Privacy policy

Effective from January 2026. Last updated 10 October 2026.

This Privacy Policy explains how Vera Services Inc (“Vera”, “we”) collects, uses and shares personal data.

1. What This Policy Covers

Vera connects physical products to digital certificates. A brand attaches a Vera tag to a product; tapping or scanning that tag opens a certificate showing what the product is, who owns it and its history.

This policy covers four things:

• The Vera platform at platform.vera.inc, used by brand staff.
• The Vera app for iOS and Android, used by brand staff to add certificates to products.
• Certificate pages, which are what someone sees after tapping or scanning a tag. These are presented under the brand’s own name.
• Our website at vera.inc.

2. Our Role: Controller and Processor

This distinction decides who you should contact about your data, so it is worth stating plainly.

Vera is a processor for the data a brand collects through its certificates. The brand decides what is collected, why, and on what legal basis. Scan records, the email and location captured by a certificate’s access gate, and the product data shown on a certificate all belong to that brand. If you scanned a tag and want your data removed, contact the brand you bought the product from. We will help them respond.

Vera is a controller for: brand staff accounts and their use of the platform and the app; support requests and error reports sent to us; consumer accounts held directly with Vera; billing; and our own website.

3. Information We Collect

Brand staff (platform and app). Name, email address, phone number where provided, profile photo, the company and role you belong to, and your interface preferences. We record sign-in events. For each signed-in session we keep when it started and was last used and a general device label such as “Chrome on macOS”, so you can see your sessions and sign out of them; this record does not include your IP address. If you choose text message as your sign-in verification method, we keep the phone number you verify for that purpose. Authentication is handled by WorkOS, including sign-in with Google, Microsoft or Apple and email magic links, so your password (where you use one) is held by WorkOS rather than by us.

We also record limited first-party product usage: which steps of an in-product tour were shown, and automatic error reports when a page fails to render. Neither carries free text about you. See section 6.

People who tap or scan a tag. Each scan is recorded against the certificate. That record includes the time, the tag and certificate identifiers, the result of the authenticity check, your IP address, your browser’s user-agent string, the referring page, and a device fingerprint stored as a hash.

A brand may additionally turn on an access gate before the certificate is shown. Where it is on, we collect the email address you enter. Location is separate and is covered in section 4. Both of these settings are the brand’s choice, not ours, and either may be off.

If you have opted into the access gate, your email address and your choice are stored in your browser’s local storage for up to 180 days so you are not asked again on the same device.

Consumers with a Vera account. Registering an account or claiming ownership of a product is optional. If you do, we hold your email address, name, and any of the following you choose to provide: phone number, profile photo, username, date of birth, gender, country, and notification preferences. Ownership transfers are addressed by the recipient’s email address.

You can create a consumer account with your email address or by signing in with Google. If you use Google, Google shares with us the basic profile information you have allowed: your name, email address and, where you have one, your profile photo. We do not receive your Google password.

Billing. Card payments are taken by Stripe using Stripe’s own hosted card fields. Card numbers never reach Vera’s systems. We store only Stripe’s identifiers for a customer, subscription and payment method.

Brand-supplied data. Where a brand connects an external store such as Shopify, we import the customer and order records it sends us, which may include names, email addresses, phone numbers and shipping addresses. That import is the brand’s decision.

4. Location

Location is the area where a policy is most often wrong in one direction or the other, so this section is specific.

We do not collect location in the Vera app. The iOS and Android app contains no location capability at all.

We do not derive your location from your IP address to populate a certificate’s scan record.

On certificate pages, we collect precise location only where two conditions are both met: the brand has enabled location collection, and you have ticked the consent box presented to you. If either is missing, no location is requested and none is stored. Where both are met, your browser supplies latitude and longitude (requested at reduced accuracy) which we store with the scan record.

To make those coordinates readable, we send them to the Google Maps Geocoding API, which returns a city, state and country. Your coordinates therefore leave our systems and reach Google for this purpose.

5. The Camera and NFC in the Vera App

The Vera app is a tool for brand staff, and its permissions are narrow.

NFC. The app reads the web address encoded on a Vera tag when you hold the phone against it, and sends that address to us so the tag can be added to the scanning session you are working in. That address contains the tag’s identifier and a cryptographic proof. The app deliberately does not read or transmit the chip’s raw hardware identifier.

Camera. The camera is used for one thing: reading the QR code that starts a scanning session. The code is decoded on the device and only the decoded text is used. No photograph or video frame is captured, stored or transmitted.

What the app does not do. It has no location capability, collects no device or advertising identifier, and contains no analytics, attribution, advertising or crash-reporting software. It does not track you across other companies’ apps or websites. The only thing it stores on the device is your light or dark theme preference.

As with any request over the internet, our servers observe the phone’s IP address. We record it in our server logs so requests can be correlated when something goes wrong.

