Privacy Policy — Verity Software Inc.

This Privacy Policy describes how Verity Software Inc. ("Verity", "we", "us") collects, uses, stores, shares, and protects your information when you use the Verity voice-transcription and dictation product (the "Service"). It applies to all users of the desktop, iOS, and web applications, regardless of location.

Defined terms (Service, Your Content, Personal Data, Sub-processor, etc.) have the meanings given in /legal/definitions.

1. What we collect

We collect only what is necessary to provide and improve the Service. We group Personal Data into four categories:

1.1 Account data

Information you provide at registration: email address, display name, and authentication tokens (OAuth or magic link). During the launch period all features are free; no billing data is collected. When paid plans are introduced, billing will be handled by a third-party payment processor acting as Merchant of Record — Verity will not store payment card numbers.

1.2 Your Content

Audio recordings you capture through the Service, the transcripts and polished outputs the Service produces, and any metadata you add (titles, tags, notes). You own Your Content; we process it solely to deliver the Service to you.

We do not use Your Content to train, fine-tune, or improve AI models — not now, and not in the future. This commitment is irrevocable and repeated in Terms of Service §6. Our fine-tuning pipeline uses only benchmark datasets, synthetic data, and publicly licensed corpora.

1.3 Usage and device data

• Device type, operating system, app version, and locale setting
• Session timestamps and duration
• Feature-usage events (e.g. "polish applied", "transcript exported") — no content is included in these events
• IP address at signup (used for sanctions screening and fraud prevention; not stored beyond screening). The country is looked up in a local copy of the DB-IP Lite database; no IP address is sent to a third party. IP Geolocation by DB-IP, licensed under CC BY 4.0.

We do not collect precise geolocation, contacts, camera data, or any sensor data beyond the microphone during an active recording session.

1.4 Biometric data

Verity processes your voice to produce transcripts. Depending on the jurisdiction, voice recordings and derived voiceprints may constitute biometric data. We treat all voice data as sensitive personal data regardless of where you are located.

• We collect biometric data only with your express written consent (provided through the in-app consent modal before your first recording).
• We use biometric data solely for transcription and polish — never for identification, surveillance, or profiling.
• We do not sell, lease, or trade biometric data.
• Retention and destruction: see §4 below and our published Biometric Data Policy.

2. How we use your information

We use your information for these purposes only:

We do not use your information for:

• Advertising, ad targeting, or ad profiling
• Selling or renting to third parties
• Training AI models on Your Content
• Building user profiles for purposes unrelated to delivering the Service

3. Who we share your information with

We share Personal Data only with the Sub-processors listed at /legal/sub-processors and only to the extent necessary to deliver the Service.

During the launch period, Verity has no payment processor — all features are free. When paid plans are introduced, a designated payment processor will act as Merchant of Record (collecting payment, remitting applicable taxes, and handling refunds). The sub-processors list will be updated with 30 days' advance notice per Terms §7.

All processing — speech-to-text, LLM polish, database, authentication — runs on Verity-provisioned infrastructure on AWS. We do not send your audio, transcripts, or account data to third-party AI API providers. AWS provides the underlying compute, storage, and networking, but Verity operates and controls the software stack, models, and data.

Material additions to this list trigger a 30-day advance notice per Terms §7.

We may also disclose Personal Data when required by law, court order, or regulatory request — and only to the extent legally required. We will notify you of such disclosures unless prohibited from doing so.

We do not sell Personal Data. We do not share Personal Data for cross-context behavioral advertising.

4. How long we keep your information

End-to-end encrypted sync (opt-in). Verity offers an optional device-sync feature that stores an encrypted copy of your transcripts on Verity servers so you can access them across devices. This feature is OFF by default; you must explicitly enable it in Settings. When enabled, transcript text is encrypted on your device before transmission using an encryption key generated on your device. Verity stores only ciphertext — we cannot read your synced transcripts because we never possess your decryption key. The key is held in your device's system keyring and is never transmitted to Verity servers; to use sync on another device you add that device by entering a short code, which transfers the key directly between your devices without Verity being able to read it. If you lose access to every device you have added, the synced copies cannot be recovered — by you, by Verity, or by anyone else. There is no recovery phrase, backup key, or escrow, because any of those would require Verity to hold something that could unlock your data. You may disable sync at any time; previously synced ciphertext is then subject to the retention schedule above (30-day soft-delete trash, then permanent purge).

