Privacy Policy

Effective October 13, 2026

This Privacy Policy explains how Optivus Corporation Private Limited (“we”, “us”) collects, uses, stores, and shares information when you use Veritas (the “Service”), available at getveritas.io. We have written this policy to be clear and specific, and updated it as our systems evolve; the latest version always lives at this URL.

1. Information we collect

1.1 Information you provide

• Account details — name, email address, password (hashed), and profile image when you sign up through our authentication provider, Clerk.
• Organization details — company name, website URL, industry, and the brand assets (logos, colors, descriptions) extracted during onboarding.
• Uploaded content — documents (PDF, DOCX, PPTX, TXT, MD), images, and any text you submit to generate content or build your knowledge base.
• Billing information — processed by Razorpay. We store invoice history, seat events, and payment references; we do not store full card numbers or CVV.

1.2 Information generated by your use of the Service

• Chat messages, prompts, and AI-generated responses.
• Knowledge graph nodes and relationships we extract from your content.
• Learning path progress, assessment answers, certificates, and activity logs.
• Audit logs of administrative actions (role changes, invitations, deletions).

1.3 Information collected automatically

• Session cookies set by Clerk to keep you signed in.
• Server logs (IP address, user agent, request URL, timestamp) retained for operational and security purposes.
• Error telemetry if the Service encounters an unexpected failure.

1.4 The free website scan

You can scan a website on getveritas.io without an account. For each scan we collect:

• The website address you enter, and what the scan finds on that website’s public pages.
• Your IP address, used only to limit how many scans one visitor can start in a day. It is removed from the scan when the scan finishes.
• If you then create an account to open the full report: the email address on that account, the website you scanned, and when. We email you the report and keep this record so we know which scan you signed up from.

2. How we use your information

We use the information we collect to:

• Provide and operate the Service (authentication, content generation, knowledge graph construction, learning).
• Process payments and send billing communications.
• Send transactional emails (invitations, notifications, security alerts, and the report from a free scan).
• Limit how many free scans one visitor can start, so the scan stays available to everyone.
• Monitor and improve reliability, performance, and security.
• Analyse conversations with Vera, the in-app assistant, to improve its answers (see Section 3.1).
• Comply with legal obligations (tax, audit, lawful requests).

We do not sell your data, use it to train third-party AI models beyond the per-call processing described below, or serve you advertising based on it.

3. AI processing — how your content is used with OpenAI

Veritas uses OpenAI as its AI model provider. When you interact with features that involve AI (chat, content generation, knowledge extraction, learning path generation, role-play, SEO analysis), we send relevant context from your account to OpenAI’s API for processing. This includes, depending on the feature:

• The prompt or question you submitted.
• Relevant excerpts from your knowledge base or uploaded documents.
• Your company profile and brand DNA.
• Prior chat messages in the current conversation.

OpenAI processes this data according to their API data usage policy. OpenAI does not use API inputs or outputs to train their models. Data sent to the API may be retained by OpenAI for up to 30 days for abuse monitoring before being deleted.

If your organization requires zero-retention processing, please reach out through your Veritas account administrator to discuss enterprise arrangements.

3.1 Conversations with Vera, the in-app assistant

When you chat with Vera, the messages you send and Vera’s replies are saved with your account so you can come back to them. Your chats are visible only to you, not to others in your organisation. A chat is kept for 90 days after it was last used, and you can delete it sooner.

We may use the messages you send to Vera, and Vera’s replies, for analytics, to find and fix wrong or unhelpful answers, and to improve the assistant.

We do not use your conversations to train AI models. Please do not put passwords, payment card details or other people’s sensitive personal information in a chat.

4. Sub-processors

We rely on a short list of carefully selected service providers to operate Veritas. Each receives only the data necessary for their function and is bound by their own security and privacy commitments.

• Clerk (clerk.com) — authentication, session management, and user/organization identity.
• OpenAI (openai.com) — AI model inference and embedding generation. See Section 3.
• MongoDB Atlas — primary database for user, organization, content, and billing data.
• Neo4j — graph database for knowledge graph storage (for select tenants).
• Amazon Web Services (S3) — object storage for uploaded documents and images.
• Razorpay (razorpay.com) — payment processing for subscriptions and invoices.
• SendGrid (sendgrid.com) — transactional email delivery.
• DataForSEO (dataforseo.com): search rankings, backlinks and competitor data for the websites you scan or set up. It receives website addresses and search terms, not your account details.
• Google (PageSpeed Insights): page speed measurement during a scan. It receives the address of the page being measured.
• PostHog (posthog.com): product analytics, including for the Vera assistant. See Sections 3.1 and 6. Data is stored in the United States.

We read the websites you scan or set up with our own crawler; no third party crawls them for us.

A current list of sub-processors is maintained on our Data Processing Agreement page.

5. Google user data (Search Console, Analytics & Business Profile)

Veritas offers optional integrations with Google Search Console, Google Analytics, and Google Business Profile to power its SEO features. You explicitly connect your Google account and choose which properties to use, and you can disconnect at any time.

