1. Controller
The full identity, address and direct contact details of the data controller have not yet been supplied for publication. They must be added before a public commercial launch. Technical requests can currently be submitted through support.
2. Data processed
Veredo processes data required to provide accounts and the service:
- account and sign-in data such as email address, display name and authentication data,
- chat messages, uploads, selected models, coding projects and settings,
- credit, usage and support records,
- technically necessary logs such as time, status, IP address, browser and device information.
3. Purposes and legal bases
Processing supports account creation, chat, comparison and coding features, security, abuse prevention, support and error analysis. Depending on the operation, it is based in particular on performance of a contract, legal obligations or legitimate interests. Where consent is required, it will be requested separately.
4. Hosting, authentication and database
The application is delivered through Vercel. Authentication and database functions use Supabase. Technically necessary request, account and content data may be processed. Applicable processing agreements and safeguards for international transfers must be documented and reviewed before commercial launch.
5. AI processing
Prompts, selected attachments and necessary conversation context are transferred to the selected AI or routing provider to generate a response. Depending on the model selection, these providers may include OpenRouter, OpenAI, Google or another provider identified in the model selector. Do not use the service for sensitive personal data if it should not be sent to the relevant provider.
6. Security and email services
Cloudflare Turnstile may process technical signals to prevent abuse. Transactional and support emails may be delivered through Resend. Scope, contractual basis, retention and possible international transfers must be documented conclusively before commercial launch.
7. Connected Google services
Google services are used only after the user explicitly connects them. For Gmail, Veredo requests only permission to send new messages ('gmail.send') and the connected account's email address. Veredo does not read, search, modify or delete messages. Before sending, Veredo displays the recipients, subject and content for confirmation; the confirmation rule selected in settings remains authoritative.
For Google Drive, Veredo uses the limited 'drive.file' permission. It applies only to files selected by the user through Google Picker or created by Veredo at the user's request. Saved files are placed in a Veredo-created folder named “Veredo”. This does not give Veredo general access to the user's other Drive content.
Access and refresh tokens are stored encrypted and used only for the requested Gmail or Drive action. Disconnecting a service deletes the local connection, including stored tokens. When the final Google service is disconnected, Veredo also attempts to revoke the authorization with Google. Google user data is not used for advertising, profiling or training general-purpose AI models. Veredo's use of Google data complies with the Google API Services User Data Policy, including the Limited Use requirements.
8. Local storage and cookies
Veredo uses session information and local settings for sign-in, language, appearance and functional state. Text drafts are stored in the browser tab separately by account, chat and workspace and can be recovered for up to 24 hours after the last edit. Expired drafts are not restored and may remain in tab storage until that session ends. Confirmed sign-out or an account change clears the previous account's drafts. This does not add cloud storage. Temporary attachments remain only in the tab's memory; reload or sign-out requires reattaching them. Existing saved chats and projects are separate from these drafts.
Browser choices are always accessible under “Cookies & privacy”. No analytics identifiers are created without separate permission. Purposes, storage names and expiry are described in the storage inventory. Optional collection remains blocked until operator information has been completed and reviewed. Necessary security functions remain independently active.
9. Analytics and logs
Optional visit analytics are technically prepared but currently paused. After legal operator approval and explicit browser permission, Veredo measures landing page views, selected clicks, source channels, limited campaign values, screen size and approximate IP region for up to 30 days. Chat contents, inputs, filenames, full referrer URLs and raw IP addresses are excluded from this analytics database. Withdrawal under “Cookies & privacy” ends collection and deletes the associated visit data. The intended legal basis is consent (GDPR Article 6(1)(a); TDDDG section 25(1) for device access). Internal reports are restricted to authorized administrators. PostHog, Vercel Web Analytics, Speed Insights and separate product-outcome measurement remain disabled; this browser choice does not authorize them.
10. Retention and deletion
Optional troubleshooting and enhanced live details
The new troubleshooting feature is initially disabled. Only after operator review and your separate choice under Account → Data may categorized interaction steps be collected: workspace area, selected action, order, relative timing, coarse screen size and a local request reference. Messages, inputs, filenames, screen recordings, full URLs, cookies and tokens are excluded. Authorized administrators may use these to assemble an incomplete troubleshooting step plan; no actions are executed again. A regular daily purge removes diagnostic events older than 30 days. Activation remains blocked until this purge has been confirmed.
All optional live signals require a separate, voluntary account choice and operator approval. They show the current workspace area, observed visible-tab duration, time without observed interaction and approximate IP region. Short-lived signals expire after 35 seconds without an update; the last approved snapshot is kept for up to 7 days and deleted on withdrawal. They are not proof of work, presence or an exact location. Sign-in or signup security data are separate, not current location measurements. Withdraw either option or download diagnostic data under Account → Data. Consent is the intended legal basis for optional live details and troubleshooting. Veredo works without either choice. Enabled Do Not Track and Global Privacy Control signals additionally prevent optional collection. Existing choices remain stored during an operator pause but do not authorize new collection during that pause.
Data is retained only for as long as needed for its purpose or a legal obligation. Accounts can be scheduled for deletion through account settings. Binding periods for logs, backups and individual providers still need to be established and added here.
11. Data subject rights
Where the legal conditions apply, individuals may request access, correction, deletion, restriction, portability or object to processing, and may withdraw consent for the future. They may also lodge a complaint with a competent data protection authority.
12. Payments
Payments and paid top-ups are currently disabled. The payment provider, processed data, legal bases and retention periods will be added before activation.
13. Changes
This notice will be updated when features, providers or legal bases change. Material changes will be identified appropriately.
Document date: 10 October 2026 – still a draft