Privacy Policy

VERO OS is operated by Individual Entrepreneur V.E.R.O., registered in the Republic of Kazakhstan (the “Company”, “we”). Questions about this policy and any request about your data — support@vero.industries.

Who the controller is, precisely. Individual Entrepreneur V.E.R.O., notification of commencement of activity no. KZ23UWQ08482620. Address: Almaty, Republic of Kazakhstan. Phone +7 771 109 4453, email support@vero.industries.

Two different roles, and the difference matters. For the account data of our own users we are the controller: we decide why and how it is processed. For the data you put into the product about your own customers — CRM records, invoices, contracts — you are the controller and we are the processor: we act on your instructions. If one of your customers asks about their data, that request belongs to you, and we will help you answer it.

• Account data: name, email, password (stored and processed by Clerk, not by us directly).
• Business data: company profile, CRM records, financial records, invoices and contracts, documents and files, the address of a connected website — everything you enter for the product and its AI agents to work.
• Payment data: handled solely by Paddle. We do not store card numbers.
• Usage data: which modules and features you use, to calculate plan limits.

Where the GDPR or the UK GDPR applies, we rely on the following grounds under Article 6:

• Performance of a contract — to run the platform: carrying out agent assignments, providing access, calculating allowances, billing and notifications (see the Terms of Service).
• Legitimate interests — to keep the service secure, prevent abuse, and improve the Company’s own technology, subject to the safeguards below.
• Legal obligation — to keep records we are required by law to retain, such as payment history.

The Company may use data processed in the service to develop and improve VERO’s own technology, including training the Company’s internal AI models, so the system understands its customers’ businesses and industries better. Strict safeguards apply:

• Data does not leave the Company. It is never sold or handed to third parties and is never used to train anyone else’s models.
• Individuals are de-identified. Before any use in training, direct identifiers — names, phone numbers, email addresses — are removed or replaced with de-identified labels.
• Third-party AI providers do not train on your data. Model providers (clause 4) receive only the text of a specific request at the moment it runs and are contractually barred (DPA) from using it to train their models.
• You can opt out. Write to support@vero.industries to exclude your account’s data from training our internal models. It does not affect how the service works for you.

Data is processed only by sub-processors that are technically necessary for VERO OS. Each one sees a narrow slice, not the whole database:

• Clerk (USA) — authentication only: login, email, password. No access to CRM, finance or documents.
• Neon (USA) — hosts the application database, encrypted at rest; no application-level access.
• Paddle (United Kingdom / EU) — payment data only; acts as Merchant of Record. No access to CRM or agent content.
• Anthropic (USA) — sees only the specific text an agent processes at the moment of a request, never your database.
• Vercel (USA and other regions) — hosting of the application code.
• Inngest (USA) — scheduling and execution of background jobs.

Each holds an independent security certification (SOC 2 or equivalent) and is bound by a data processing agreement not to use your data for its own purposes. We never sell data and never pass it to anyone outside this list.

Part of the VERO OS infrastructure is located outside the Republic of Kazakhstan and outside the EEA — mainly in data centres in the United States (the Neon database, Vercel hosting, Anthropic request processing).

Where personal data of individuals in the EEA or the UK is transferred, the transfer relies on the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (and, for the UK, the IDTA or the UK Addendum), and, where the provider is certified, on the EU–US Data Privacy Framework. Clerk, Vercel and Paddle publish their data processing agreements and the transfer mechanisms they use. All transfers are encrypted in transit (TLS).

Data is encrypted in transit (TLS) and at rest at the database level. We keep your data while your account is active. After an account is deleted, data is erased within 30 days, except records we are required by law to retain, such as payment history.

Where the GDPR or the UK GDPR applies, you have the right to: access your data; have it corrected; have it erased; restrict processing; object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent where processing is based on it. Withdrawing consent does not affect processing carried out before withdrawal.

To exercise any of these rights, write to support@vero.industries. We reply within 14 days, and in any event within one month where the GDPR sets that period.

You also have the right to lodge a complaint with a supervisory authority — the data protection authority of your country of residence, or the Information Commissioner’s Office in the United Kingdom.

If the data concerns a customer of one of our clients, the request should go to that client, who is the controller. Tell us and we will pass it on.

If a breach occurs that is likely to result in a risk to people’s rights, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, and we inform affected individuals where the risk is high. Where we act as a processor for one of our clients, we notify that client without undue delay so they can meet their own deadline.

We use only what is strictly necessary for the service to work: authentication and session (Clerk), the selected workspace, and the interface language. No advertising or tracking cookies are set. Analytics cookies are not placed without your consent.

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16 years of age.

We give at least 14 days’ notice by email before a material change takes effect. This policy exists in Russian and in English; where the two differ, the Russian version prevails, as the language of the Company’s place of registration.