https://vera.ink/assets/privacy-RUZDF-h9.js

1import{j as e}from"./index-acTickSX.js";import{L as t}from"./LegalPage-CIPxEF4X.js";import"./useAuthSession-B4usz6sI.js";const o=`## PRIVACY POLICY
2
3This Privacy Policy explains how iWantIt (Pty) Ltd collects, uses, stores, and shares personal information in connection with vera.ink. We are committed to processing your personal information lawfully, fairly, and transparently.
4
5---
6
7### 01 / WHO WE ARE AND YOUR DATA CONTROLLER
8
9iWantIt (Pty) Ltd (registration number 2026/315901/07), Sandton, Gauteng, South Africa, is the responsible party and data controller for personal information collected via vera.ink. Our Information Officer may be contacted at [email protected].
10
11The Information Officer (Simon Keeling) is registered with the Information Regulator of South Africa as required by POPIA Section 55. Regulator Registration Number: 2026-015714, registered 15 May 2026.
12
13---
14
15### 02 / SCOPE
16
17This policy applies to all users of vera.ink — website visitors, free tier users, and paid subscribers — regardless of location.
18
19---
20
21### 03 / LEGAL BASES FOR PROCESSING
22
23**South Africa (POPIA):** We process personal information where you have consented (s11(1)(a)), where processing is necessary to perform our contract with you (s11(1)(b)), where we have a legitimate interest not overridden by your interests (s11(1)(f)), or where required by law (s11(1)(c)).
24
25**European Union (GDPR):** We rely on Article 6(1)(b) (contract performance), Article 6(1)(a) (consent where obtained), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests).
26
27**United Kingdom (UK GDPR):** We rely on Article 6(1)(b) (contract performance), Article 6(1)(a) (consent where obtained), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests), as retained by the Data Protection Act 2018. We are monitoring implementation of the UK Data (Use and Access) Act 2025 as provisions take effect during 2026.
28
29**United States — California (CCPA / CPRA):** We do not sell personal information. California residents have the right to know what personal information we collect, to request deletion, and to non-discrimination for exercising these rights. California residents also have the right to opt-out of the sale or sharing of their personal information, and to limit the use and disclosure of sensitive personal information.
30
31---
32
33### 04 / WHAT WE COLLECT
34
35**Account data:** Email address provided when submitting a verification or creating an account.
36
37**Verification data:** Documents and source material you submit for verification, verification results, findings reports, and corrected documents.
38
39**Subscription and billing data:** Subscription tier, billing history, and Dodo Payments customer ID. Payment card details are never stored by us — processed solely by Dodo Payments.
40
41**Usage data:** Verification history, modes selected, packs created, and activity within the platform.
42
43**Technical data:** IP address, device type, browser type, and access logs collected automatically when you use the platform.
44
45---
46
47### 05 / HOW WE USE YOUR INFORMATION
48
49We use your personal information for the purposes below. Each one names the legal basis we rely on for it.
50
51- Provide, operate, and deliver the verification service — contract
52- Process your documents through AI systems to generate verification outputs — contract
53- Communicate with you about your account, verification results, and support — contract
54- Process payments and manage your subscription — contract; keeping the billing records afterwards — legal obligation
55- Keep the service secure and diagnose faults — legitimate interests
56- Improve the service through aggregated, anonymised analysis — legitimate interests
57
58---
59
60### 06 / DOCUMENT PROCESSING AND RETENTION
61
62Documents and source material you submit are processed by AI systems (Anthropic PBC and Google LLC) operating under data processing agreements with us. We do not use your documents to train AI models.
63
64Verification results, including your original document, source material, findings, and corrected document, are retained in your account history until you ask us to erase them. You may delete an individual verification at any time from your library.
65
66**How long we keep each category.** Where we cannot give a fixed period, we give the criteria we use to determine it instead.
67
68**Account data.** For as long as your account exists. If you ask us to close it, we keep a minimal record for up to 2 years afterwards for legal and dispute-resolution purposes, unless a longer retention period is required by law.
69
70**Verification data.** Deleting a verification from your library removes that verification record. The report and corrected document generated from it stay in your library until you ask us to erase them: email [email protected] and we will delete both, and the stored files behind them. We apply no automatic expiry, so nothing goes unless you ask.
71
72**Subscription and billing data.** Kept for as long as South African tax and company law requires records of the transaction to be retained, counted from the end of the financial year in which it falls. While that obligation runs we cannot delete these records on request, even if you close your account. Payment card details are never held by us at all.
73
74**Usage data.** Verification history, modes selected and packs created form part of your account and are kept for as long as the account exists. We apply no automatic expiry. To have them erased sooner, email [email protected].
75
76**Technical data.** The application writes no IP addresses, device details or browser details to our own database. Sign-in records and server request logs are held by our authentication and hosting providers on our behalf and are kept for their retention periods, not ours; we access them only to keep the service secure and to diagnose faults.
77
78---
79
80### 07 / SOURCE PACKS
81
82Source packs you create, including all pasted content and indexed embeddings, are stored in your account and accessible only to you. Source pack content is processed through embedding models (Google Gemini) to enable semantic search. We do not share your source pack content with other users or third parties beyond what is required to operate the service.
83
84---
85
86### 08 / WHO WE SHARE YOUR DATA WITH
87
88We share personal data only with:
89
90- **Anthropic PBC** — AI processing (Claude models) under a data processing agreement
91- **Google LLC** — AI processing (Gemini models and embeddings) under a data processing agreement

