Privacy policy

Data Controller

The controller of your personal data is Vericto S.A.S., Tax ID (NIT) 902.100.599-0 (hereinafter, "Vericto"), domiciled in Bogotá D.C., Colombia. For any query relating to the processing of your data, or to exercise your habeas data rights under Law 1581 of 2012, you can contact us at privacy@vericto.com.

This policy covers the data of which Vericto is the controller: account, authentication, billing, support, and use of the service and the site. When Vericto processes, on a customer's behalf, the personal data in its SQL statements, evaluation events, reports and workspace configuration, it acts as processor under the Data Processing Agreement: the customer is the controller of that data, and requests about it go to the customer.

Data collected

Vericto collects four categories of data:

1. Account data

• Email: for authentication, transactional notifications and service communications.
• Workspace name: identifier of the project or environment.
• Billing information: processed directly by the payment processor (Paddle). Vericto never receives or stores card numbers; it keeps only the customer and subscription identifiers the processor returns, plus invoice metadata (amount, currency, date, status).
• IP address and user agent: recorded on each session for security and rate limiting.

2. Product usage data

• Database connection strings: Vericto does not receive or store them; they are configured in the proxy, inside your infrastructure.
• Text of intercepted SQL queries: stored encrypted in the audit trail. Retained according to your plan (7, 30 or 90 days, or what the Enterprise contract sets). Accessible only to workspace members. Vericto processes it as processor, on the customer's behalf (DPA).
• Query metadata: timestamp, dialect, decision (BLOCKED/ALLOWED), triggered rule, latency, AST node. Not encrypted; used for dashboard metrics.
• Rule configuration: active standard rules and custom rules defined by the user.

3. Telemetry data

• Website and dashboard usage (vericto.com and app.vericto.com): pages visited, time on site and the key sign-up steps (sign-up, first query evaluated, checkout start and purchase), measured with Google Analytics 4 only if you accept analytics cookies in the banner. In the dashboard they are tied to an opaque internal id of your account, never to your email.
• Where your sign-up came from: when you create the account we store which campaign or site brought you: the link's utm_* parameters, the ad click id if any, the referring domain and the landing page, of the first and the last campaign visit. It holds no personal data and only serves to measure which channels bring customers. Kept while the account exists and deleted with it.
• Errors and exceptions: recorded in the backend's operational logs (Amazon CloudWatch), kept for 90 days. Logs do not include the text of your queries.

4. Contributor License Agreement (CLA) signatures

• Only if you contribute to a Vericto project on GitHub: signing the Contributor License Agreement records your GitHub username, the name and email you enter, the date and time of signing and the version signed.

4. Site assistant and contact form

• Conversations with the vericto.com assistant: the question you type, the answer, the page you ask from and a random session identifier (30 minutes). No cookies are used and no personal data is needed to use the assistant, and we ask you not to type any. We do not store your IP: only a value derived from it with a key that changes every day, used to detect abuse, which cannot be turned back into the IP or linked across days.
• Questions sent to the team: if you choose to get a reply by email, your email and, if you provide them, your company, role and database engine, together with your question and the conversation with the assistant. Only with your explicit consent, of which we keep the accepted text, its version and the date.

Data usage

We use your data exclusively for:

• Service delivery: intercepting and analysing SQL queries, maintaining the audit trail, sending block notifications.
• Security: detecting unauthorised access, preventing abuse, rate limiting.
• Product improvement: aggregated, anonymised analysis of usage patterns to prioritise features. Never individualised analysis without consent.
• Transactional communications: verification emails, password recovery, quota alerts, invoices. We do not send marketing emails without explicit consent.
• Technical support: when you contact support, we may access your workspace metadata (not the content of your queries) to diagnose the issue.
• Campaign measurement: knowing, in aggregate, which channels (LinkedIn, X, newsletters, communities) bring sign-ups, active accounts and customers. The attribution cookie and Google Analytics rely on your consent; the origin carried in the sign-up link itself, on our legitimate interest in measuring our campaigns, disclosed in this policy, which you accept when you sign up.
• Site assistant: answering your questions from Vericto's documentation, reviewing every week the questions it could not answer to improve the site's content, and preventing abuse. Answers are generated by an AI model and may contain errors. If you send us your question, we use it only to reply to you.
• Contribution records: keeping proof of the licenses that contributors to Vericto projects grant through the CLA.

We never sell your data to third parties. We never use the content of your queries to train AI models.

Data retention

Data type	Free Plan	Builder Plan	Team Plan	Enterprise
Query text and metadata (audit trail)	7 days	30 days	90 days	No limit, or what the contract sets
Account data	Until cancellation + 30 days
Access logs (IP, user agent)	90 days
Account security events (sign-ins, MFA, failed attempts)	365 days
Export files (your personal data and the audit trail)	7 days
Support ticket and feedback attachments	180 days
Conversations with the site assistant	30 days (deleted in the next weekly cleanup: at most 37 days)
Questions sent to the team from the site	12 months
Billing data	7 years (legal obligation)
CLA signatures	As long as the contributions they cover are distributed

After a downgrade, query text and its metadata keep the previous plan's retention for 30 days; the new plan's applies after that. You can ask for them to be deleted earlier by writing to privacy@vericto.com.

When you delete your account, from Settings → Account → Delete account or by writing to privacy@vericto.com, we deactivate it at once and delete it for good within 30 days at most; until then you can cancel the deletion. Workspaces where you were the only member are deleted with all their data. We only keep the billing data we must retain due to legal obligations and, in other teams' workspaces, the record of the actions you took, with your identity replaced by a pseudonym, without your name, email or IP address. Backups are deleted 30 days later at the latest.

