Privacy Policy

Last Updated: April 6, 2026

1. Introduction & Controller Identity

Verdikt (the “Service”) is a B2B multi-agent AI debate platform designed to assist business decision-making. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, website, and related applications.

1.1 Data Controller

Verdikt (the “Company,” “we,” “us,” or “our”) operates Verdikt. We are committed to protecting your privacy and ensuring you have a positive experience on our Service.

For data protection inquiries, contact:
Email: privacy@getverdikt.com
Website: getverdikt.com

1.2 Scope and Application

This Privacy Policy applies to:

2. Information We Collect

2.1 Account and Authentication Data

When you create an account or authenticate with Verdikt, we collect:

2.2 Debate and Content Data

When you use Verdikt to submit debates, create dilemmas, or interact with the platform, we collect:

2.3 AI Interaction Data

Your prompts, context, and debate data are transmitted to AI providers (Google Gemini and Anthropic Claude) to generate debate arguments and verdicts. This data may include:

2.4 Device and Usage Data

We automatically collect information about how you interact with Verdikt:

2.5 Hiring Feature Data

If you use Verdikt’s hiring debate feature, we collect and process:

This data is considered sensitive personal data and is subject to enhanced protection (see Section 12).

2.6 Communication Data

We collect information when you communicate with us:

2.7 Organizational Intelligence Data

For Team, Business, Premium, and Enterprise tiers, Verdikt processes decision data to build organizational intelligence. This includes:

Per-session opt-out: Each session includes a “Share with company intelligence” toggle. When disabled, that session’s data is excluded from intelligence synthesis. The toggle is visible on the briefing screen before every session.

3. How We Use Your Information

3.1 Primary Service Delivery

We use your information to:

Lawful Basis: Contract (performance of our agreement with you)

3.2 Billing and Account Management

We use your information to:

Lawful Basis: Contract (billing obligations)

3.3 Service Improvement and Analytics

We use your information to:

Lawful Basis: Legitimate interest (improving our Service and user experience)

3.4 Legal Compliance and Security

We use your information to:

Lawful Basis: Legal obligation, legitimate interest (security and fraud prevention)

3.5 Organizational Intelligence Synthesis

For organizations on Team, Business, Premium, or Enterprise tiers, we use decision data to:

Lawful Basis: Legitimate interest (Article 6(1)(f) GDPR) — improving the quality and relevance of decision advisory for your organization. We have conducted a balancing test confirming that this processing is proportionate: (a) data is processed only within your organization’s context and never shared across organizations, (b) PII is redacted before AI synthesis, (c) users have per-session opt-out control, and (d) the intelligence toggle can be disabled entirely in organization settings.

Data minimization: Intelligence synthesis uses only encrypted ledger summaries (truncated to 120 characters) and does not process full session transcripts or conversation histories. Cached intelligence is automatically purged after 90 days of organizational inactivity.

3.6 Communication and Support

We use your information to:

Lawful Basis: Contract (service delivery), legitimate interest (customer support)

4. AI Data Processing

4.1 AI Provider Integration

Verdikt uses two AI providers to generate debates and verdicts:

4.2 Data Transmitted to AI Providers

When you submit a business dilemma or debate prompt, the following data is transmitted to our AI providers:

4.3 Data Retention by AI Providers

Verdikt accesses Google and Anthropic exclusively through their paid commercial API tiers, which provide stronger data protection than consumer products. Specific retention terms:

Both providers delete API data automatically after their respective safety-retention windows. No user content is stored by AI providers beyond these periods.

4.4 User Rights and AI Data

Your right to access, delete, or port data applies to Verdikt’s servers. For the temporary data retained by AI providers during their safety-retention windows:

4.5 Safeguards

We have implemented the following safeguards:

5. Data Sharing & Sub-Processors

We share your information with the following sub-processors who help us deliver Verdikt. All sub-processors have signed Data Processing Agreements (DPAs):

Provider Purpose Data Processed Location
Google Cloud Platform Cloud hosting, Firestore database, Cloud Functions All customer data, debate history, user accounts United States (us-central1)
Google AI (Gemini) AI debate generation, verdict synthesis User prompts, debate context, business dilemmas (PII-redacted). Retained ≤30 days for safety, then deleted. Not used for model training. API Terms United States
Anthropic (Claude) AI debate generation, artifact analysis User prompts, debate context, job descriptions (PII-redacted). Retained ≤30 days for safety, then deleted. Not used for model training. Commercial Terms United States
Stripe Payment processing, subscription management, billing Payment method, billing address, subscription status, invoice history United States
Brevo (Sendinblue) Email delivery (invitations, trial lifecycle, billing, renewal reminders) Email address, notification content European Union / United States
Sentry Error tracking and debugging Error logs, performance metrics, anonymized identifiers United States

5.1 Third-Party Service Providers

In addition to sub-processors listed above, we may share data with:

5.2 No Sale of Personal Information

Verdikt does NOT sell, rent, or trade your personal information to third parties. We do not monetize user data.

6. International Data Transfers

Verdikt operates with data infrastructure in the United States. If you are located in the European Union or other jurisdictions, your data is transferred to and processed in the United States.

6.1 EU-US Data Privacy Framework

Verdikt complies with the EU-US Data Privacy Framework (DPF), formerly Privacy Shield, as set forth by the U.S. Department of Commerce and the European Commission.

