Privacy Policy

1. Who is responsible for your data

Verazo t/a Nexiel Limited ("Verazo," "we," "us," or "our") provides the Verazo platform and this website. For your account, billing, and marketing-site data, Verazo is the controller. Where your organization is a Verazo customer and stores its own compliance records, and any personal data inside them, in the Service, Verazo processes that data as a processor on your organization's behalf, and your organization is the controller of it, under the Terms of Service and, where one is in place, a separate Data Processing Agreement.

Company details, including the Companies Registration Office (CRO) number and registered office, appear in Company information below.

2. What Verazo collects, and why

Account and identity data

Your name, email address, and organization details, provided when you create a Verazo account through Verazo's own login system or when you are invited to join an existing organization. Used to identify you, secure your account, and operate the Service.

Billing data

Your billing contact details and subscription status. Verazo does not receive or store your card details. Payment processing is handled directly by Stripe, named as a subprocessor below.

Integration credentials

Any read-only token you explicitly provision for a connected system, for example GitHub, AWS, Okta, or Google Workspace. Encrypted at rest with AES-256-GCM, as described on the Trust Center, and used only to run the checks your organization configures.

Compliance content you create

Policies, control-check evidence and screenshots, the risk register, vendor and subprocessor due-diligence records, security-questionnaire answers, incident records, and the audit ledger itself, as described on the Trust Center. This may include personal data your organization includes in that content, for example a named individual in a policy or an incident record.

Usage and support data

Information generated by using the Service, including audit-ledger entries and log-in activity, and anything you send us directly, for example a support request.

Marketing website visitor data

This marketing website sets no analytics, advertising, or tracking cookie today, and has no signup form and no contact form that submits data to Verazo's own servers. The Contact page is a plain mailto: link that opens your own email client. Verazo never receives or stores anything from that page itself, only whatever email you choose to send. See the Cookie Policy for what this site stores and why.

3. Legal bases for processing

• Contract (Art. 6(1)(b) GDPR): creating and maintaining your account, and providing and billing for the Service.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the Service secure, preventing abuse, and understanding how the Service is used so it can be maintained and improved.
• Legal obligation (Art. 6(1)(c) GDPR): tax, accounting, and other records the law requires Verazo to keep.
• Consent (Art. 6(1)(a) GDPR): only where Verazo asks for it separately, for example a non-essential cookie category. None exists on this site today, see the Cookie Policy.

4. Verazo AI and your data

Verazo AI parses a natural-language request into a known control, narrates a finished check's result, drafts a first-pass policy or questionnaire answer, and drives a sandboxed browser session for the rare control with no API. Doing so can send the text of your request, and data read from a connected system, to Verazo AI's underlying provider, named in the subprocessor table below. None of these jobs runs a dedicated step to strip or redact personal data before the request is sent, and this is not yet a formal, verifiable feature.

A control's pass or fail status is always set by a deterministic check, never by Verazo AI, and a change to your organization's overall certification-readiness status requires a person to confirm it.

5. Subprocessors

A subprocessor is another company that processes personal data on Verazo's behalf. This list matches the Trust Center exactly.

Anthropic is named here, and on the Trust Center, as a matter of GDPR subprocessor transparency. Everywhere else on this site, Verazo's AI capability is described as Verazo AI.

6. International transfers

Hetzner processes data entirely within the EU. Anthropic and Stripe process data in the United States. Where personal data is transferred to a subprocessor outside the European Economic Area, Verazo relies on that subprocessor's Standard Contractual Clauses, or another valid transfer mechanism recognized under GDPR Chapter V, to cover that transfer.

7. Your rights

Under the GDPR, you have the right to access the personal data Verazo holds about you, correct it, ask for it to be erased, restrict or object to certain processing, and receive a portable copy of data you provided. Where processing relies on consent, you can withdraw that consent at any time.

If your organization is a Verazo customer, contact that organization first about a request concerning compliance content it controls in the Service. Contact us directly, using the details below, about anything Verazo controls itself: your account, billing, and marketing-site data, or if your organization cannot be reached.

You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie), or with the supervisory authority in your own EU member state.

8. Retention

Verazo keeps personal data only as long as needed for the purpose it was collected for, or as required by law. An accessibility violation's screenshot is kept for 10 years from the day it is captured, even after the violation is fixed, matching the evidentiary purpose of proving a violation existed and was remediated. A single published retention period covering every other record type does not exist yet, as also stated on the Trust Center. Contact us with any specific retention question.

9. Data Protection Officer

Verazo's Data Protection Officer can be contacted at DPO [at] nexiel [dot] ie with any question about this policy or about how your personal data is handled.

10. Cookies

This marketing website sets no analytics, advertising, or tracking cookie today. The cookie banner on this site stores a single choice in your browser's own local storage, on your device only. See the Cookie Policy for the full detail, including the one third-party request this site makes to load its fonts.

11. Children

The Service is intended for business use. Verazo does not knowingly collect personal data from anyone under 16 through this website, and creating an account means acting on behalf of an organization.

12. Changes to this policy

Verazo may update this policy from time to time. The date at the top of this page shows when it was last updated. For a material change, Verazo takes reasonable steps to notify you, by email or an in-product notice, before the change takes effect.