Third parties and subprocessors

Vericto uses the following subprocessors to provide the service:

• Supabase (PostgreSQL) (United States, us-east-1): storage of account data, audit trail and configuration.
• Amazon Web Services (United States, us-east-1): backend and API hosting, secrets management and operational logs. Also Amazon Bedrock, which runs the site assistant (Anthropic and Cohere models served by AWS in us-east-1, us-east-2 and us-west-2). Bedrock does not share questions or answers with the model providers and does not use them to train the models.
• Paddle.com Market Ltd (United Kingdom): payment processing as merchant of record. Receives your email, name, country and payment details to issue the invoice and calculate taxes. Acting as the authorised reseller, Paddle processes that data as an independent controller, subject to its own privacy policy. Transfers outside the EEA are covered by the UK standard contractual clauses.
• Upstash (Upstash, Inc., United States, primary region us-east-1): Redis database for the rules cache, usage limits, failed-login lockout and temporary login state. It stores identifiers and counters, not the content of your queries.
• GitHub (GitHub, Inc., United States): sign in with GitHub, only if you choose it. We receive your GitHub email and username.
• Resend (United States): delivery of transactional emails (account verification, invitations, alerts, password recovery). Receives only the destination address and the message content.
• Cloudflare: CDN and DDoS protection. May process source IPs. With Cloudflare Turnstile it checks that whoever uses the assistant or the contact form is a person; Turnstile does not use cookies. On this site, Cloudflare Web Analytics measures visits in aggregate (page views, country, browser and load performance) without cookies or persistent identifiers, and it is not used to track you across sites.
• Google Analytics 4 (Google LLC, United States): website and dashboard usage measurement, only if you accept analytics cookies. If you accepted them, our server also sends it the first query evaluated, the purchase of a plan (amount, currency and plan) and its cancellation, with your pseudonymous Google Analytics id. No Google Signals or ad personalisation; GA4 does not store IP addresses.
• CLA Assistant (a service of SAP SE, Germany): only for people who contribute to a Vericto project. Records Contributor License Agreement signatures; the data is stored on Microsoft Azure, in Europe, subject to CLA Assistant's privacy statement.

The TCP proxy runs in your own infrastructure and you operate it: Vericto does not host it and has no network access to your databases.

All subprocessors are subject to data processing agreements (DPA) with the transfer safeguards the applicable law requires, except CLA Assistant, which operates under its own privacy statement.

Your rights under GDPR

If you are a resident of the European Economic Area, you have the following rights:

• Access: you can download a copy of the personal data we hold about you, in JSON format, from Settings → Account → Export your data, or ask for it by email.
• Rectification: you can correct inaccurate data directly in your account settings or by requesting it via email.
• Erasure ("right to be forgotten"): you can delete your account from Settings → Account → Delete account, or ask for it by email. What is deleted, when, and what is kept is in the retention section; billing data is retained as a legal obligation for the period stated in the table.
• Portability: you can export your personal data in JSON format from Settings → Account, and your workspace's data (audit trail, rule configuration) from the dashboard.
• Objection: you can object to the processing of your data for usage analytics. This does not affect how the service works.
• Restriction: you can request restriction of processing while a dispute about data accuracy is resolved.

Access, portability and erasure of your account are available in the dashboard, under Settings → Account. For these or any other right, or if you cannot sign in, write to privacy@vericto.com. We will respond within a maximum of 30 days.

If you believe that the processing of your data does not comply, you may file a complaint with the Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, at www.sic.gov.co. If you reside in the European Economic Area or the United Kingdom, you may also complain to the supervisory authority of your country of residence.

Your rights under CCPA (California residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: you can download the personal data we hold about you from Settings → Account → Export your data, and request information about the categories of personal data we collect and who we share it with.
• Right to delete: you can delete your account from Settings → Account → Delete account, or request it by email, subject to applicable legal exceptions.
• Right to non-discrimination: we do not discriminate against users who exercise their CCPA rights.
• Right to opt out of sale: Vericto does not sell personal data. The sale opt-out mechanism does not apply.

Cookies

Vericto uses the following cookies:

• Session cookies (essential): authentication JWT in an httpOnly cookie. Required for the service to work. Cannot be disabled.
• Language preference cookie (functional): vericto-locale, with a 1-year lifetime. On the public site it is only created if you change the language using the selector; it is never inferred from your location or your browser settings. Our server reads it to open the page in the language you chose. It is not a tracking cookie and is not shared with third parties. You can delete it from your browser and the site will keep working in English.
• Preferences stored in your browser (not cookies): the dashboard stores your theme (vericto-theme), language (vericto-locale), time zone (vericto-timezone) and time format (vericto-time-format) in localStorage. If you are signed in, these preferences are also linked to your account so they follow you across devices.
• Analytics cookies (Google Analytics 4): _ga and _ga_*, 2 years. Only set if you accept them in the consent banner; you can withdraw consent at any time from "Cookie preferences", in the footer of every page. Details in the cookie policy.
• Campaign attribution cookie (analytics, first-party): vericto_attr, 90 days. Remembers the first and the last campaign that brought you, to link it to your account if you sign up. Only set if you accept analytics, it holds no personal data and no third party reads it. The vericto_consent cookie (necessary, 6 months) stores your choice for vericto.com and app.vericto.com.

We do not use advertising or cross-site tracking cookies.

Contact the DPO

For any privacy inquiry, exercise of rights, or security incidents related to personal data, contact our Data Protection Officer:

• Email: privacy@vericto.com
• Response time: maximum 30 calendar days
• Languages: Spanish, English

For security incidents that may affect personal data, write to security@vericto.com. We respond in less than 48 hours.