When data reaches the end of its retention period, we delete or irreversibly anonymize it. Backups are purged on their next rotation cycle (maximum 30 days after primary deletion).

5. Your rights

You have the following rights over your Personal Data. To exercise any of them, visit your Privacy Rights Portal, email [email protected], or use the in-app account settings (including in-app account deletion under Settings › Account › Delete Account). We respond within 30 days (or sooner where required by law).

5.1 Rights available to all users

• Access — request a copy of the Personal Data we hold about you.
• Correction — request correction of inaccurate Personal Data.
• Deletion — request deletion of your Personal Data and Your Content. We delete within 30 days, except where retention is required by law.
• Export / portability — export Your Content in standard formats (plain text, JSON) from your account settings or by request.
• Withdraw consent — withdraw consent for biometric data processing at any time. Withdrawal stops future recording and transcription; previously processed data is handled per the retention schedule above.

5.2 Additional rights — Canada

PIPEDA (federal): You may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca if you believe we have not adequately addressed your request.

Quebec Law 25: You have the right to:

• Be informed of automated decision-making that produces legal or significant effects and request human review.
• Data portability in a structured, commonly used format.
• File a complaint with the Commission d'acces a l'information du Quebec (CAI).

We will notify you and the CAI within 72 hours of any confidentiality incident (breach) that presents a risk of serious injury, as required by Law 25.

British Columbia PIPA / Alberta PIPA: Express consent is required for collection of sensitive personal data (including audio recordings). Your consent is obtained through the in-app recording consent modal. You may withdraw consent at any time.

5.3 Additional rights — United States

California (CCPA/CPRA): California residents have the right to:

• Know what Personal Data we collect and why (this policy).
• Delete Personal Data (§5.1 above).
• Correct inaccurate Personal Data.
• Opt out of the sale or sharing of Personal Data. We do not sell or share your Personal Data, so there is nothing to opt out of.
• Limit the use of sensitive Personal Data. We use sensitive data (voice/biometric) only to provide the Service.
• Non-discrimination for exercising your rights.

We do not use or disclose sensitive Personal Data for purposes other than providing the Service. We do not sell Personal Data. We do not share Personal Data for cross-context behavioral advertising.

To exercise your CCPA/CPRA rights: visit your Privacy Rights Portal, email [email protected], or use the in-app account settings. We verify your identity through your authenticated account session. You may designate an authorized agent — provide a signed authorization letter.

Other US state privacy laws (VA, CO, CT, TX, OR, MT, DE, NH, NJ, MD, NE, RI, MN, IN, KY, IA, TN): These laws grant similar rights (access, delete, correct, opt out, appeal). The rights in §5.1 satisfy all of them. To appeal a denied request, email [email protected] with "APPEAL" in the subject line; we respond within 45 days.

Illinois BIPA: Your biometric data rights are described in §1.4 above and in our Biometric Data Policy. You consented to biometric data collection through the in-app consent modal. You may withdraw consent at any time.

5.4 Additional rights — EU/EEA/UK

If you are established in the EU, EEA, or UK:

• Lawful basis: We process Personal Data under contract performance (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest in security and abuse prevention (Art. 6(1)(f)), and consent for biometric data (Art. 9(2)(a)).
• Data-subject rights: Access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent — all exercisable via [email protected].
• Right to lodge a complaint: You may lodge a complaint with your local supervisory authority (data protection authority).
• Right of withdrawal (Dir. 2011/83/EU): You have a 14-day cooling-off period. Because the Service is digital content supplied immediately, you expressly consent to immediate performance at checkout and acknowledge the resulting loss of the statutory withdrawal right (Art. 16(m)). The 30-day refund in Terms §4.5 applies regardless.
• EU representative (GDPR Art. 27): Verity Software Inc. currently qualifies for the small-scale processing exemption under Art. 27(2)(a) — processing is occasional, does not include large-scale processing of special categories (Art. 9) or criminal-conviction data (Art. 10), and is unlikely to result in a risk to the rights and freedoms of individuals. We will appoint an EU representative and publish contact details here before actively marketing to or onboarding users in the EU/EEA.

6. International transfers

Verity Software Inc. is incorporated in Quebec, Canada. Your Personal Data may be transferred to and processed in the United States, where Verity operates its infrastructure on AWS.

