1. Controller
The full identity, address and direct contact details of the data controller have not yet been supplied for publication. They must be added before a public commercial launch. Technical requests can currently be submitted through support.
2. Data processed
Veredo processes data required to provide accounts and the service:
- account and sign-in data such as email address, display name and authentication data,
- chat messages, uploads, selected models, coding projects and settings,
- credit, usage and support records,
- technically necessary logs such as time, status, IP address, browser and device information.
3. Purposes and legal bases
Processing supports account creation, chat, comparison and coding features, security, abuse prevention, support and error analysis. Depending on the operation, it is based in particular on performance of a contract, legal obligations or legitimate interests. Where consent is required, it will be requested separately.
4. Hosting, authentication and database
The application is delivered through Vercel. Authentication and database functions use Supabase. Technically necessary request, account and content data may be processed. Applicable processing agreements and safeguards for international transfers must be documented and reviewed before commercial launch.
5. AI processing
Prompts, selected attachments and necessary conversation context are transferred to the selected AI or routing provider to generate a response. Depending on the model selection, these providers may include OpenRouter, OpenAI, Google or another provider identified in the model selector. Do not use the service for sensitive personal data if it should not be sent to the relevant provider.
6. Security and email services
Cloudflare Turnstile may process technical signals to prevent abuse. Transactional and support emails may be delivered through Resend. Scope, contractual basis, retention and possible international transfers must be documented conclusively before commercial launch.
7. Connected Google services
Google services are used only after the user explicitly connects them. For Gmail, Veredo requests only permission to send new messages ('gmail.send') and the connected account's email address. Veredo does not read, search, modify or delete messages. Before sending, Veredo displays the recipients, subject and content for confirmation; the confirmation rule selected in settings remains authoritative.
For Google Drive, Veredo uses the limited 'drive.file' permission. It applies only to files selected by the user through Google Picker or created by Veredo at the user's request. Saved files are placed in a Veredo-created folder named “Veredo”. This does not give Veredo general access to the user's other Drive content.
Access and refresh tokens are stored encrypted and used only for the requested Gmail or Drive action. Disconnecting a service deletes the local connection, including stored tokens. When the final Google service is disconnected, Veredo also attempts to revoke the authorization with Google. Google user data is not used for advertising, profiling or training general-purpose AI models. Veredo's use of Google data complies with the Google API Services User Data Policy, including the Limited Use requirements.
8. Local storage and cookies
Veredo uses session information and local settings required for sign-in, language, appearance and functional state. Non-essential tracking technologies will not be enabled without the legally required information and consent.
9. Analytics and logs
Page and event data may be collected for stability, audience measurement, abuse prevention and product improvement. A binding list of events, legal bases and retention periods must be published before commercial launch.
10. Retention and deletion
Data is retained only for as long as needed for its purpose or a legal obligation. Accounts can be scheduled for deletion through account settings. Binding periods for logs, backups and individual providers still need to be established and added here.
11. Data subject rights
Where the legal conditions apply, individuals may request access, correction, deletion, restriction, portability or object to processing, and may withdraw consent for the future. They may also lodge a complaint with a competent data protection authority.
12. Payments
Payments and paid top-ups are currently disabled. The payment provider, processed data, legal bases and retention periods will be added before activation.
13. Changes
This notice will be updated when features, providers or legal bases change. Material changes will be identified appropriately.
Document date: 31 August 2026