Privacy Policy

Two different roles apply, depending on the data:

• Account data, security logs, contact and access requests, billing: we decide why and how they are used, so we are the controller.
• Content an organization puts in its workspace (claims it checks, links, images, notes, boards, reports, files, and any personal data of other people inside them): the organization is the controller and we act as its processor, only on its instructions, under our Data Processing Addendum.

If your question is about content in your organization's workspace, your organization's administrator is your first contact; we will help them answer.

• Account: first and last name, display name, email address, password (handled by our sign-in provider; we never store it in readable form), optional profile picture, phone number if you turn on SMS two-step sign-in, language and display preferences, notification choices, the version and time you accepted the Terms.
• Signed-in devices: the browser and device description sent by your browser, sign-in times. We do not show IP addresses for sessions.
• Organization: organization name, members and their roles, organization code, invitations (the invited email address), join requests, plan, token balance and a usage record of paid actions (who, which action, when), invoices.
• Content you submit: searches and keywords, links you paste, domains and social profile links you check and the figures you type from a profile, images you check in Geo Lens, still frames from a video (8 frames extracted in your browser; the video file itself never leaves your device), Workspace notes, links, images, files, boards and connections, Targeted News items and their titles, and the reports Veruno generates. This content can include personal data of other people (for example people named in news, holders of social accounts, people in photos).
• Uploaded files: Workspace images, profile pictures, feedback photos and client logos are re-encoded when stored, which removes metadata such as EXIF and location. Workspace documents (PDF, DOCX, XLSX, PPTX, TXT, CSV) are stored as you upload them, including any metadata inside them. Images you check in Geo Lens are kept as the original file, with their metadata, because metadata can matter for verification.
• Usage and security logs: limit counters and failed sign-in attempts (account or email, IP address, action, time), records of bulk deletions and of administrator actions, error logs. Our logger removes email addresses, IP addresses, tokens and keys from error logs; they can still contain account or organization identifiers.
• Messages: contact-form and request-access messages (name, email, subject, message, language), feedback (rating, text, optional photo, your name), questions to the help assistant (the question, the page, and an email address only if you leave one for a reply).
• Email: messages you exchange with us at contact@veruno.eu; emails our system sends (password reset, onboarding for Pro organizations, notices to our team about new messages and feedback, security alerts to our team).

We do not use advertising, tracking pixels or analytics tools.

Where we rely on legitimate interest, you can object (see Your rights). Where your organization processes personal data for journalistic purposes, the exemptions in art. 85 GDPR and art. 7 of Law 190/2018 may apply to it as controller.

We share data only with the service providers below, each for its task and only with the data that task needs. They act as our processors (or, for public registries and YouTube, as independent recipients). We do not sell data.

When a link preview or an image is fetched, our server contacts the website you named; that website sees our server, not you.

We may also disclose data where the law requires it (for example to a court or a competent authority).

Several providers are based outside the European Economic Area, mostly in the United States. Where data leaves the EEA, the transfer relies on an adequacy decision (such as the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses, together with the provider's security measures. You can ask us for more information about the safeguard used for a given provider.

If you delete your account while you are a member of an organization that has other members, the cards you added stay with that organization (it is the controller of that content). If you are the only member, the organization and all its data are deleted.

Under the GDPR you have the right to:

• access your data and get a copy;
• rectification of inaccurate data (most account data can be edited in Settings);
• erasure (you can also delete your account yourself in Settings);
• restriction of processing;
• data portability for data you gave us under contract or consent;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting earlier processing.

Write to contact@veruno.eu from the address linked to your account (or tell us how we can verify it is you). We answer within one month; for complex requests this can be extended by two more months, and we will tell you why.

For content in an organization's workspace, we forward your request to that organization and help it answer.

You can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro, or to the authority in the EU country where you live or work. We would appreciate the chance to fix the problem first.

Veruno does not make decisions about you that have legal or similarly significant effects. Its reports are triage signals about claims, sources and images, partly written by AI and labelled as such; they are not verdicts, and the decision always stays with a person.

We protect data with encryption in transit (HTTPS), separation between organizations in the database, private file storage with short-lived links, sign-in tokens in secure cookies that page scripts cannot read, checks of new passwords against known breaches, rate limits and spending ceilings, scrubbed logs and a record of administrator actions. No system is perfectly secure; if a breach affects your data, we will inform you and the authority as the law requires.

Veruno is a professional service and is not intended for anyone under 16. We do not knowingly collect data about children.

When we change this policy, we update the date and version at the top. For significant changes we notify account holders by email or in the app before they take effect.