Template — legal review required. This notice is a working draft describing how the VERITRAIL website is designed to handle personal data. Items in [square brackets] must be completed, and the whole notice must be reviewed by qualified legal counsel for each jurisdiction in which VERITRAIL operates, before publication.
Last updated: 21 October 2026
1. Who we are
The controller responsible for personal data collected through this website is [legal entity name], [registered address] ("VERITRAIL", "we", "us"). Contact for privacy questions: [privacy contact email]. [Data protection officer or representative details, where required.]
2. Summary
- We use cookieless, privacy-friendly analytics. We do not use advertising or cross-site tracking cookies, and we do not store IP addresses for analytics.
- We collect personal data only when you choose to submit it — for example to receive a full assessment report, download the blueprint, book a Governance Baseline, request a demo, contact us or subscribe to the newsletter.
- We do not sell personal data.
3. Data we collect and why
| Context | Data | Purpose | Legal basis [to be confirmed by counsel] |
|---|---|---|---|
| Website analytics | Event name, page path, limited event properties (for example "assessment started"); no cookies; no IP address stored | Understand which pages and tools are used, to improve the site | Legitimate interests |
| Maturity self-assessment — preliminary result | Your answers and organization profile (industry, size band, number of AI systems, use of agents, EU exposure), processed to calculate the score | Show your preliminary result | Legitimate interests / your request |
| Maturity self-assessment — full report | Business email, name, company, role, consent record, your answers and profile, source page | Generate and deliver your report; follow up about relevant VERITRAIL services if you agreed | Consent and/or steps at your request [confirm] |
| Blueprint download | Business email, name, company, role, consent record | Provide the document; follow up once if you agreed | Consent [confirm] |
| Contact, demo and Baseline forms; design-partner enquiries | Business email, name, company, role, your message, consent record | Respond to your enquiry and arrange meetings | Steps at your request / legitimate interests |
| Newsletter | Business email, consent record | Send the newsletter | Consent |
| Ask VERITRAIL demo, risk triage, guardrail generator | The text and selections you submit | Produce a response or result | Legitimate interests / your request |
We ask for a business email address because our services are for organizations; free-mail addresses are not accepted for report and lead forms.
Please do not submit personal data about other people, special-category data, secrets or confidential information in free-text fields or in the Ask VERITRAIL demo.
4. AI processing
Some features use AI. Before any text is sent to an external model provider, common sensitive-data patterns (for example email addresses, phone numbers, payment card and bank numbers, national identifiers and API keys) are redacted. Redaction is pattern-based and may not catch everything, which is why we ask you not to submit sensitive data. [List model providers and processing locations.] We do not use your submissions to train models [confirm contractual position with each provider]. See our Responsible AI statement.
5. Sharing
We share personal data only with service providers who process it on our behalf under contract — [hosting provider], [email delivery provider], [model provider(s)] — and where required by law. [List sub-processors or link to a sub-processor list.]
6. International transfers
[Describe where data is stored and processed and the transfer safeguards relied on, if any data leaves the jurisdiction where it was collected.]
7. Retention
| Data | Proposed retention [to be confirmed] |
|---|---|
| Analytics events | [13 months], aggregated thereafter |
| Lead and enquiry records | [24 months] after last interaction, then deleted or anonymized |
| Generated assessment reports | [24 months] after generation |
| Newsletter subscription | Until you unsubscribe, plus a consent record kept for [the period required to demonstrate consent] |
| Ask VERITRAIL demo conversations | [30 days], redacted |
| Audit log entries relating to your request | [Period required for security and accountability] |
8. Your rights
Depending on where you are, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time without affecting earlier processing. You can also complain to a data protection authority. To exercise your rights, contact [privacy contact email]. We will respond within the period required by applicable law.
9. Security
We use access controls, encryption in transit, redaction before external model calls and before log writes, and a tamper-evident audit log for material actions. No system is perfectly secure; tell us at [security contact] if you believe you have found a vulnerability.
10. Changes
We will update this notice when our practices change and show the date of the last update at the top.