92- **Supabase Inc** — database and file storage infrastructure under a data processing agreement
93- **Resend Inc** — transactional email delivery under a data processing agreement
94- **Dodo Payments** — payment processing as merchant of record
95
96We do not sell your personal information. We do not share your documents or source material with other users or for marketing purposes.
97
98All data processing agreements comply with GDPR, UK GDPR, and POPIA Section 72 cross-border transfer requirements.
99
100---
101
102### 09 / YOUR RIGHTS
103
104**Your right to object.** Set out here on its own, separately from the list below, because the law requires it to be brought to your attention that way. Where we process your personal information on the basis of our legitimate interests, you may object to that processing at any time on grounds relating to your particular situation. If you object we will stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. To object, email [email protected].
105
106Depending on your jurisdiction, you may also have the following rights:
107
108- **Access:** request a copy of the personal information we hold about you
109- **Correction:** request correction of inaccurate personal information
110- **Deletion:** request deletion of your personal information
111- **Portability:** request your personal information in a structured, machine-readable format
112- **Objection:** object to processing based on legitimate interests
113- **Restriction:** request restriction of processing in certain circumstances
114- **Withdrawal of consent:** where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before you withdrew it
115- **Opt-out of Sale/Sharing (California):** request to opt-out of the sale or sharing of your personal information
116- **Limit Use of Sensitive Personal Information (California):** request to limit the use and disclosure of sensitive personal information
117- **Non-discrimination:** you will not be discriminated against for exercising your privacy rights
118
119We will respond to your requests within the timeframe required by applicable law: up to one month under GDPR, 45 days under CCPA/CPRA, or 20 business days under POPIA.
120
121If you are unhappy with how we have handled your personal information, you can complain to us first at [email protected]. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
122
123You also have the right to lodge a complaint with a supervisory authority. South African users may contact the Information Regulator at inforeg.org.za. EU users may contact their national supervisory authority under GDPR Article 77. UK users may contact the ICO at ico.org.uk. California residents may contact the California Privacy Protection Agency at cppa.ca.gov.
124
125To exercise any of these rights, contact [email protected].
126
127---
128
129### 10 / COOKIES AND TRACKING
130
131vera.ink uses minimal cookies required for session management and authentication. We do not use advertising or tracking cookies. We do not use third-party analytics platforms that process personal data without your consent.
132
133---
134
135### 11 / SECURITY
136
137We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. All data is encrypted in transit and at rest. Access to personal data is restricted to personnel who need it to operate the service.
138
139In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, and will notify affected users without undue delay where required by applicable law.
140
141---
142
143### 12 / INTERNATIONAL TRANSFERS
144
145Your personal data may be transferred to and processed in countries outside South Africa, including the United States (Anthropic, Google, Supabase, Resend, Dodo Payments) and the European Economic Area. We ensure such transfers are subject to appropriate safeguards, including standard contractual clauses where required, in compliance with GDPR Article 46, UK GDPR Article 46, and POPIA Section 72.
146
147Where the destination country is covered by an adequacy decision of the European Commission or the UK government, the transfer relies on that decision. Where it is not, the transfer relies on the European Commission's standard contractual clauses (with the UK International Data Transfer Addendum where UK data is involved). You can request a copy of the safeguards that apply to a 

147specific transfer by emailing [email protected].
148
149---
150
151### 13 / CHILDREN
152
153vera.ink is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted personal information to us, contact [email protected] and we will delete it promptly.
154
155---
156
157### 14 / CHANGES TO THIS POLICY
158
159We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect. The current version is always available at vera.ink/privacy.
160
161---
162
163### 15 / CONTACT
164
165**Data Controller:** iWantIt (Pty) Ltd
166**Information Officer:** [email protected]
167**Address:** Sandton, Gauteng, South Africa
168For data protection queries: [email protected]`;function n(){return e.jsx(t,{title:"PRIVACY POLICY",subtitle:"vera.ink — iWantIt (Pty) Ltd",content:o,lastUpdated:"22 September 2026 (v3)"})}export{n as component};