Data we process
Business e-mail, organization and billing details, target URL, authorization evidence, review configuration, measurements, artifacts and audit events. We do not sell personal data.
Purposes and legal bases
We process data to answer your enquiry, enter into and perform the contract, secure the service and prevent abuse, provide support, meet accounting and tax duties and pursue legitimate interests in a reliable service. Acknowledging this policy on the contact form is not consent to marketing. Any marketing communication requires a separate appropriate legal basis.
Recipients and transfers
Reports are private by default. An organization administrator can create an expiring, revocable link to one selected version; until expiry or revocation, anyone who receives that link can open it. We use Bunny for hosting and execution, Stripe for payment, Brevo for transactional e-mail, Google CrUX for field performance data and OpenAI through the Node runtime for structured interpretation of redacted category digests. Providers receive only what their task requires. Where processing transfers data outside the EEA, we use an appropriate transfer mechanism and contractual safeguards.
Retention
Raw artifacts are generally retained for 30 days, or 90 days for an active subscription. Selected evidence included in a report is retained with that report. The ordinary retention period for normalized results and reports is 730 days from completion of each assessment. Minimal identifiers and billing references may remain as service records. Authorization evidence and related audit records may be retained for five years. Law or a legal hold may extend these periods.
Your rights and contact
You may request access, correction, erasure, restriction or portability, or object to processing where applicable. You may complain to the Information Commissioner of the Republic of Slovenia. Contact privacy@verunel.com for privacy requests.