1. Controller identity and scope

Verdictan Reference SL (SL), NIF B00000000, registered with Madrid under number 1, with service address at Madrid, ES, is the controller for website, onboarding, and commercial contact data described in this policy.

This Privacy Policy explains how Verdictan handles personal information when you visit our website, request a demo, create or use an account, or interact with our documentation, console, APIs, and support channels.

Verdictan acts as a controller for commercial contacts, support operations, and platform security data. When enterprise customers send prompts, responses, or files through the product under a signed agreement, Verdictan processes that information on the customer's behalf as a processor, according to the applicable order form, DPA, or service terms.

2. Information we collect

The information we collect depends on how you use Verdictan. Some data is provided directly by you, some is generated by your administrators, and some is collected automatically to operate and secure the service.

Identity and account data such as name, work email, company, role, authentication settings, and account status.
Commercial and onboarding data such as contact-sales submissions, deployment preferences, evaluation notes, and contract records.
Service activity data such as audit events, gateway decisions, configuration changes, support messages, security logs, and usage telemetry.
Content processed through the platform such as prompts, model responses, files, metadata, and policy decisions, subject to customer configuration and retention settings.
Website and device data such as IP address, browser details, and referral pages needed for fraud prevention and site reliability.

3. How and why we use information

Verdictan uses personal information for the purposes and legal bases described below.

Contractual necessity (Art. 6(1)(b) GDPR): Where you are personally a party to a contract with Verdictan, or ask us to take steps before entering one, process the personal information objectively necessary to perform that contract or take those requested steps.
Legitimate interest (Art. 6(1)(f) GDPR): Where an organization is the customer, authenticate its authorized users, provision and administer workspaces, enforce access control, deliver requested product features, and support evaluation workflows; respond to support tickets, security inquiries, and contact-sales requests; detect abuse, investigate incidents, prevent fraud, and protect the platform and our customers; measure product usage, debug failures, plan capacity, improve product quality, and send operational notices. We assess these interests against the rights and freedoms of affected individuals.
Legitimate interest (Art. 6(1)(f) GDPR): Google Search Console and Bing Webmaster Tools are used to monitor search-engine visibility, indexing status, and crawl performance for verdictan.com and docs.verdictan.com. These operator-facing tools do not inject client-side scripts into Verdictan pages or set cookies from those pages. They provide aggregated search-performance and crawl/indexing reports rather than direct visitor identifiers. To the extent this operational reporting involves personal data, Verdictan relies on its legitimate interest in site reliability and optimization.
Legal obligation (Art. 6(1)(c) GDPR): Retain records required by tax, accounting, anti-fraud, or other applicable laws; respond to lawful government requests.
Customer instructions (processor role): When Verdictan processes prompts, responses, files, or related service data on behalf of an enterprise customer, that customer determines the purposes and legal basis for the processing, and Verdictan processes the data under the governing agreement and documented instructions.
Where permitted and with a separate opt-in, we may send relevant marketing communications. You can opt out at any time using the unsubscribe link in those communications.

5. International transfers

Verdictan is operated from the European Economic Area (Spain). The applicable transfer mechanism depends on the data's origin, destination, recipient, and governing agreement. For restricted transfers, safeguards may include the European Commission's Standard Contractual Clauses for EEA data, the UK International Data Transfer Agreement or UK Addendum for UK data, and recognized Swiss safeguards or adapted clauses for Swiss data, together with any required transfer assessment.

Personal information may be transferred to the United States (for cloud infrastructure and AI provider routing where configured by the customer) and to other countries where our subprocessors operate. Information about the applicable contractual or other transfer safeguard is available on request by contacting privacy@verdictan.com.

For additional information about our approach to transatlantic transfers, see the International Data Transfer Policy page on this website.

Google Search Console and Bing Webmaster Tools provide aggregated search-performance and crawl/indexing reports without direct visitor identifiers.

6. Retention

Verdictan retains personal information only for as long as necessary for the purposes described in this policy or as required by law. The following criteria determine retention periods:

Account and identity data: retained while the relevant account or organization relationship is active and then according to the applicable account- or organization-closure workflow, security needs, legal obligations, and legal holds. Data is deleted or redacted when the applicable workflow completes unless another documented purpose requires continued retention.
Contact-sales submissions and commercial records: retained while an inquiry or customer relationship is active and afterward according to follow-up needs, applicable limitation periods, tax or accounting duties, disputes, and legal holds.
Audit events and gateway decision logs: retention depends on the owning store and deployment configuration. Current managed schemas include 365-day defaults for trail configuration and the gateway-event store, but this is not a universal or self-service customer setting; a governing agreement or operator-managed deployment may define a different period.
Support messages and security logs: retained while a request or incident is active and afterward according to investigation needs, recurrence analysis, applicable limitation periods, legal obligations, disputes, and legal holds.

7. Security

We use technical and organizational safeguards designed for enterprise AI workloads, including encryption in transit (TLS), encryption at rest for sensitive stores (AES-GCM-SIV), role-based access control, audit logging, session controls, and environment isolation. No service can promise absolute security, so incident response and continuous review remain part of our operating model.

8. Your rights

Depending on your location and the role Verdictan plays for the relevant data, you may have the following rights under the GDPR and other applicable data protection laws:

Access: request a copy of the personal information we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your personal information where there is no compelling reason for continued processing.
Restriction: request that we limit the processing of your data in certain circumstances.
Data portability: receive your data in a structured, commonly used, machine-readable format.
Objection: object to processing based on legitimate interest, including direct marketing.
Withdraw consent: where processing is based on consent, you can withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.
Lodge a complaint: you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain (www.aepd.es), or another competent supervisory authority.

You can submit privacy requests at privacy@verdictan.com. We may need to verify identity or organizational authority before completing a request. When Verdictan acts as a processor on behalf of an enterprise customer, requests regarding prompts, responses, files, or user activity records may need to be directed to that customer first.

9. Automated decision-making

Verdictan does not use personal information for automated decision-making or profiling that produces legal or similarly significant effects on individuals as described in Art. 22 GDPR. Customer-configured gateway policies can combine deterministic rules with model- or service-assisted checks; customers remain responsible for deciding whether and how resulting policy outcomes affect individuals.

10. Data Protection Officer

Verdictan evaluates whether a DPO designation is required under the Article 37 criteria and will publish the DPO's contact details if applicable.

DPO status: not_required (assessment date 2026-01-01). No DPO contact is published for this operator. Direct data protection inquiries to privacy@verdictan.com.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the website and, where appropriate, by email. The 'Last updated' date at the top of this page reflects the most recent revision.

12. Contact us

If you have questions about this policy, contact privacy@verdictan.com. For contract, legal, or security matters, contact legal@verdictan.com or security@verdictan.com as appropriate.

Privacy Policy