How we handle your data and your users’ data.

1. Who we are

Veritus is operated by Design Technology Ltd, trading as Transcom Internet Services (“we”, “us”, “Transcom”), a company registered in England and Wales (No. 2828342), with its registered office at Concorde House, Brighton, BN2 1TS, United Kingdom. We are the data controller for personal data processed when you visit veritus.uk or sign up for an account.

For data processed via the Veritus scoring API on behalf of our paying customers, our customer is the data controller and we are the data processor — see section 6.

2. Data we collect when you visit veritus.uk

• Web server logs: IP address, user agent, request URL, timestamp. Retained 30 days for security and abuse investigation.
• Cookie data: we use a single first-party session cookie required to operate sign-in and the contact form. We do not use analytics cookies or third-party tracking cookies.
• Form submissions: if you submit the signup form or the contact form, we collect the data you enter (name, email, company, address, etc.).

3. Data we collect when you have a Veritus account

• Account data: your name, business name, billing address, contact email and phone, billing details (handled by Stripe; we never see your card number).
• Configuration data: your API keys, rule sets, threshold settings, domain and form configuration.
• Usage data: count and metadata of API calls and widget invocations for billing and capacity planning.
• Verdict history: the verdicts we returned to you, retained per your tier’s data retention period.

4. Data processed via the scoring API

When your end users sign up on a form protected by Veritus, the form fields are sent to us for scoring. This typically includes email address, phone number, name, postal address, country, and an IP address. Optional fields you may send include date of birth, language preference, referrer URL, and custom application-specific fields.

We act as your data processor for this data under Article 28 of the UK GDPR. We process it only to compute a verdict, log the verdict for your dashboard, and (with your explicit consent) include it in anonymised training data for the global model.

Payload data is retained for the verdict-history period of your tier (7 days on Free, up to 1 year on Business). After that, identifying fields are deleted; only the verdict and anonymised feature vector are retained for model training.

5. Third-party enrichment providers

To enrich your end-users’ data, we send specific fields to the following processors:

• Have I Been Pwned — first 5 chars of SHA-1 of password (k-anonymity model; the password itself never leaves the browser).
• MaxMind GeoIP2 — IP address, returns geolocation, ASN, datacentre/proxy flags.
• UK Royal Mail PAF data & international postal feeds — postal address, returns deliverability and accuracy.
• Phone validation provider — phone number, returns line type and carrier (provider rotated periodically).

We do not sell or share your end-users’ data with any third party for marketing or any purpose other than scoring.

6. Legal basis for processing

• Account & billing data: performance of contract (Article 6(1)(b) UK GDPR).
• End-user data via the scoring API: your customer’s legitimate interest in fraud prevention (Article 6(1)(f)), processed under your instructions as data processor.
• Server logs & abuse data: our legitimate interest in network security and service integrity.
• Marketing emails: consent (Article 6(1)(a)) — opt-in only, unsubscribe in every message.

7. International transfers

All scoring, all training, and all customer data are processed and stored in the United Kingdom. We do not transfer data to the United States or any other country outside the UK or European Economic Area in the normal course of operation. If a third-party enrichment provider operates outside the UK/EEA, transfers are governed by UK International Data Transfer Agreements.

8. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, port, or object to processing of your personal data. To exercise any right, email privacy@veritus.uk. We respond within 30 days.

End users whose data has been scored should contact the operator of the site they signed up on first, as that operator is the data controller for their data.

9. Complaints

If you are unhappy with how we have handled your data, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first — email privacy@veritus.uk.

10. Changes to this policy

We will post material changes here with at least 30 days’ notice before they take effect. Existing customers will be notified by email.