Privacy Policy
Last updated: 28 March 2026
1. Data controller
The data controller is Verace S.r.l. (hereinafter "Verace"), based in Italy. For any matter relating to the processing of your data you can contact us at privacy@verace.io.
2. Data collected
We collect the following categories of personal data:
- Registration data: first name, last name, email address, company name, VAT number, address.
- Usage data: products entered, images uploaded, QR scans received (device type, country, language).
- Payment data: handled directly by Stripe; Verace does not store card numbers.
- Technical data: IP address, user-agent, session cookies and technical cookies.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Service provision (dashboard, QR, public page) | Performance of the contract (art. 6(1)(b) GDPR) |
| Billing and subscription management | Legal obligation (art. 6(1)(c) GDPR) |
| Transactional emails (account confirmation, plan notices) | Performance of the contract |
| Content moderation (Vision AI) | Legitimate interest (art. 6(1)(f) GDPR) |
| Aggregated usage analysis | Legitimate interest |
| Marketing and newsletter | Consent (art. 6(1)(a) GDPR) |
4. Data retention
Account data is kept for the entire duration of the contract and for 10 years after closure (Italian tax obligation). Anonymized scan data may be kept indefinitely for statistical purposes. System logs are deleted after 90 days.
5. Data recipients
Your data may be communicated to:
- Supabase Inc. — database hosting and authentication (USA, with adequate SCCs safeguards)
- Vercel Inc. — web application hosting (USA)
- Stripe Inc. — payment management (USA)
- Resend Inc. — transactional email delivery (USA)
- Google LLC — content moderation via Vision API (USA)
All the providers listed above offer adequate safeguards for non-EU transfers (Standard Contractual Clauses).
6. Rights of data subjects
Under the GDPR you have the right to:
- Access your personal data (art. 15)
- Rectify inaccurate data (art. 16)
- Request erasure ("right to be forgotten", art. 17)
- Restrict processing (art. 18)
- Data portability (art. 20)
- Object to processing based on legitimate interest (art. 21)
- Withdraw consent at any time
To exercise these rights write to privacy@verace.io. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
7. Cookies
We use technical cookies necessary for the operation of the service (session, onboarding preferences). For more information see our Cookie Policy.
8. App usage analytics
To improve the mobile app we collect pseudonymous usage events, tied to a random device identifier and not to your identity or any other personal data. They help us understand how the app is used (screens visited, actions) on an aggregate basis, on the legal basis of legitimate interest. Raw events are retained for at most 90 days, then automatically deleted. We do not use third-party analytics tools.
Product requests: when you scan a barcode (EAN) for a product not yet on Verace, you can report it to help us understand which products users are looking for. We record the code and the random device identifier, with no personal data. If you have an account and choose "Notify me", we link the request to your profile and use your contact details (push notification or email) only to alert you when that product becomes available on Verace. Anonymous requests contain no identifying data.
9. Changes to the privacy policy
We reserve the right to update this notice. In case of substantial changes we will notify you by email or via a notice in the dashboard. Continued use of the service after notification constitutes acceptance.