This Privacy Policy explains how iWantIt (Pty) Ltd collects, uses, stores, and shares personal information in connection with vera.ink. We are committed to processing your personal information lawfully, fairly, and transparently.
01 / WHO WE ARE AND YOUR DATA CONTROLLER
iWantIt (Pty) Ltd (registration number 2026/315901/07), Sandton, Gauteng, South Africa, is the responsible party and data controller for personal information collected via vera.ink. Our Information Officer may be contacted at support@vera.ink.
The Information Officer (Simon Keeling) is registered with the Information Regulator of South Africa as required by POPIA Section 55. Regulator Registration Number: 2026-015714, registered 15 May 2026.
02 / SCOPE
This policy applies to all users of vera.ink — website visitors, free tier users, and paid subscribers — regardless of location.
03 / LEGAL BASES FOR PROCESSING
South Africa (POPIA): We process personal information where you have consented (s11(1)(a)), where processing is necessary to perform our contract with you (s11(1)(b)), where we have a legitimate interest not overridden by your interests (s11(1)(f)), or where required by law (s11(1)(c)).
European Union (GDPR): We rely on Article 6(1)(b) (contract performance), Article 6(1)(a) (consent where obtained), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests).
United Kingdom (UK GDPR): We rely on Article 6(1)(b) (contract performance), Article 6(1)(a) (consent where obtained), Article 6(1)(c) (legal obligation), and Article 6(1)(f) (legitimate interests), under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
United States — California (CCPA / CPRA): We do not sell personal information. Where the CCPA applies to our processing, California residents have the right to know what personal information we collect, to request deletion, and to non-discrimination for exercising these rights. California residents also have the right to opt-out of the sale or sharing of their personal information, and to limit the use and disclosure of sensitive personal information.
04 / WHAT WE COLLECT
Account data: Email address provided when submitting a verification or creating an account. You need to give us an email address to create an account and use vera.ink; without one we cannot provide the service. Everything else you submit is your choice.
Verification data: Documents and source material you submit for verification, verification results, findings reports, and corrected documents.
Subscription and billing data: Subscription tier, billing history, and Dodo Payments customer ID. Payment card details are never stored by us — processed solely by Dodo Payments.
Usage data: Verification history, modes selected, packs created, and activity within the platform.
Technical data: IP address, device type, browser type and request logs, processed automatically by our hosting and sign-in providers when you use the platform. We do not store them in our own application database (see section 06).
05 / HOW WE USE YOUR INFORMATION
We use your personal information for the purposes below. Each one names the legal basis we rely on for it.
- Provide, operate, and deliver the verification service — contract
- Process your documents through AI systems to generate verification outputs — contract
- Communicate with you about your account, verification results, and support — contract
- Process payments and manage your subscription — contract; keeping the billing records afterwards — legal obligation
- Keep the service secure and diagnose faults — legitimate interests
- Improve the service through aggregated, anonymised analysis — legitimate interests
06 / DOCUMENT PROCESSING AND RETENTION
What happens to a document you check. When you paste or upload a document, we extract its text. We do not keep the original file. The text is sent to our AI providers, Anthropic (Claude) and Google (Gemini), to run the check, to match findings to rules, to write the report and, if you ask for one, to prepare a corrected copy. PDF files are sent to Google's Gemini model to be transcribed into text. We do not use your documents to train AI models.
Verification results, including the text of your original document (not the file itself), source material, findings, and corrected document, are retained in your account history until you delete them or ask us to erase them. You may delete an individual verification at any time from your library.
How long we keep each category. Where we cannot give a fixed period, we give the criteria we use to determine it instead.
Account data. For as long as your account exists. If you ask us to close it, we keep a minimal record for up to 2 years afterwards for legal and dispute-resolution purposes, unless a longer retention period is required by law.
Verification data. Deleting a verification from your library permanently removes it, including your document's text, the findings, the report and any corrected copy. If the document was part of a batch, the batch's combined report is deleted as well. Deleted verifications cannot be recovered from your account; backup copies held by our database host are removed on that host's normal backup cycle. A document you saved to your library separately is not deleted with the verification: email support@vera.ink to have it erased. We apply no automatic expiry, so nothing goes unless you delete it or ask.
Subscription and billing data. Kept for as long as South African tax and company law requires records of the transaction to be retained, counted from the end of the financial year in which it falls. While that obligation runs we cannot delete these records on request, even if you close your account. Payment card details are never held by us at all.
Usage data. Verification history, modes selected and packs created form part of your account and are kept for as long as the account exists. We apply no automatic expiry. To have them erased sooner, email support@vera.ink.
Technical data. The application writes no IP addresses, device details or browser details to our own database. Sign-in records and server request logs are held by our authentication and hosting providers on our behalf and are kept for their retention periods, not ours; we access them only to keep the service secure and to diagnose faults.
07 / SOURCE PACKS
Source packs you create, including all pasted content and indexed embeddings, are stored in your account and accessible only to you. Source pack content is processed through embedding models (Google Gemini) to enable semantic search. We do not share your source pack content with other users or third parties beyond what is required to operate the service.
08 / WHO WE SHARE YOUR DATA WITH
We use the following service providers ("sub-processors"). Each receives only what it needs to do its job.
Receive your documents or source material
- Anthropic PBC (United States): Claude models, used to review findings against the whole document, check for missing topics, write your report, prepare corrected copies and build Source Packs.
- Google LLC (United States): Gemini models, used to transcribe PDFs, run the check, and create the text embeddings used to match findings to rules.
