Privacy policy

Data Controller

The controller of your personal data is Vericto S.A.S., Tax ID (NIT) 902.100.599-0 (hereinafter, "Vericto"), domiciled in Bogotá D.C., Colombia. For any query relating to the processing of your data, or to exercise your habeas data rights under Law 1581 of 2012, you can contact us at privacy@vericto.com.

Data collected

Vericto collects four categories of data:

1. Account data

• Email: for authentication, transactional notifications and service communications.
• Workspace name: identifier of the project or environment.
• Billing information: processed directly by the payment processor (Paddle). Vericto never receives or stores card numbers; it keeps only the customer and subscription identifiers the processor returns, plus invoice metadata (amount, currency, date, status).
• IP address and user agent: recorded on each session for security and rate limiting.

2. Product usage data

• Database connection strings: stored encrypted with AES-256-GCM. Used only to establish the proxy connection.
• Text of intercepted SQL queries: stored encrypted in the audit trail. Retained according to your plan (7-90 days). Accessible only to workspace members.
• Query metadata: timestamp, dialect, decision (BLOCKED/ALLOWED), triggered rule, latency, AST node. Not encrypted; used for dashboard metrics.
• Rule configuration: active standard rules and custom rules defined by the user.

3. Telemetry data

• Website and dashboard usage (vericto.com and app.vericto.com): pages visited, time on site and the key sign-up steps (sign-up, first query evaluated, checkout start and purchase), measured with Google Analytics 4 only if you accept analytics cookies in the banner. In the dashboard they are tied to an opaque internal id of your account, never to your email.
• Where your sign-up came from: when you create the account we store which campaign or site brought you: the link's utm_* parameters, the ad click id if any, the referring domain and the landing page, of the first and the last campaign visit. It holds no personal data and only serves to measure which channels bring customers. Kept while the account exists and deleted with it.
• Errors and exceptions: recorded in the backend's operational logs (Amazon CloudWatch), kept for 90 days. Logs do not include the text of your queries.

4. Contributor License Agreement (CLA) signatures

• Only if you contribute to a Vericto project on GitHub: signing the Contributor License Agreement records your GitHub username, the name and email you enter, the date and time of signing and the version signed.

4. Site assistant and contact form

• Conversations with the vericto.com assistant: the question you type, the answer, the page you ask from and a random session identifier (30 minutes). No cookies are used and no personal data is needed to use the assistant, and we ask you not to type any. We do not store your IP: only a value derived from it with a key that changes every day, used to detect abuse, which cannot be turned back into the IP or linked across days.
• Questions sent to the team: if you choose to get a reply by email, your email and, if you provide them, your company, role and database engine, together with your question and the conversation with the assistant. Only with your explicit consent, of which we keep the accepted text, its version and the date.

Data usage

We use your data exclusively for:

• Service delivery: intercepting and analysing SQL queries, maintaining the audit trail, sending block notifications.
• Security: detecting unauthorised access, preventing abuse, rate limiting.
• Product improvement: aggregated, anonymised analysis of usage patterns to prioritise features. Never individualised analysis without consent.
• Transactional communications: verification emails, password recovery, quota alerts, invoices. We do not send marketing emails without explicit consent.
• Technical support: when you contact support, we may access your workspace metadata (not the content of your queries) to diagnose the issue.
• Campaign measurement: knowing, in aggregate, which channels (LinkedIn, X, newsletters, communities) bring sign-ups, active accounts and customers. The attribution cookie and Google Analytics rely on your consent; the origin carried in the sign-up link itself, on our legitimate interest in measuring our campaigns, disclosed in this policy, which you accept when you sign up.
• Site assistant: answering your questions from Vericto's documentation, reviewing every week the questions it could not answer to improve the site's content, and preventing abuse. Answers are generated by an AI model and may contain errors. If you send us your question, we use it only to reply to you.
• Contribution records: keeping proof of the licenses that contributors to Vericto projects grant through the CLA.

We never sell your data to third parties. We never use the content of your queries to train AI models.

Data retention

Data type	Free Plan	Builder Plan	Team Plan	Enterprise
Query text and metadata (audit trail)	7 days	30 days	90 days	Configurable
Account data	Until cancellation + 30 days
Access logs (IP, user agent)	90 days
Conversations with the site assistant	30 days (deleted in the next weekly cleanup: at most 37 days)
Questions sent to the team from the site	12 months
Billing data	7 years (legal obligation)
CLA signatures	As long as the contributions they cover are distributed

Upon cancelling your account, all your data is permanently deleted within a maximum of 30 days, except billing data which we must retain due to legal obligations.

