Legal
Data processing
Last updated: October 6, 2026. Draft, pending legal review.
Roles
For the inventory data you and your team enter (AI tools, answers, evidence, policies, training records), you decide why and how it is used and we process it on your behalf to run the Service. For our own account administration, billing and security, we decide. The privacy policy describes what we collect and why.
What is processed
Account details (name, email), the inventory content you enter, files and links you attach as evidence, an audit trail of changes, and technical data such as IP address for abuse prevention. We do not receive card details; Paddle handles payment. The free scope check at /check runs in your browser and sends us nothing.
Sub-processors
| Name | Purpose | Region |
|---|---|---|
| Vercel | Application hosting | EU region (project setting) |
| Neon | Database (PostgreSQL) | eu-central-1, Frankfurt, Germany |
| Clerk | Sign-in and account management | Hosted in the EU (see Clerk's documentation) |
| Paddle | Payments and billing, merchant of record | See Paddle's documentation |
| Resend | Review-reminder and notification email | Sends from an EU region |
| GitHub | Encrypted nightly database backups, kept 30 days | See GitHub's documentation |
Each provider's own sub-processor list is the authoritative detail for its infrastructure. Our team in India may access data to run the Service. If we add or replace a sub-processor we update this page.
Data processing agreement
If you need a signed agreement for your own compliance, write to contact@vritah.com. This page is a description, not an agreement.