Legal
Privacy policy
In short
- Verity is operated by Tamás Bakcsi-Kelemen, a private person in Romania, until the company that will sell it is founded.
- We use your email address to run your account or your founding reservation, and to email you about it. The server notes IP addresses to keep Verity secure.
- Your stock data is yours: we process it only to produce your reports.
- We do not sell data, we use no analytics and no advertising, and none of your data leaves the European Union.
- You can see, correct, download or delete your data. Write to hello@useverityapp.com.
1. Who we are
Verity, at useverityapp.com, is software that reports on a shop’s stock. It is operated by Tamás Bakcsi-Kelemen, a private person in Romania, until the company that will sell it is founded; this policy will name the company when it is. In this policy, “we” and “us” mean Verity’s operator, and “you” means anyone whose personal data Verity handles.
This policy covers the website, the tour, the founding list and Verity accounts. Accounts are not open to shops yet: they open with the paid plans.
2. Controller and processor
Verity handles two kinds of data, and our role is different for each.
| The data | Who decides what happens to it |
|---|---|
| Your personal data: your founding reservation, your account (the email address you sign up with, your password, your sessions), and what the server notes while you use Verity. | We do. For this data we are the controller. |
| Your stock data: the items, categories, stock movements and suppliers you import or enter. | You do. You decide what goes in and why; we store and process it only to produce your reports. For this data you are the controller and we are your processor. |
The data processing agreement for stock data will be published here before accounts open to shops. We have not appointed a data protection officer: write to hello@useverityapp.com about anything in this policy.
3. The personal data we collect
If you reserve a founding place
Your email address, the name you give for your shop, the size of catalogue you choose, and when you agreed to be emailed. You give them on the form, and nothing else is collected about you there. Nothing is reserved until you confirm from the email we send.
If you have an account
- Your email address, to sign you in and to tell accounts apart. It is stored in lower case. Your workspace is named with a generated identifier, never with your email.
- Your password, never stored. We keep a salted scrypt hash of it, which can confirm a password but cannot be turned back into one.
- When the account was created, and when you last signed in.
- Your sessions: see Cookies.
We do not ask for your name, phone number, postal address or payment details.
Your stock data, which we process for you
Items, with their prices and quantities; categories; and stock movements. It is business data about products, not about people. Verity never asks for your customers’ names, emails or addresses.
One exception is yours to control. The supplier and location fields are free text. If you put a person’s name in one, such as a sole trader you buy from or a colleague’s desk, that becomes personal data you have chosen to store, and you are its controller.
Suppliers, and the people at them. You can record the companies you buy from (name, address, VAT number, lead time, order rules) and contacts at them: a name, an email address, a phone number and a job title. Those contacts are personal data about those people. You decide what to record and you are its controller; Verity only stores it, and never contacts or emails them. It is kept in its own table, apart from the company, so it can be shown, included in your data export and deleted on its own. No report or chart can read it.
Each workspace also keeps its settings: its timezone, its currency, and how its screens are laid out.
What the server notes while you use Verity
- Your IP address, and the email address you sign in with, to slow down password guessing. Attempts to sign in, sign up, reset a password and the like are counted per IP address, and attempts to sign in, reset a password or reserve a founding place per email address. A count is kept under a code made from the address with a secret key, never the address itself.
- The web server’s access log. Each request is logged with the IP address, the time, the address requested and the name your browser gives itself (its user agent).
- The application’s own log. Which page or report was asked for, how it was answered and how long that took, and, when something fails, the error with a short reference you can quote to us. It records no IP address, no email address, no search or filter terms, and nothing from what you send.
- The emails we send you. Each one waits in a queue, with the address and what it says, until it is sent.
- Blocking abuse. An address that fails to sign in again and again is blocked for a while, and so is one that probes for known weaknesses.
If you take the tour
The tour opens Verity on an invented example shop. It asks for no account and no email address, and nothing in the example shop can be changed. It uses the session cookie (section 6), and starting a tour is counted per IP address, at most 10 times in 10 minutes, under a code made from the address with a secret key, never the address itself.
4. How we use it, and our legal basis
For each use of personal data, the law asks us to name what allows it (GDPR Article 6). We use your data for nothing this table does not list.
| What for | The data | Legal basis |
|---|---|---|
| Reserving your founding place, confirming it, and emailing you about the founding offer and when plans open | Email address, shop name, catalogue size, when you agreed | Your consent (Art. 6(1)(a)), given on the form. You can withdraw it at any time, with the link in our email or by writing to us, and the reservation is deleted there and then. |
| Running your account: signing you in, password resets, address confirmations and notices about your account | Email address, password hash, dates, sessions | Our contract with you (Art. 6(1)(b)): the service you signed up for. |
| Slowing down password guessing, and blocking abuse | IP address; the email address you sign in with, as a code | Our legitimate interest (Art. 6(1)(f)) in keeping accounts and the service secure. |
| Running the server, and finding and fixing faults | The access log and the application’s log | Our legitimate interest in keeping Verity working. |
| Recovering from a failure or a loss of data | The database backups | Our legitimate interest in keeping everybody’s data recoverable. |
| Recording what was done to each account, and each file uploaded | The account, named only by a code; what was done, and when | Our legitimate interest in being able to show what happened to an account. |
| Running the tour | The tour’s session cookie; your IP address, as a code | Our legitimate interest in letting anyone try Verity without an account, without it being overrun. |
| Storing your stock data and producing your reports | Your stock data, with any supplier contacts in it | We process it on your behalf, as your processor (Art. 28), so what allows it is yours to decide. |
5. What you have to give us
Nothing, to visit the site: the server receives your IP address, as every web server does. Without an email address we cannot reserve a founding place or make an account, and a reservation also needs the shop name and the catalogue size. Everything else in an account is yours to add or leave out.
