Privacy

last updated [EFFECTIVE DATE]

This policy explains what VertRule Evidence Studio (“the Service”), operated by [LEGAL ENTITY], stores and why. We collect the minimum needed to run accounts, billing, and hosted sharing.

• Account. Your email, name, and OAuth provider identifier from the provider you sign in with (GitHub).
• Billing. Plan, subscription status, and your Stripe customer and subscription identifiers. Payments are processed by Stripe; we do not store your card details.
• Your content. The systems you create and the signed evidence packs you generate, plus their ownership, lifecycle, and sharing metadata.
• Hosted share links. When you publish, we store an unlisted, non-indexed link to the published pack.
• Usage events. A small set of anonymous product events (for example, a page view or a verification) used to understand the funnel. These carry no personal data beyond an optional account identifier — never your evidence, tokens, or keys.

Your signing key is generated in your browser and never leaves it. We store the signed pack and the public signer identifier, never the signing seed. We cannot recover a lost key.

We use a single session cookie to keep you signed in. We do not use third-party advertising or tracking cookies, and we do not use a third-party analytics service.

We share data only with the providers needed to run the Service: GitHub for sign-in and Stripe for payments. We do not sell your data. A portable pack you download or send is a copy held by the recipient; deleting or revoking the hosted copy does not reach copies already distributed.

We keep your packs until you delete them. Deleting a snapshot removes its hosted share links immediately. There is no automatic expiry. Account deletion (which removes your account, systems, snapshots, and share links) is handled on request for this release — email hello@vertrule.com. To request a copy of your data or ask a privacy question, use the same address.

[LEGAL ENTITY], [CONTACT ADDRESS]. Questions: hello@vertrule.com. This policy is governed by the laws of [JURISDICTION].