP anonymization) is enabled only with consent in regions that require it, and is fully opt-out elsewhere. We honor Global Privacy Control (GPC)as a universal opt-out signal. Details: Cookie Policy.

The Service is for users 18+ and is not directed to children. We do not knowingly collect Personal Data from anyone under 18. If you believe a child has provided us Personal Data, email privacy@verdict.systems and we will delete it.

If you are a California resident, you have the right to:

• Know what categories and specific pieces of Personal Information we have collected, used, disclosed, or sold/shared in the prior 12 months.
• Delete Personal Information, subject to permitted exceptions.
• Correct inaccurate Personal Information.
• Opt out of sale or sharing for cross-context behavioral advertising (we do not engage in either — see § 15).
• Limit use of sensitive Personal Information.
• Be free from retaliation for exercising your rights.
• Designate an authorized agent to act on your behalf (with verifiable authorization).

Categories disclosed for a business purpose: identifiers, commercial information, internet/network activity, inferences, and professional/employment information. Recipients of those disclosures are our subprocessors (see § 8).

To submit a do-not-sell / do-not-share request manually, email privacy@verdict.systems with the subject line "Do Not Sell or Share Request" and the email address tied to your account.

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access your Personal Data and obtain a copy (Art. 15 GDPR).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure (Art. 17). For Evidence Records and their public log entries, see § 5.3.
• Restriction of processing (Art. 18).
• Data portability — in a structured, commonly used, machine-readable format (Art. 20).
• Object to processing based on legitimate interests or direct marketing (Art. 21).
• Not be subject to a decision based solely on automated processing that produces legal effects (Art. 22) — see § 18.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with a supervisory authority. For example: the Irish DPC, the UK ICO, or the Swiss FDPIC.

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia have rights to know, delete, correct, and opt out of sales, targeted advertising, and (in some states) profiling for decisions with legal effects. Submit requests to privacy@verdict.systems; we respond within the statutory window applicable to your state.

Verdict does not use automated decision-making, including profiling, to produce legal or similarly significant effects on you. AI features of the Service produce informational outputs (summaries, conformance indications, search results) that are subject to human review by you or your counsel before any decision with consequence — see Terms § 7 and the Responsible AI Disclosure.

To exercise any right above, email privacy@verdict.systems with the request, the right you are exercising, and information sufficient for us to verify your identity (typically the email address on your account and a response to a verification message). We respond within:

• 45 days under CCPA/CPRA (extendable once by 45 more days with notice).
• 30 days under GDPR / UK GDPR (extendable by 60 days for complex requests with notice).
• The shorter of the above where multiple regimes apply.

We do not charge a fee for reasonable requests. Where a Customer's Personal Data is involved (i.e., we are the Processor), we will route the request to the Customer and notify you.

We will post material changes with at least 14 days' advance notice by email or in-product notice. Continued use after the effective date constitutes acceptance. The current version is always dated and posted at /privacy.

Privacy team: privacy@verdict.systems.

Data Protection Officer (acting): until Verdict appoints a standalone DPO, the privacy alias above functions as the contact for all DPO matters and routes to qualified counsel.

EU representative (Article 27 GDPR): to be appointed; in the interim, EEA residents may direct requests to the privacy alias above, which is monitored by EU-qualified counsel.

UK representative (Article 27 UK GDPR): to be appointed; in the interim, UK residents may direct requests to the privacy alias above.

Verdict Systems Inc.
Attn: Privacy
Houston, Texas, USA