6.1 Safeguards

• Canada → US: Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) permits transfers where the recipient provides comparable protection. We ensure comparable protection through contractual data-processing agreements with AWS and our payment processors.
• Quebec → US: Law 25 requires a privacy impact assessment (PIA) before cross-border transfers. We have conducted PIAs for our infrastructure and payment processors and determined that our contractual safeguards provide adequate protection.
• EU/EEA/UK → US: We rely on the EU Commission Standard Contractual Clauses (Decision 2021/914), supplemented by the EU-US Data Privacy Framework where the recipient is certified. UK transfers use the UK Addendum to the SCCs.

Copies of SCCs and our PIA summaries are available on request via [email protected].

6.2 Government access

We have not received, and do not anticipate receiving, any national-security orders, FISA directives, or bulk-surveillance requests. If we receive a lawful government request for Personal Data, we will (a) scrutinize it for legal validity, (b) narrow the scope to the minimum required, and (c) notify the affected user unless legally prohibited.

7. Security

We protect your Personal Data with:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Authentication via OAuth 2.0 or magic-link (no passwords stored)
• Access controls limiting employee access to Personal Data to those with a business need
• Regular security reviews of infrastructure and payment processor practices
• Incident-response procedures with 72-hour breach notification (Quebec Law 25; GDPR Art. 33)

End-to-end encryption (device sync). When you enable the optional device-sync feature, your transcripts are encrypted client-side using AES-256-GCM before any data leaves your device. The encryption key is generated on your device, stored in your system keyring, and is never transmitted to or stored on Verity servers. Adding a second device transfers that key directly between your devices, protected by a short code you type from one screen to the other; Verity relays the exchange but cannot read the key. Synced transcripts are stored on our servers as ciphertext only. Even in the event of a server-side data breach, synced transcripts cannot be decrypted, because Verity does not possess and cannot derive the key.

No system is perfectly secure. If you suspect a security issue, contact [email protected] or [email protected].

8. Children's privacy

Verity requires users to be at least 16 years old to create an account. We do not knowingly collect Personal Data from children below the most-protective applicable threshold:

• 13 in the United States (COPPA)
• 14 in Quebec (Law 25, art. 4.1)
• 16 in the EU/EEA (GDPR Art. 8)

If we learn we have collected data from a child below the applicable threshold without verifiable parental consent, we delete the account and associated data within 30 days and confirm deletion to the reporting party.

Parents or guardians may report a suspected underage account by emailing [email protected].

9. Cookies and tracking

The Verity web application uses:

• Strictly necessary cookies — authentication session, CSRF protection, locale preference. These cannot be disabled.
• Referral attribution — a verity_referral cookie and localStorage entry to track referral codes. Contains only the 8-character referral code; no personal data. Cleared after account creation.

We do not use:

• Third-party analytics cookies
• Advertising or retargeting cookies
• Cross-site tracking pixels
• Fingerprinting

The desktop and iOS applications do not use cookies.

10. AI and automated decision-making

Verity uses AI models (speech-to-text and large language models) to transcribe and polish your dictation. These are content-processing tools, not decision-making systems:

• They do not make decisions with legal or similarly significant effects on you.
• They do not profile you.
• Their outputs are informational — you control whether to use, edit, or discard them.

Under the EU AI Act, Verity is classified as a limited-risk AI system (Article 50 — transparency obligations only). We disclose AI involvement through an in-app modal and a persistent badge on polished outputs.

If Quebec Law 25's automated-decision provisions apply to any future feature, we will provide notice and a mechanism to request human review before deploying that feature.

11. Changes to this policy

We treat "material changes" to this Privacy Policy the same way we treat material changes to the Terms of Service: 30 days' advance notice by email and in-app notification before the change takes effect. You may object and terminate the Service before the effective date with a pro-rata refund.

Non-material changes (clarifications, expanded rights, additional transparency) take effect when posted.

The §1.2 commitment to never train on Your Content is irrevocable and cannot be weakened without your affirmative re-consent.

12. How to contact us

Verity Software Inc. 64 rue de L'Ermitage, Blainville, QC, J7B 1K3, Canada

Person responsible for the protection of personal information (Law 25): the Founder, reachable at [email protected].

Canadian privacy regulator: Office of the Privacy Commissioner of Canada — priv.gc.ca Quebec privacy regulator: Commission d'acces a l'information du Quebec (CAI) — cai.gouv.qc.ca

This policy is maintained by Verity Software Inc. and updated as our practices evolve.