App updates. When the app opens, it checks for and downloads updates to itself from Expo (650 Industries, Inc.), the service that delivers them. That check discloses the phone’s IP address and basic technical information — the platform, operating system version and app version — to Expo. It does not include anything about you or your scanning sessions.

6. Support Requests and Error Reports

When you contact support from the platform or the app, we receive what you write, any files you attach, and technical context that makes the report actionable: the page you were on, your browser or device platform and operating system version, time zone, and the version of the software you were running. From the platform this also includes the size of your browser window; from the app, the scanning session you were in, where there is one.

The platform also files an error report automatically when a page fails to render. That report contains the error and the technical context above. It does not contain anything you have typed.

Reports sent from the Vera app are not tied to a user account, because the app has no sign-in. This means we generally cannot reply to them directly. If you need an answer, email us as well.

7. SMS / Text Messaging

Vera sends text messages only to consumers who opt in from their Vera account on a certificate page, after verifying their phone number, and to account holders who choose text message as their sign-in verification method. Those security codes are sent only when you sign in or confirm a change to your security settings, are never marketing, and stop if you switch to an authenticator app in your security settings. The Vera app for brand staff does not send or sign you up for text messages. We do not sell, rent, or share mobile phone numbers or SMS opt-in data with third parties or affiliates for marketing purposes.

Message frequency varies based on your account activity and the notification categories you enable. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for assistance.

8. How We Use Information

We use personal data to operate and secure the services; to verify that a product is genuine and to record its ownership and history; to show a brand how its certificates are being used; to answer support requests and fix defects; to take payment; to send service messages, and marketing messages where you have agreed to them; and to meet our legal obligations.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (running an account); consent (location on certificate pages, SMS, marketing, and analytics and session recording on our website); our legitimate interests in securing the services, preventing counterfeiting and improving the product, including the cookieless page statistics described in section 16; and compliance with law.

9. AI Features

The Vera platform includes an assistant that answers questions about a brand’s own data. When a brand’s staff member asks a question, that question and the results of the database queries run to answer it are sent to Google’s Gemini Enterprise Agent Platform (formerly Vertex AI) for processing.

Those results can include personal data belonging to that brand’s customers, such as a customer’s name, email address or city, where the question asked for it and the staff member has permission to see it. Queries are restricted to the asking user’s own company.

We store the question that was asked. We do not store the assistant’s answer or the query results.

We do not use identifiable customer data to train AI models. We may use aggregated or de-identified data to improve the service.

10. Sharing and Subprocessors

We do not sell personal data.

We share personal data with service providers who help us run the service:

• Google Cloud Platform — hosting, database, cache, file storage and secrets
• Google Gemini Enterprise Agent Platform (formerly Vertex AI) — the assistant described in section 9
• Google Maps Platform — turning coordinates into a place name, and showing scan locations on a map
• Google Fonts — serving fonts on certificate pages, which discloses your IP address to Google
• WorkOS — sign-in and identity
• Stripe — payments
• SendGrid — transactional email
• Twilio — text messages
• Shopify — where a brand connects its store
• Expo (650 Industries, Inc.) — delivering updates to the Vera app
• Vercel — hosting our website at vera.inc, and its cookieless page statistics and page-speed measurements
• PostHog — analytics and session recording on our website, hosted in the European Union, only if you agree
• Resend — delivering messages sent through our website’s contact form

These providers are contractually bound to process data only as we instruct. Those used for the platform, the Vera app and certificate pages are also listed, as subprocessors, in our DPA. Vercel, PostHog and Resend serve only our website, so they are not.

If you choose to sign in with Google, Google confirms your identity to us and shares the profile information described in section 3. For that sign-in, Google acts under its own privacy policy, not on our instructions.

We may also disclose data where the law requires it, to enforce our terms, or as part of a merger or acquisition.

11. International Transfers

We are based in the United States and our providers operate internationally, so your data may be processed outside your country. Where required, we use appropriate safeguards, including Standard Contractual Clauses. Website analytics collected with your consent are processed by PostHog in the European Union.

12. Retention

We keep personal data for as long as the account or certificate it belongs to exists, and afterwards where we need it to meet a legal, accounting or security obligation, or to resolve a dispute.

Scan records are treated differently, and deliberately: a certificate’s value is its history, so deleting the record of a scan would delete part of the provenance the product’s owner relies on. We therefore retain scan records for as long as we provide the service for that certificate, and we do not delete them on a fixed schedule.

Records of signed-in sessions and sign-in verification codes are deleted about a day after the session ends or the code expires.

You can ask us to delete data about you at any time. See section 14.

13. Security

We protect personal data with access controls, encryption in transit, network isolation for our databases, managed secret storage, and permission checks enforced on the server rather than in the interface. No system is perfectly secure, and we do not claim otherwise.

