Privacy Policy

We keep only what is needed to run the chat product:

• Account data: your email address (required for magic-link sign-in), and optionally a display name and avatar URL.
• Chat data: the messages you send, the AI responses, and any images or CVs you attach.
• Usage data: IP address, browser user-agent, request timestamps, and approximate AI token usage and cost per request.
• Cookies: a single session cookie after you sign in. We do not use third-party advertising or analytics cookies.

We do not knowingly collect data from anyone under 16.

• Provide the service: authenticate you, return search results, persist your chat history, populate your sidebar.
• Operate and improve: debug failures, monitor cost, prevent abuse.
• Communicate: send magic-link sign-in emails and service notifications. We do not send marketing email without your consent.

We do not sell your personal data. We do not share it with advertisers.

To run the product, Verodian sends limited data to the following processors. Each acts on our instructions under their own privacy terms:

• Neon — Postgres database; stores accounts, chats.
• Vercel — web hosting and Blob storage for uploaded chat images.
• Render — hosts the API.
• GitHub Actions — runs scheduled background jobs.
• Cloudinary — hosts profile avatar uploads.
• Brevo — delivers transactional email (magic links and service notifications).
• Upstash — Redis for response caching, rate-limit counters, and operator-alert de-duplication.
• Anthropic and OpenRouter— AI model providers. Your chat content is sent to a frontier model to generate the assistant’s response. We do not opt in to AI training on your data.

• Chat history: kept until you delete it or your account.
• Magic-link tokens: expire 15 minutes after issuance and are deleted after use.
• AI call logs: kept for 90 days for cost analysis, then aggregated.
• Server logs: kept for 30 days.

Under the Nigeria Data Protection Regulation (NDPR), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (you can edit your profile at /profile).
• Delete your account and associated chat history.
• Object to processing or withdraw consent.
• Receive a copy of your data in a portable format.

Email support@verodian.com to exercise any of these. We respond within 30 days.

All traffic is over HTTPS. Passwords do not exist — sign-in is magic-link only, with 15-minute token expiry. Session cookies are HttpOnly, Secure, and SameSite=Lax. No system is perfectly secure, but we take reasonable steps to protect your data.

Some processors above (Anthropic, Vercel, Cloudinary) operate from the United States or European Union. Where data leaves Nigeria, we rely on the processors’ standard contractual clauses and equivalent safeguards.

We may update this policy as the product evolves. Material changes will be announced by email or in-product before they take effect. The “Last updated” date above always reflects the current version.

support@verodian.com