• What we access — for the properties you select: Google Search Console data (search performance such as queries, clicks, impressions, and average position; URL indexing and coverage status; and your sitemaps) and Google Analytics (GA4) metrics such as traffic, channels, and engagement. Search Console access also lets Veritas submit and delete sitemaps on your properties, only when you initiate that action. If you connect Google Business Profile, we access your Business Profile accounts and business location listings (names, addresses, and listing details) to show which of your locations are on Google and where coverage gaps exist; changes to your listings are made only when you initiate them in Veritas.
• How we use it — solely to provide the SEO features you use in Veritas (performance dashboards, keyword-ranking and coverage reports, sitemap management, and AI-generated SEO recommendations). Where you use AI-powered SEO features, relevant Google data is processed by OpenAI as described in Section 3. We do not use Google user data for advertising, we do not sell it, and it is not used to train or improve any generalized AI/ML models.
• How we protect it — your Google OAuth token is encrypted at rest using authenticated encryption (AES-GCM), in addition to the general safeguards described in the Security section.
• Retention and deletion — we retain your Google data only while your Google connection is active. You can disconnect at any time from your SEO settings, which revokes Veritas’s access and deletes the stored token; deleting your account removes associated data as described in the Data retention and Your rights sections.

Limited Use. Veritas’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and tracking technologies

Veritas uses the cookies and similar technologies listed below. On your first visit we show a consent banner. The essential category always loads. Analytics and Marketing are on until you switch them off, except that in the European Economic Area, the United Kingdom and Switzerland, Marketing stays off until you switch it on. You can change your choice at any time with the button at the end of this section.

• Essential — a session cookie set by Clerk to keep you signed in. Required for the Service to function; cannot be disabled.
• Analytics (PostHog) — this category is on by default. PostHog records session replays and product usage events from the moment you arrive, so we can find where the product is confusing. You can switch it off at any time using the toggle in this section, and we stop immediately. Replays capture mouse movement, clicks, scrolling and text typed into forms, except in areas we exclude from recording entirely: sign-in and sign-up, billing and checkout, onboarding, settings, profile, and any page displaying your own content or knowledge base. Password fields are never recorded anywhere. While you are signed in, this activity is linked to your user account and your organisation. PostHog is operated by PostHog, Inc., stores this data in the United States, and is governed by the PostHog Privacy Policy.
• Analytics (Google Analytics) — on our public pages only (the homepage, pricing, features, tools, blog and other marketing pages, not inside the signed-in Service or in tools embedded on other websites), Google Analytics 4 measures visits, the pages viewed and where visitors came from. It sets first-party cookies named _ga and _ga_* and follows the same Analytics choice as PostHog: on by default, and switching Analytics off stops it. Google’s advertising features follow the Marketing category below. Google Analytics is operated by Google LLC and is governed by the Google Privacy Policy.
• Marketing (LinkedIn Insight Tag and Meta Pixel) — this category is on by default, except in the European Economic Area, the United Kingdom and Switzerland, where it is off until you opt in. LinkedIn’s Insight Tag and the Meta Pixel allow us to measure the effectiveness of our advertising on LinkedIn, Facebook and Instagram and build retargeting audiences from visitors to our site. The Meta Pixel runs on our public pages only, never inside the product. While Marketing is on, Google Analytics may also use its advertising features. You can switch Marketing off at any time, or choose Reject in the banner, and we stop immediately. The Insight Tag is operated by LinkedIn Corporation and is governed by the LinkedIn Privacy Policy. The Meta Pixel is operated by Meta Platforms, Inc. and is governed by the Meta Privacy Policy.

Choosing Reject in the banner, or switching a category off, stops that category at once. Your choice is stored in your browser’s local storage on this device only.

Manage cookie preferences

7. Data retention

We retain data for the periods below, unless you request earlier deletion:

• Account and organization data: for as long as your account is active.
• Uploaded content and generated artifacts: for as long as your account is active, or until you delete them.
• Billing records and invoices: 7 years (required by applicable tax law).
• Server logs: 90 days.
• Free scan results: 30 days.
• Copies of the pages a scan or setup read: 7 days.
• Setup data from a sign-up that never starts a plan: 7 days.
• The record that you opened a scan report (your email, the website, and when): 12 months after your last scan.
• AI prompts/responses forwarded to OpenAI: up to 30 days on OpenAI’s side (per their policy).

8. Your rights

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data (subject to retention periods above).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.

You can delete your account at any time from your account settings. Organization administrators can delete an entire organization from the admin panel, which purges all tenant data. For any other request, please contact your organization administrator, who can raise it with us on your behalf.

9. International data transfers

Veritas is operated from India. Our sub-processors are located in multiple regions, including the United States and the European Union. When you use the Service, your data may be transferred to, stored in, and processed in these regions. Where required by applicable law, we rely on appropriate safeguards (standard contractual clauses or equivalents) for cross-border transfers.

10. Security

We maintain technical and organizational measures to protect your data, including:

• TLS encryption in transit.
• Encryption at rest for databases and object storage.
• Role-based access controls for administrative actions.
• Per-tenant isolation (separate databases per organization).
• Audit logging of privileged actions.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you in accordance with applicable law.

11. Children

Veritas is a B2B SaaS product intended for use by businesses and their employees. We do not knowingly collect data from anyone under 16. If you believe we have collected such data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via email to account administrators at least 14 days before taking effect. The most recent version is always available at this URL with an updated effective date.

13. Contact us

Questions about this policy or our data practices? Optivus Corporation Private Limited is headquartered in New Delhi, India. For now, please route inquiries through your Veritas account administrator; a dedicated data-protection contact address will be published here in a future revision.