- Supabase Inc, through the Lovable Cloud platform: database, file storage and sign-in. This is where your account, the extracted text of documents you check, results, reports and corrected copies are stored.
- Railway Corporation (United States): hosts the vera.ink MCP server. When you connect an AI assistant to vera.ink, the document text it sends passes through this server on its way to us. The server does not store it.
- Lovable and Cloudflare: host the vera.ink website and its sign-in connection for AI assistants.
Receive web addresses or search terms only, never your documents
- Firecrawl, Jina AI, Tavily, Exa and Brave Search: used to find and fetch official sources when you build a Source Pack, or when you give us a source web address to check against. They receive the web address or search terms, not your documents.
Receive account and billing details only
- Resend Inc: sends sign-in codes and service emails.
- Dodo Payments: processes payments as merchant of record. We never see or store your card details.
Website visitors
- Google Fonts: the website loads its fonts from Google, which receives your IP address when a page loads.
We do not sell your personal information. We do not share your documents or source material with other vera.ink users or use them for marketing.
We will update this list before adding a new provider that receives your documents.
09 / WHEN YOU UPLOAD OTHER PEOPLE'S INFORMATION
Documents you check may contain personal information about other people, for example your clients, their customers or their staff. For that information, you are the controller (the "responsible party" under POPIA), and we process it on your behalf as your processor (the "operator" under POPIA). In that role we:
- use it only to provide vera.ink to you, and for no other purpose;
- keep it confidential and limit access to the people who need it to run the service;
- use only the service providers listed in section 08, under written terms that protect it;
- protect cross-border transfers with appropriate safeguards (see International transfers);
- delete it when you delete it, or when you ask us to (see section 06);
- help you respond if one of those people asks to exercise their rights;
- tell you without undue delay if we become aware of a breach affecting it.
Please upload only what the check needs. Redacting names and contact details before you upload is usually possible, and doesn't affect most checks.
If your organisation needs a signed data processing agreement, email support@vera.ink.
10 / YOUR RIGHTS
Your right to object. Set out here on its own, separately from the list below, because the law requires it to be brought to your attention that way. Where we process your personal information on the basis of our legitimate interests, you may object to that processing at any time on grounds relating to your particular situation. If you object we will stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. To object, email support@vera.ink.
Depending on your jurisdiction, you may also have the following rights:
- Access: request a copy of the personal information we hold about you
- Correction: request correction of inaccurate personal information
- Deletion: request deletion of your personal information
- Portability: request your personal information in a structured, machine-readable format
- Objection: object to processing based on legitimate interests
- Restriction: request restriction of processing in certain circumstances
- Withdrawal of consent: where processing is based on consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before you withdrew it
- Opt-out of Sale/Sharing (California): request to opt-out of the sale or sharing of your personal information
- Limit Use of Sensitive Personal Information (California): request to limit the use and disclosure of sensitive personal information
- Non-discrimination: you will not be discriminated against for exercising your privacy rights
We will respond to your requests within the timeframe required by applicable law: up to one month under GDPR, 45 days under CCPA/CPRA, or, under POPIA, within a reasonable time and as soon as reasonably practicable. Exercising these rights is free of charge, except where the law allows a reasonable fee, for example for requests that are manifestly unfounded or excessive.
If you are unhappy with how we have handled your personal information, you can complain to us first at support@vera.ink. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You also have the right to lodge a complaint with a supervisory authority. South African users may contact the Information Regulator at inforeg.org.za. EU users may contact their national supervisory authority under GDPR Article 77. UK users may contact the ICO at ico.org.uk. California residents may contact the California Privacy Protection Agency at cppa.ca.gov.
To exercise any of these rights, contact support@vera.ink.
11 / COOKIES AND TRACKING
vera.ink uses minimal cookies required for session management and authentication. We do not use advertising or tracking cookies. We do not use third-party analytics platforms that process personal data without your consent.
12 / SECURITY
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. All data is encrypted in transit and at rest. Our database is hosted in the European Union, in Frankfurt, Germany. Access to personal data is restricted to personnel who need it to operate the service.
Each account can see only its own documents, results and private Source Packs. This is enforced in the database itself, not only in the app. Uploaded documents and reports are held in private storage that cannot be reached from a public link. API keys are stored only as secure one-way fingerprints (hashes); we can't see your full key after it is created.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware, and will notify affected users without undue delay where required by applicable law.
13 / INTERNATIONAL TRANSFERS
Your personal data may be transferred to and processed in countries outside South Africa, including the United States (Anthropic, Google, Supabase, Railway, Cloudflare, Resend, Dodo Payments and the source-fetching providers listed in section 08) and the European Economic Area. We ensure such transfers are subject to appropriate safeguards, including standard contractual clauses where required, in compliance with GDPR Article 46, UK GDPR Article 46, and POPIA Section 72.
Where the destination country is covered by an adequacy decision of the European Commission or the UK government, the transfer relies on that decision. Where it is not, the transfer relies on the European Commission's standard contractual clauses (with the UK International Data Transfer Addendum where UK data is involved). You can request a copy of the safeguards that apply to a specific transfer by emailing support@vera.ink.
14 / CHILDREN
vera.ink is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted personal information to us, contact support@vera.ink and we will delete it promptly.
15 / CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect. The current version is always available at vera.ink/privacy.
16 / CONTACT
Data Controller: iWantIt (Pty) Ltd Information Officer: support@vera.ink Address: Sandton, Gauteng, South Africa For data protection queries: support@vera.ink