Third parties and subprocessors

Vericto uses the following subprocessors to provide the service:

• Supabase (PostgreSQL) (United States, us-east-1): storage of account data, audit trail and configuration.
• Amazon Web Services (United States, us-east-1): backend and API hosting, secrets management and operational logs. Also Amazon Bedrock, which runs the site assistant (Anthropic and Cohere models served by AWS in us-east-1, us-east-2 and us-west-2). Bedrock does not share questions or answers with the model providers and does not use them to train the models.
• Paddle.com Market Ltd (United Kingdom): payment processing as merchant of record. Receives your email, name, country and payment details to issue the invoice and calculate taxes. Acting as the authorised reseller, Paddle processes that data as an independent controller, subject to its own privacy policy. Transfers outside the EEA are covered by the UK standard contractual clauses.
• Upstash (Upstash, Inc., United States, primary region us-east-1): Redis database for the rules cache, usage limits, failed-login lockout and temporary login state. It stores identifiers and counters, not the content of your queries.
• GitHub (GitHub, Inc., United States): sign in with GitHub, only if you choose it. We receive your GitHub email and username.
• Resend (United States): delivery of transactional emails (account verification, invitations, alerts, password recovery). Receives only the destination address and the message content.
• Cloudflare: CDN and DDoS protection. May process source IPs. With Cloudflare Turnstile it checks that whoever uses the assistant or the contact form is a person; Turnstile does not use cookies. On this site, Cloudflare Web Analytics measures visits in aggregate (page views, country, browser and load performance) without cookies or persistent identifiers, and it is not used to track you across sites.
• Google Analytics 4 (Google LLC, United States): website and dashboard usage measurement, only if you accept analytics cookies. If you accepted them, our server also sends it the first query evaluated, the purchase of a plan (amount, currency and plan) and its cancellation, with your pseudonymous Google Analytics id. No Google Signals or ad personalisation; GA4 does not store IP addresses.
• CLA Assistant (a service of SAP SE, Germany): only for people who contribute to a Vericto project. Records Contributor License Agreement signatures; the data is stored on Microsoft Azure, in Europe, subject to CLA Assistant's privacy statement.

The TCP proxy runs in your own infrastructure and you operate it: Vericto does not host it and has no network access to your databases.

All subprocessors are subject to data processing agreements (DPA) and comply with GDPR, except CLA Assistant, which operates under its own privacy statement.

Your rights under GDPR

If you are a resident of the European Economic Area, you have the following rights:

• Access: you can request a copy of all the personal data we hold about you.
• Rectification: you can correct inaccurate data directly in your account settings or by requesting it via email.
• Erasure ("right to be forgotten"): you can request deletion of your data. Billing data is retained as a legal obligation for the period stated in the retention table.
• Portability: you can export your data in JSON format from the dashboard (audit trail, rule configuration).
• Objection: you can object to the processing of your data for usage analytics. This does not affect how the service works.
• Restriction: you can request restriction of processing while a dispute about data accuracy is resolved.

To exercise any of these rights, write to privacy@vericto.com. We will respond within a maximum of 30 days.

If you believe that the processing of your data does not comply, you may file a complaint with the Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, at www.sic.gov.co. If you reside in the European Economic Area or the United Kingdom, you may also complain to the supervisory authority of your country of residence.

Your rights under CCPA (California residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: you can request information about the categories of personal data we collect and who we share it with.
• Right to delete: you can request deletion of your personal data, subject to applicable legal exceptions.
• Right to non-discrimination: we do not discriminate against users who exercise their CCPA rights.
• Right to opt out of sale: Vericto does not sell personal data. The sale opt-out mechanism does not apply.

Cookies

Vericto uses the following cookies:

• Session cookies (essential): authentication JWT in an httpOnly cookie. Required for the service to work. Cannot be disabled.
• Language preference cookie (functional): vericto-locale, with a 1-year lifetime. On the public site it is only created if you change the language using the selector; it is never inferred from your location or your browser settings. Our server reads it to open the page in the language you chose. It is not a tracking cookie and is not shared with third parties. You can delete it from your browser and the site will keep working in English.
• Preferences stored in your browser (not cookies): the dashboard stores your theme (vericto-theme), language (vericto-locale), time zone (vericto-timezone) and time format (vericto-time-format) in localStorage. If you are signed in, these preferences are also linked to your account so they follow you across devices.
• Analytics cookies (Google Analytics 4): _ga and _ga_*, 2 years. Only set if you accept them in the consent banner; you can withdraw consent at any time from "Cookie preferences", in the footer of every page. Details in the cookie policy.
• Campaign attribution cookie (analytics, first-party): vericto_attr, 90 days. Remembers the first and the last campaign that brought you, to link it to your account if you sign up. Only set if you accept analytics, it holds no personal data and no third party reads it. The vericto_consent cookie (necessary, 6 months) stores your choice for vericto.com and app.vericto.com.

We do not use advertising or cross-site tracking cookies.

Contact the DPO

For any privacy inquiry, exercise of rights, or security incidents related to personal data, contact our Data Protection Officer:

• Email: privacy@vericto.com
• Response time: maximum 30 calendar days
• Languages: Spanish, English

For security incidents that may affect personal data, write to security@vericto.com. We respond in less than 48 hours.