14. Your Rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy in a portable form, and withdraw consent you have given. You may also have the right not to be discriminated against for exercising these rights.

Where to send a request. If it concerns data collected through a brand’s certificates, contact that brand, because they decide what happens to it. If they pass the request to us, or if it concerns your Vera account, a support request, or our website, write to legal@vera.inc.

You can withdraw location consent by clearing your browser’s site data, stop text messages by replying STOP, and change or withdraw your website analytics choice at any time through the Cookies link in the footer of vera.inc.

15. Children

The services are for businesses and adult consumers. They are not directed at children, and we do not knowingly collect personal data from a child under 16. If you believe a child has given us personal data, write to legal@vera.inc and we will delete it.

16. Cookies and Tracking Technologies

The Vera platform uses cookies to keep you signed in. Certificate pages use your browser’s local storage to remember an access-gate choice, as described in section 3.

The platform, the certificate pages and the Vera app contain no third-party analytics, advertising or crash-reporting software.

Our website at vera.inc works differently. It keeps a few items in your browser that it needs in order to work, and it uses two kinds of measurement.

Strictly necessary storage. The website sets these itself, each only when you use the feature it belongs to, and does not ask first because that feature cannot work without it. They are used only by the website. The cookies are sent only over secure connections and cannot be read by scripts on the page.

• vera_site_gate (cookie, 14 days, or for the life of your invitation up to 90 days) — remembers that you have been let in while access to the site is restricted.
• vera_site_gate_stash (cookie, 10 minutes) — holds a pricing sign-in link while you pass the access check, and is deleted once it has been used.
• vera_staged_unlock (cookie, 30 days) — gives preview access to pages that have not been released yet.
• vera_pricing_access (cookie, 12 hours) — keeps you signed in to the pricing page.
• vera-analytics-consent (local storage, no expiry date) — records your answer to the analytics banner so we do not ask again on that device. It stays until you change it or clear your browser’s site data.
• vera-color-mode (local storage, no expiry date) — remembers light or dark mode, only if you switch it.
• vera.prefill.* (session storage, until you close the tab) — if you open the ROI calculator after submitting a form, carries the email address, plan and product categories you gave into it.
• vera-density (session storage, until you close the tab) — a display setting, used only when a page is opened with a density option in its address.

The two kinds of measurement are:

• Cookieless page statistics. Vercel, which hosts the site, counts page views and a small number of events such as a form being submitted, and measures how quickly each page loads and responds on your device. It sets no cookies, stores nothing in your browser and runs without asking. To count unique visitors, Vercel uses a hash created from each incoming request rather than a cookie, and discards it after 24 hours. The page-speed measurements are not linked to a visitor.
• Analytics and session recording. Outside the United States, they run only if you agree: the first time you visit, a banner asks whether we may use analytics cookies and session recordings. In the United States, a notice tells you that analytics are on, lets you turn them off, and asks before any session recording, as described below. Where analytics run, PostHog, hosted in the European Union, records the pages you view, what you click and a recording of how you use the site, with anything you type into a form masked. This data travels through our own address (vera.inc/ingest) to PostHog’s servers in the European Union. To recognise a return visit, PostHog stores a cookie whose name begins ph_ and ends _posthog, which lasts 365 days and holds a random identifier, a copy of it in local storage, and a few items beginning ph_ in session storage that end when you close the tab. If you then submit a form — requesting access, using the ROI calculator, contacting us or subscribing — we link that activity to the email address you give, so we can understand how visitors become customers.

If you decline, none of this happens and nothing is sent to PostHog. If you accepted and later decline, PostHog stops recording and its cookie and ph_ items are deleted from your browser. PostHog keeps one setting in local storage that records your opt-out and holds no identifier. If you had already given us your email address through a form, we send PostHog one last event recording that you withdrew, so we stop linking your activity to whether you become a customer.

Your choice is kept in vera-analytics-consent, listed above, and you can change it at any time through the Cookies link in the website footer.

If you visit from the United States, which we estimate from your IP address when the page loads without storing it, the analytics described above run without asking first, but session recording starts only if you allow it. You can turn analytics off at any time with “Don’t track me” in the notice or through the Cookies link in the footer, and we treat a Global Privacy Control signal from your browser as that request and show that we have honoured it. Everywhere else, and whenever we cannot tell where you are, nothing is sent to PostHog until you accept.

If you open an invitation link we sent you (an address beginning vera.inc/invite/), we record the click: the time, the page it opens, the website you came from and your type of device, but not your IP address; where analytics run for you, as described above, the pages you then view are linked to the person the link was made for.

17. Changes to This Policy

We may update this policy. Where a change is significant, we will take reasonable steps to tell you. The date at the top records when it was last changed.

18. Contact

Questions about this policy, or a request under section 14:

legal@vera.inc

For help using Vera or the Vera app, see our support page.