6.2 Standard Contractual Clauses

For data transfers outside the DPF framework, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Our sub-processors are bound by equivalent SCCs.

6.3 Transfer Impact Assessment

We have conducted Transfer Impact Assessments in accordance with GDPR Article 46 to evaluate:

7. Data Retention

7.1 Retention Schedule

Account Data:

Retained while your account is active. Deleted within 30 days of account deletion or subscription cancellation.

Debate and Content Data:

Retained for the duration of your subscription plus a 30-day grace period after cancellation. You may request deletion at any time.

Billing and Credit Transaction Data:

Credit transaction records are retained for 12 months and automatically purged. When an account or organization is deleted, Stripe customer records are permanently deleted via the Stripe API (not archived). Stripe retains invoice and charge records independently for tax compliance per their own data retention policies.

Deletion Audit Logs:

When an account or organization is permanently deleted, an anonymized audit log is retained for 6 years per IRS record-keeping requirements (26 USC §6501). Audit logs contain only hashed identifiers (truncated SHA-256) — no raw email addresses, names, or user IDs are stored. These anonymized records are automatically purged after the statutory retention period.

Usage and Analytics Data:

Retained for 12 months from collection date. Aggregated, anonymized data may be retained longer.

Organizational Intelligence Cache:

Cached intelligence summaries are refreshed every 24 hours and automatically purged after 90 days of organizational inactivity. Decision Ledger entries are retained for the duration of the organization’s subscription and deleted upon organization deletion. When a user deletes their account, their entries in the organization’s Decision Ledger are anonymized (userId replaced with “deleted-user”) to preserve aggregate intelligence while removing personal attribution.

Hiring Feature Data:

Retained for 90 days after final evaluation. Extended retention requires explicit consent.

Support and Communication Data:

Retained for 3 years to address follow-up issues and legal compliance.

7.2 Data Deletion

Upon subscription cancellation, your organization enters a 30-day grace period during which data is accessible in read-only mode. After the grace period, all organization data is permanently deleted through an automated cascade that removes sessions, verdicts, artifacts, billing records, persona memories, team invitations, and audit logs. Upon account deletion or specific deletion requests, we will purge your personal data from our systems within 30 days, subject to legal retention obligations.

8. Your Rights (GDPR & CCPA)

You have the following privacy rights. To exercise any of these rights, contact privacy@getverdikt.com with your request.

8.1 GDPR Rights (for EU residents)

8.2 CCPA Rights (for California residents)

8.3 Response Timeline and Process

For all rights requests:

9. Children’s Privacy (COPPA Compliance)

Verdikt is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children’s Online Privacy Protection Act (COPPA). Account registration is blocked for users under 13 through both client-side and server-side enforcement.

Users aged 13–17 may create an account only with verifiable parental or guardian consent, as confirmed during the registration process.

If we become aware that we have collected data from a child under 13 without verifiable parental consent, we will delete it immediately and terminate the associated account.

Parents or guardians who believe a child has provided us with personal information should contact privacy@getverdikt.com immediately.

10. Cookies & Tracking

10.1 Cookies and Local Storage

Verdikt uses cookies and local storage to:

10.2 Cookie Types

Essential Cookies: Required for authentication and platform functionality. These cannot be disabled.

Analytics Cookies: Google Analytics is used to understand how you use Verdikt. Data is anonymized. You can opt-out via browser settings or by installing the Google Analytics Opt-out Browser Add-on.

Firebase Analytics: Firebase collects usage data to help us understand platform performance. Data is not sold to third parties.

10.3 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. Note that disabling cookies may impact platform functionality.

11. Data Security

11.1 Security Measures

We implement comprehensive security safeguards to protect your personal data:

11.2 Data Breach Notification

In the event of a data breach affecting your personal information:

11.3 Limitations

While we implement industry-standard security measures, no system is completely secure. We cannot guarantee absolute protection against all unauthorized access, loss, alteration, or destruction of data. You are responsible for maintaining the confidentiality of your account credentials.

12. High-Risk Processing (Hiring Feature)

12.1 Data Protection Impact Assessment (DPIA)

The Verdikt hiring feature processes candidate evaluation data and job descriptions, which may include sensitive personal data (as defined in GDPR Article 9). We have conducted a Data Protection Impact Assessment (DPIA) for this feature in accordance with GDPR Article 35.

Key findings from our DPIA:

12.2 Special Protections for Hiring Data

When using the hiring feature, we:

12.3 Candidate Rights

Candidates whose data is processed through the hiring feature have the right to:

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

Your continued use of Verdikt after policy changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Email: privacy@getverdikt.com
Website: getverdikt.com
Address: 1317 Edgewater Dr #6656, Orlando, FL 32804

14.1 Data Protection Officer

Verdikt designates privacy@getverdikt.com as the primary contact for all privacy inquiries.

15. EU Representative

In accordance with GDPR Article 27, Verdikt will appoint an EU representative for data protection inquiries. Residents of the EU may contact us at privacy@getverdikt.com.

15.1 GDPR Contact Information Summary

For all GDPR inquiries:

This Privacy Policy is effective as of April 6, 2026 and governs all use of Verdikt. Verdikt is operated in compliance with GDPR, CCPA, and applicable data protection laws.