Privacy Notice

Version 1, 30 September 2026. This notice explains what personal data Verithink collects, why, where it goes, and your rights.

1. Who is responsible

Nanu Ltd, registered in England and Wales (company number 14443667), 167-169 Great Portland Street, 5th Floor, London W1W 5PF, is the data controller for Verithink. Contact: contact@nanu.tech.

2. What we collect

• Account data: your email address, the name you give us, when the account was created, and your plan.
• Your content: the text you submit for evaluation and the assessments we produce, saved in your library until you delete them.
• Usage data: the number of evaluations you run each period and the timestamps of your requests, to apply your plan's allowance and keep the service secure.
• Billing data: if you buy a plan, Stripe tells us your Stripe customer reference, your subscription status and renewal date. We never receive your card number.
• Technical data: standard server logs (IP address, browser type, request time) kept for security and troubleshooting.

3. Why we use it and on what legal basis

• To provide the service you asked for, including producing assessments, keeping your library and running your subscription: performance of our contract with you.
• To keep the service secure, prevent abuse and fix problems: our legitimate interests in running a safe, reliable service.
• To keep billing and tax records: our legal obligations.
• To email you about the service: notices about your account, plan or changes to terms are part of the contract. Marketing email would only ever be sent with your consent, and we do not send any today.

We do not use your content to train AI models, we do not profile you, and we do not sell personal data.

4. Who processes it for us

We use a small number of providers, each bound by a data-processing agreement and acting only on our instructions:

• Microsoft Azure hosts the application and your data (account, library, usage) in the United Kingdom. The text you submit is evaluated by an Azure OpenAI model deployed in Microsoft Azure, under Microsoft's terms for that service: prompts and outputs are not used to train models. Microsoft may retain prompts and outputs for up to 30 days for abuse monitoring, as described in its Azure OpenAI data policy.
• Microsoft Entra External ID handles sign-in: it processes your email address to send the one-time code and to verify it.
• Stripe handles payments as the merchant of record and processes your payment details under its own privacy policy. We receive only your customer reference, subscription status and email.

Where a provider processes data outside the United Kingdom, the transfer is covered by the UK's approved safeguards (the International Data Transfer Agreement or an adequacy decision, together with the provider's standard contractual clauses).

5. Cookies

The app sets one strictly necessary cookie to keep you signed in. It is scoped to verithink.ai, not readable by other sites, and expires when your session ends. We do not use advertising or cross-site tracking cookies.

6. How long we keep it

• Your library stays until you delete individual evaluations or your account.
• Account data stays while your account exists. When you ask us to delete your account we remove your account, library and usage data within 30 days; backup copies expire automatically within a further 30 days.
• Billing records are kept for as long as tax law requires (currently six years in the United Kingdom); Stripe keeps its own records under its policy.
• Server logs are kept for 30 days.

7. Your rights

Under UK data protection law, and EU law where it applies to you, you can ask us for a copy of your personal data, ask us to correct or delete it, restrict or object to our processing, and receive your data in a portable format. To exercise a right, email contact@nanu.tech from the address on your account; we respond within one month. You can delete individual evaluations yourself in the app at any time. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or to your local supervisory authority.

8. Security

Data is encrypted in transit and at rest. Each account's data is isolated from every other account's at the database level. Access to production systems is limited to named people and audited. The evaluation engine treats the text it reads strictly as data and is hardened against instructions hidden inside it.

9. Children

Verithink is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this notice

We will update this notice when our processing changes and record the new version and date at the top. For material changes we will email account holders.