6. Cookies
Verity sets one cookie: your session. It is what keeps you signed in, so it needs no consent banner. Page scripts cannot read it (HttpOnly), it is sent only over an encrypted connection (Secure), and it is not sent along when another site links to this one in the background (SameSite=Lax). We store only a SHA-256 digest of it, so even a copy of our database could not be used to sign in as you.
The cookie lasts 14 days from signing in. On our side, a session also ends after 14 days without use, and after 90 days whatever happens. Signing out ends it at once. The tour uses the same cookie, for a session into the example shop, stored the same way.
Your browser also keeps a few preferences in its local storage, such as your light or dark choice, so pages open the way you left them. The cookie policy lists the cookie and each of these by name.
No analytics, no advertising, no tracking, and no third-party scripts or fonts. Every page loads only from Verity’s own address, and the browser is told to refuse anything else.
7. Who we share it with
| Who | What for | Where | What they receive |
|---|---|---|---|
| RoLeaf | Hosting: it runs the server Verity and all its data are on, as our sub-processor | Romania | Everything stored on the server |
| mailbox.org (Heinlein Hosting GmbH, Berlin) | Sending Verity’s emails: password resets, address confirmations, notices about your account, and the founding list’s | Germany | The address each email goes to, and what it says |
Nobody else receives your data. We do not sell or share it, and we give it to a public authority only when the law obliges us to. A payment provider will be added when paid plans open. None is used today, and this policy will name it before it receives anything.
8. Transfers outside the European Union
None. Your data stays in the European Union: the server is in Romania, the mail service in Germany, and the copies of the backups on our own computer in Romania.
9. How long we keep it
| The data | How long |
|---|---|
| A founding reservation you have not confirmed | 48 hours, then it is deleted. |
| A confirmed founding reservation | Until you leave the list, which deletes it at once. Otherwise until plans open, and for the 14 days that email gives you to start a plan; then it is deleted, unless you have started one. |
| A count against password guessing | At most 60 minutes, deleted no more than 5 minutes after its time is up. |
| A block on an address | 1 hour for failing to sign in again and again; 24 hours for probing for weaknesses. |
| The access log and the application’s log | At most 12 months. |
| An email waiting to be sent | Until it is sent: normally within seconds, and never after its link has stopped working, or 24 hours for a notice. Then the address and what it says are wiped. Which kind of email it was, and when, is kept without the address; for an account, until the account is deleted. |
| A tour session | 30 minutes. In its last 5 you can keep it going for another 30. |
| Your account | Until you delete it (below). |
| Stock movements | 730 days, then deleted automatically, every day. That is the longest period any report can show. |
| Items, categories, suppliers and their contacts, and settings | As long as your account exists. A contact you delete is deleted outright. |
| A file you upload | Not kept. It is read in memory, and only its rows are stored, with its column headings, so that the next file with the same columns maps itself. |
| The record of what was done to an account, and of each file uploaded | 3 years from each entry. It names an account only by a code that cannot be read without a separate key, and a file without its name or column headings. |
| Backups of the database | 14 days. The copies on our own computer are deleted after the same 14 days, except that the newest 3 are kept until newer ones arrive. The hosting provider’s image of the whole server is kept for a week, and always at least the last three. |
When you delete your account
You can delete your account yourself, from Account settings. Asking needs your password again, and it signs you out everywhere at once. For 14 days after that the account is locked: you can still sign in to cancel the deletion or to download a copy of your data, but nothing else. Signing in does not cancel it; only cancelling does.
When those days are up, your workspace and every row of stock data in it are deleted, along with your sign-in, settings, saved charts, column mappings and API keys. Your email address is then kept in no table at all. Each workspace’s stock data lives in its own database schema, so deleting a workspace removes it in one step, with nothing left behind in a shared table. Copies inside backups expire with those backups. If a backup is ever restored, every deletion made after it was taken is carried out again before Verity is opened to anyone.
10. How we protect it
- Every page is served over an encrypted connection.
- Passwords are hashed and sessions are stored as digests, so neither can be read back out of the database.
- Each workspace’s data is in a schema of its own, so one account’s query cannot reach another account’s data.
- Each backup is encrypted before it is written, to a key that is not kept on the server.
If a security breach affects your personal data, we tell you without undue delay, and the Romanian data protection authority within 72 hours where the law requires it. If it affects a shop’s stock data, we tell the shop.
11. Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you, and have a copy of it;
- have it corrected;
- have it deleted;
- restrict how it is used;
- receive it in a portable form;
- object to a use that rests on our legitimate interest;
- withdraw a consent you gave, at any time. For the founding list, the link in our email does it at once.
Write to hello@useverityapp.com. We answer within one month. You can also download all of your account’s data at any time, as one file, from Account settings (Download your data).
If a shop has put your details into Verity, as a supplier contact for example, the shop decides what happens to them, so write to the shop. A request that reaches us instead is passed on to it.
12. Complaints
If you believe we have handled your data unlawfully, you can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro, or to the authority of the country where you live or work.
13. Automated decisions
Nothing about you is decided automatically. Verity’s reports make judgements about products, such as which stock is dead and which is in excess, never about people.
14. Changes to this policy
When this policy changes, the date at the top changes with it. If a change affects how we use data you have already given us, such as the company that will sell Verity taking over from its operator, we tell you by email before it applies.
15. Contact
Write to hello@useverityapp.com about anything in this policy. The legal notice gives the operator’s details.