Privacy Policy
Last updated: 28 March 2026
1. Data controller
The data controller is Verace S.r.l. (hereinafter "Verace"), based in Italy. For any matter relating to the processing of your data you can contact us at privacy@verace.io.
2. Data collected
We collect the following categories of personal data:
- Registration data: first name, last name, email address, company name, VAT number, address.
- Usage data: products entered, images uploaded, QR scans received (device type, country, language).
- Payment data: handled directly by Stripe; Verace does not store card numbers.
- Technical data: IP address, user-agent, session cookies and technical cookies.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Service provision (dashboard, QR, public page) | Performance of the contract (art. 6(1)(b) GDPR) |
| Billing and subscription management | Legal obligation (art. 6(1)(c) GDPR) |
| Transactional emails (account confirmation, plan notices) | Performance of the contract |
| Content moderation (Vision AI) | Legitimate interest (art. 6(1)(f) GDPR) |
| Aggregated usage analysis | Legitimate interest |
| Marketing and newsletter | Consent (art. 6(1)(a) GDPR) |
4. Data retention
Account data is kept for the entire duration of the contract and for 10 years after closure (Italian tax obligation). Anonymized scan data may be kept indefinitely for statistical purposes. System logs are deleted after 90 days.
5. Data recipients
Your data may be communicated to:
- Supabase Inc. — database hosting and authentication (USA, with adequate SCCs safeguards)
- Vercel Inc. — web application hosting (USA)
- Stripe Inc. — payment management (USA)
- Resend Inc. — transactional email delivery (USA)
- Google LLC — content moderation via Vision API (USA)
All the providers listed above offer adequate safeguards for non-EU transfers (Standard Contractual Clauses).
6. Rights of data subjects
Under the GDPR you have the right to:
- Access your personal data (art. 15)
- Rectify inaccurate data (art. 16)
- Request erasure ("right to be forgotten", art. 17)
- Restrict processing (art. 18)
- Data portability (art. 20)
- Object to processing based on legitimate interest (art. 21)
- Withdraw consent at any time
To exercise these rights write to privacy@verace.io. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
7. Cookies
We use technical cookies necessary for the operation of the service (session, onboarding preferences). For more information see our Cookie Policy.
8. Changes to the privacy policy
We reserve the right to update this notice. In case of substantial changes we will notify you by email or via a notice in the dashboard. Continued use of the service after notification constitutes acceptance.