Privacy Policy

Effective date: February 2, 2026 · Last updated: July 13, 2026

VerityRecord is committed to user privacy. End-to-end encryption is a choice you make per record: for records you encrypt, we cannot access the file contents. This policy explains what data we collect, why we collect it, and what your rights are.

Data We Collect

Account information: Email address, user ID, verification status
Content data: Uploaded file hashes, link captures, timestamps, metadata
Usage data: Request counts, rate-limiting records, audit logs
View records: When a certificate or share link is opened we log a salted hash of the IP address (the raw IP is never stored), approximate location (country/city derived from network headers), browser type (user-agent) and referring page — used for abuse protection and the owner’s Share Activity panel (which shows country level only)
Payment information: Processed through Stripe; your card details are never stored on our servers

How We Use Your Data

To generate timestamped seal certificates
To protect the system against abuse
To manage billing and usage limits
To maintain security and audit logs

Zero-Knowledge Principle

End-to-end encryption is a choice you make per record, and it is not on by default. The contents of records you encrypt are encrypted client-side using AES-256-GCM and the key is held solely by you, so our servers store only ciphertext and cannot read them. Records you do not encrypt are stored as they are and are technically accessible to us. If you forget your password, encrypted data cannot be recovered.

Data Retention

Concrete retention periods:

Open (unsealed) bags: members — until you delete them; guests — auto-deleted after 30 days
Sealed records: kept while your account is active (no age-based deletion)
Cryptographic proof (hashes, timestamps, receipts): permanent — preserved even if content is deleted, so verification integrity survives
View records: 12 months, then deleted
Audit / security logs: 12 months
Share-link records: sensitive fields scrubbed on deactivation; anonymized after 12 months; deleted after 24 months
Backups: 30 days rolling
Billing records: retained as required by tax law

Your Rights

You may request a copy of your data (export)
You may request deletion of your account and data
You may request information about how your data is processed

Analytics

We use Google Analytics 4 (GA4) to understand how the site is used: page views, device type, and approximate region. Data is processed in an aggregated way; we do not use analytics for advertising. Known bots are excluded. You can opt out via the cookie banner (Decline).

Cookies

We use essential cookies (theme, language, session) and analytics (Google Analytics 4) for anonymous usage statistics. We do not use advertising cookies.

Legal Compliance

Our data practices are built around the GDPR (EU 2016/679) — the strictest widely-adopted privacy framework. We extend the same rights to all users worldwide, regardless of where you live.

Your rights include: access to your data, data portability, rectification, erasure, and the right to object to processing. You can exercise these rights from your account settings or by contacting us.

International Data Transfer

Your data is processed and stored on Google Cloud Platform infrastructure located in the United States (us-central1), and the data controller is established in the United States. For EU/EEA users, transfers rely on Google Cloud’s Standard Contractual Clauses (SCCs). By creating an account and using the service you consent to your data being processed in the United States. Encrypted-bag contents are end-to-end encrypted before leaving your device — we cannot read them regardless of where they are stored.

Technical Standards

VerityRecord uses the following cryptographic standards to ensure the integrity and authenticity of your sealed documents:

SHA-3 (SHA3-256) — NIST FIPS 202 compliant hash function for file fingerprinting
Merkle Tree — Cryptographic data structure for efficient multi-file integrity verification
RFC 3161 — Trusted timestamping via independent Time Stamp Authorities (FreeTSA, DigiCert, Sectigo)
AES-256-GCM — Client-side encryption for encrypted bags (zero-knowledge)

These standards ensure that sealed documents can be independently verified by any third party without relying on VerityRecord.

Data Controller

The data controller responsible for the processing of your personal data is:

Entity: Clinom Research Tech, LLC
Address: 1111B S Governors Ave, Suite 95697, Dover, DE 19904
Country: United States (State of Delaware)
EIN: 32-0842154
Contact:

Under GDPR Article 13, this information is provided to fulfill the obligation of informing data subjects about the identity of the data controller.

Age Requirement

You must be at least 18 years of age to use VerityRecord. If you are under 18, you may only use the service with the consent and supervision of a parent or legal guardian. We do not knowingly collect personal data from minors; where local law sets a higher age of digital consent, that higher age applies. If we become aware that a minor has provided us with personal data without parental consent, we will take steps to delete that information.

Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, United States. Any disputes arising from or in connection with this policy shall be subject to the exclusive jurisdiction of the courts of New Castle County, Delaware, United States. For EU users, this does not affect your rights under GDPR to lodge a complaint with your local data protection authority.

Contact

For privacy-related questions: