This Privacy Policy explains how Veryfront GmbH (“Veryfront”) processes personal data when you visit the Veryfront website (“Website”) or use the Veryfront Platform (“Platform”). The Platform includes Veryfront Code, Veryfront Studio, Veryfront Cloud and Veryfront Agent. This Policy covers processing for which Veryfront is the controller.

Personal data is any information relating to an identified or identifiable natural person, such as a name or email address. Veryfront processes personal data in accordance with the General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”) and the German Telecommunications Digital Services Data Protection Act (“TDDDG”).

1. Controller and Contact

Veryfront GmbH
Finkenstraße 10
70199 Stuttgart
Germany

Privacy contact: Kentaro Wakayama
Email: [email protected]

2. Processing of Personal Data

2.1. Visiting the Website

When you visit the Website, Veryfront's servers automatically process the data your browser transmits (server log files):

IP address of the requesting device,
date and time of access,
URL accessed and the website from which you came (referrer URL),
browser, operating system and device type,
amount of data transferred, status code and error messages.

Purpose: Delivering the Website, ensuring a stable connection, and detecting and preventing attacks.

Legal basis: Veryfront's legitimate interest in these purposes (Art. 6 para. 1 lit. f GDPR).

Storage: Server logs are retained only as long as necessary for operation and security.

2.2. User

When you register as a user, Veryfront processes the following user data:

first and last name,
email address,
language,
profile picture, if provided,
date, time and IP address of registration and sign-in.

Purpose: Providing and managing your user profile, authenticating you and preventing misuse.

Legal basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR). If you use the Platform as a User of one of Veryfront's customers, the legal basis is Veryfront's legitimate interest in providing the access requested by the customer for you and preventing misuse (Art. 6 para. 1 lit. f GDPR).

Storage: Until your user profile is deleted. When a customer's contract ends, Veryfront deletes data relating to that customer's account in accordance with Veryfront's Terms of Use, unless statutory retention obligations apply.

2.3. Single Sign-On (SSO)

You can use your Google, GitHub or Microsoft account to register and sign in to Veryfront. This account is linked to your Veryfront user. Your browser is redirected to the provider for authentication. The provider then sends Veryfront your email address and, where available, your name and profile picture.

Purpose: Simplified registration and sign-in.

Legal basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR). If you use the Platform on behalf of a customer, the legal basis is Veryfront’s legitimate interest in providing and securing your access (Art. 6 para. 1 lit. f GDPR).

The providers' own privacy policies apply to their processing: Google, GitHub and Microsoft.

2.4. Using the Platform

Customer Content: When you use the Platform within a customer's account, the content, files, code, prompts, outputs and other data you work with are “Customer Content”. This includes personal data of end users of the customer's applications. Veryfront processes Customer Content solely as a processor on behalf of that customer.

The customer, typically your employer or client, acts as controller or as processor for another controller, depending on the use. The data processing agreement between the customer and Veryfront applies. Veryfront uses Customer Content only to provide the Platform and does not use it to train AI models.

To exercise your rights regarding Customer Content, please contact the customer, which will handle or forward your request as appropriate.

Usage data: Separately, Veryfront processes technical usage data as a controller, such as request counts, response times, error rates, models used and technical metadata from runs and logs. Customer Content contained in runs, logs or traces remains subject to the data processing agreement.

Purpose: Operating, securing, billing and improving the Platform. Statistics used across customers are aggregated and anonymised.

Legal basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR) for operation and billing; Veryfront's legitimate interest in security, abuse prevention and improvement of the Platform (Art. 6 para. 1 lit. f GDPR).

Storage:

Grafana Cloud: logs are retained for 31 days and traces for 30 days.
Sentry: error events are retained for up to 90 days, full-detail traces for 30 days and sampled traces for up to 13 months.
Other usage and diagnostic data: deleted or anonymised when no longer needed to investigate and resolve the relevant fault or security incident.
Billing-relevant usage records: retained as set out in Section 2.5.

2.5. Billing and Payment

For paid services, Veryfront processes:

company name, address and VAT ID,
name and email address of the billing contact,
ordered services, credit purchases and consumption,
invoices and payment status.

Veryfront uses Stripe for payments (Section 3.4). Veryfront does not store credit card or bank account details itself.

Purpose: Billing and payment processing.

Legal basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR) and statutory retention obligations (Art. 6 para. 1 lit. c GDPR).

Storage: Until the applicable statutory retention periods under commercial and tax law expire (§ 257 German Commercial Code, § 147 German Fiscal Code). The period depends on the type of record.

2.6. Contact and Support

When you contact Veryfront by contact form, email or the Platform's feedback function, Veryfront processes the data you provide, such as name, company, email address, your message and any attachments. In-app feedback is processed through Sentry (Section 3.6).

Purpose: Answering your inquiry and providing support.

Legal basis: Performance of the contract or steps taken at your request before entering into a contract (Art. 6 para. 1 lit. b GDPR). For other inquiries, the legal basis is Veryfront’s legitimate interest in answering your inquiry and providing support (Art. 6 para. 1 lit. f GDPR).

Storage: Until your inquiry has been dealt with, unless a contract is concluded or retention periods for business communications apply.

2.7. Emails

Veryfront sends you emails that are necessary for the contract, such as account confirmations, security notices, invoices and notices of changes under Veryfront's Terms of Use (Art. 6 para. 1 lit. b GDPR).

3. Recipients and Service Providers

Veryfront uses carefully selected service providers. These providers act as processors on behalf of Veryfront. They are bound by Veryfront's instructions and a data processing agreement under Art. 28 GDPR. Where a provider acts as an independent controller, Veryfront says so below.

3.1. Hosting, Infrastructure and Delivery

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers for Veryfront's Kubernetes and database infrastructure.

Google Cloud (Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland): storage and delivery of uploaded files and assets.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: content delivery network for secure and fast delivery of the Website; Cloudflare processes server log data for this purpose.

Legal basis: Veryfront's legitimate interest in secure and fast delivery (Art. 6 para. 1 lit. f GDPR). Privacy policy.

3.2. AI Inference Providers

The Platform provides access to third-party AI models through the AI Gateway. Prompts, code, project files, outputs and related metadata are transmitted to the inference provider that runs the selected model:

Google Cloud (Vertex AI): models of Anthropic (Claude), Google (Gemini) and Mistral AI,
Microsoft Azure (Azure AI Foundry) (Microsoft Ireland Operations Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland): models of OpenAI (GPT),
Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France: models of DeepSeek, Alibaba Cloud (Qwen) and Z.ai (GLM).

The models are run only by the inference providers listed. Veryfront contractually prohibits these providers from using the data to train AI models, and the providers also undertake not to do so.

Details, including processing locations, are set out in Appendix 1 to Veryfront's Terms of Use. Where this data is Customer Content, Veryfront acts as a processor (Section 2.4). Otherwise, the legal basis is performance of the contract (Art. 6 para. 1 lit. b GDPR).

3.3. Integrations

If you connect a third-party service to an account, Veryfront processes the connection metadata, access tokens and tool configuration required for the integration. When you use the integration, Veryfront transmits the requests, content and metadata you select to the connected provider to perform the action you requested.

The legal basis is performance of the contract (Art. 6 para. 1 lit. b GDPR). The connected provider is responsible for its own processing under its privacy policy.

Veryfront's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.4. Payment

Stripe Payments Europe Ltd., One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, processes payments. You enter payment details directly with Stripe.

Stripe acts as Veryfront's processor when providing payment services on Veryfront's instructions. It acts as an independent controller for its own purposes, including fraud prevention, compliance with legal obligations and improvement of its services.

Veryfront receives payment status and billing details: name, email address, telephone number, billing address and tax IDs, where provided. Stripe privacy policy.

Legal basis: Performance of the contract (Art. 6 para. 1 lit. b GDPR).

3.5. Communication and Customer Relations

Microsoft Ireland Operations Limited (Microsoft 365): receiving, sending and storing business emails, including sender details, message content and attachments. Microsoft DPA.

HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA: receiving and managing contact and sales inquiries.

When you submit a contact form, Veryfront transmits your name, email address, message and the page name.

Data hosting: Germany; further processing outside the EU possible. HubSpot DPA, section 11: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required. Privacy policy.

Twilio Ireland Limited (SendGrid), 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland: sending emails. Privacy policy.

3.6. Monitoring and Error Tracking

Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA: error monitoring, diagnostics and in-app feedback.

If you send feedback or an error occurs, Sentry may process contact details, messages, account and project context, technical metadata, stack traces, logs, screenshots and attachments. Privacy policy.

Raintank Inc., d/b/a Grafana Labs (Grafana Cloud), 165 Broadway, 23rd Floor, New York, NY 10006, USA: logging, metrics and tracing to monitor availability, stability and security.

Technical data such as server information, IP addresses, timestamps, request metadata and error information may be processed.

Configured telemetry region: Germany. Privacy policy.

Legal basis: Veryfront's legitimate interest in reliable and secure services (Art. 6 para. 1 lit. f GDPR).

3.7. Document Previews

For PDF previews of uploaded or imported files, Veryfront uses the Adobe PDF Embed API (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, City West Business Campus, Saggart, Dublin 24, Ireland). Documents are rendered in your browser; Adobe processes technical request data and anonymous usage data. Privacy policy.

For Office previews of uploaded or imported files, Veryfront uses the Microsoft Office Online viewer. Microsoft receives the document URL, the file name, the document content and the technical request data needed to render it. Privacy policy.

Legal basis: Performance of the contract where the preview is part of the requested service (Art. 6 para. 1 lit. b GDPR); otherwise Veryfront's legitimate interest in making files easy to inspect (Art. 6 para. 1 lit. f GDPR).

3.8. Advisors, Acquirers and Authorities

Veryfront discloses personal data to lawyers, tax advisors and auditors where necessary to protect Veryfront's legal and economic interests. These advisors are bound by professional or contractual confidentiality.

In the event of a merger, acquisition or sale of Veryfront's business, data may be disclosed to the prospective or actual acquirer and their advisors to the extent necessary and subject to confidentiality.

Legal basis: Veryfront's legitimate interest in these purposes (Art. 6 para. 1 lit. f GDPR).

Veryfront discloses data to authorities or courts only where Veryfront is legally obliged to do so (Art. 6 para. 1 lit. c GDPR).

4. International Data Transfers

Veryfront generally processes personal data within the European Union.

Some of the providers named above, or their group companies, are located in the United States or may access data from there: Cloudflare, Google, HubSpot, Microsoft, Adobe, Twilio (SendGrid), Functional Software (Sentry), Grafana Labs.

Veryfront transfers personal data to third countries only if at least one of the following applies:

the European Commission has decided that the country ensures an adequate level of data protection (Art. 45 GDPR),
the recipient is certified under the EU-U.S. Data Privacy Framework, which is covered by such an adequacy decision,
Veryfront has agreed the European Commission's Standard Contractual Clauses with the recipient (Art. 46 para. 2 lit. c GDPR), together with a Transfer Impact Assessment (TIA) where required and additional measures where necessary.

The providers describe their transfer safeguards as follows:

Cloudflare, Google, HubSpot, Twilio (SendGrid) and Sentry: EU-U.S. Data Privacy Framework for covered transfers; EU Standard Contractual Clauses where required. Google's clauses are set out in its CDPA, Appendix 3.
Microsoft (Azure) and Grafana Labs: EU Standard Contractual Clauses (Microsoft DPA, Appendix C; Grafana DPA, Schedule 2).
Adobe: Standard Contractual Clauses between its relevant group companies and applicable adequacy decisions.

You can request a copy of the safeguards at [email protected].

5. Cookies

The Website and the Platform only use cookies and similar technologies that are technically strictly necessary, for example to keep you signed in, to protect against attacks or to recognise your browser after a page change. Session cookies are deleted at the end of your visit. Persistent cookies remain on your device until they expire or you delete them.

Legal basis: Storing and accessing these cookies does not require consent (§ 25 para. 2 no. 2 TDDDG).

Veryfront does not use cookies for analytics or advertising. You can manage and delete cookies in your browser at any time. Blocking cookies may impair the Website and the Platform.

6. Data Security

Veryfront uses appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls limited to authorised personnel on a need-to-know basis, and regular reviews of Veryfront's security measures.

7. Storage Period

Unless a specific period is stated above, Veryfront stores personal data only for as long as necessary for the respective purpose or as required by law. Customer Content is deleted in accordance with Veryfront's Terms of Use and the data processing agreement.

8. Automated Decision-Making

Veryfront does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

9. Your Rights

You have the following rights free of charge:

Access (Art. 15 GDPR): information about whether Veryfront processes your personal data and, if so, which data, for what purposes and for how long, where it comes from and to whom Veryfront discloses it, including a copy of the data.
Rectification (Art. 16 GDPR): correction of inaccurate and completion of incomplete data.
Erasure (Art. 17 GDPR): deletion of your data, in particular if it is no longer necessary, you withdraw your consent or you have successfully objected, unless statutory retention obligations or the exceptions in Art. 17 para. 3 GDPR and § 35 BDSG apply.
Restriction (Art. 18 GDPR): restriction of processing, for example while the accuracy of your data or an objection is being examined.
Data portability (Art. 20 GDPR): receiving the data you have provided to Veryfront in a structured, commonly used and machine-readable format, or having it transmitted to another controller.
Withdrawal of consent (Art. 7 para. 3 GDPR): withdrawing any consent at any time with effect for the future, without affecting the lawfulness of processing before the withdrawal.
Complaint (Art. 77 GDPR): lodging a complaint with a supervisory authority. The authority responsible for Veryfront is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, [email protected].

Right to object (Art. 21 GDPR): Where Veryfront processes your personal data on the basis of Veryfront's legitimate interests (Art. 6 para. 1 lit. f GDPR), you can object at any time.

Veryfront will then stop the processing unless Veryfront can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Some features or services may consequently no longer be available to you.

You can object to processing for direct marketing at any time without giving reasons.

To exercise your rights, contact Veryfront at [email protected].

10. Changes to this Privacy Policy

Veryfront updates this Privacy Policy when its services, its processing or the legal requirements change. The current version is available on the Privacy Policy page.