Privacy policy
This policy explains what Vertifai collects when you use the browser extension and the account at vertif.ai, what it is used for, who it is shared with and how you control it.
In short
Vertifai reads the page you're on to prepare answers. Page content is sent to Vertifai only when you ask about it. The page title and address go with your messages. Search queries may include page text and go to our search provider. Page evidence is kept with the task until you delete it.
Introduction
Vertifai ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our browser extension, the website vertif.ai and related services (the "Service").
The controller for this processing is Algora AS, organisation number 934 323 114, Garderbakken 17 B, 1900 Fetsund, Norway.
This policy is published in English and Norwegian. Both versions are equally valid; if they differ, the version more favourable to you applies.
Data collection
We collect the following types of information:
A. Personal information
- Email address: Collected when you create an account to manage your credits and analysis history.
- Authentication credentials: Passwords are collected for secure sign-in purposes. If you sign in with Google, we receive the account identifier and email address Google provides.
- Security records: sign-in and account events with the IP address and browser details, to protect your account.
- Settings and consents: your preferences and a record of the consents you give (for example to web research with Bypass), with the time and version.
B. Usage data and content
- The page you are on: The extension reads the page you are on in your browser to prepare answers; this preparation stays on your device. Page content, including text you select, is sent to us only when you ask about it. The page title and address go with your messages in a signed-in task, unless you turn page reading off for that task. Search queries may include page text and go to our search provider. Page evidence is kept with the task until you delete it, or until an earlier expiry applies.
- YouTube video URLs: When you request an analysis, we collect the URL of the YouTube video you are watching.
- Video metadata and content: We access public video information (titles, channel names, captions/transcripts) to perform the fact-checking analysis.
- Captured pages and selections: When you attach content or request a page-aware action, we process the selected text, page content, images and associated page title and address supplied for that task. These sources may include private content you can access.
- Conversations and research: We store your questions, replies, task settings, source references and acquired source content so you can reopen tasks and inspect the evidence used. Retrieved excerpts may cover only part of a page or video.
- Analysis history: We store the results of your fact-checking requests to allow you to view them later.
C. Payment information
- If you purchase analysis credits or a subscription, payment processing is handled by our third-party payment processor (Stripe). We do not directly store or collect your full card details.
How we use your data
We use the information we collect to:
- Explain, summarize and analyze the content you submit, and search the public web for sources when your question needs them.
- Manage your account, subscription, and credit balance.
- Sync your analysis history across devices.
- Communicate with you regarding your account or service updates.
Legal bases
We process personal data only where the GDPR gives us a legal basis:
- Contract (Art. 6(1)(b)): to provide what you ask for: your account, tasks, answers and sources, history across devices, exports, subscriptions, credit purchases and the emails the Service needs, such as password reset.
- Consent (Art. 6(1)(a)): for features you switch on yourself, such as web research with Bypass, personal memory and connected services. You can withdraw consent at any time by turning the feature off; this does not affect processing that took place before.
- Legal obligation (Art. 6(1)(c)): to keep accounting records of payments, as the Norwegian Bookkeeping Act requires.
- Legitimate interests (Art. 6(1)(f)): to keep the Service and your account secure (sign-in protection, rate limits, security records, abuse prevention), to answer support requests and to send security notices such as a changed email address. You can object to this processing (see “Your rights”).
Transfers outside the EEA
Some of these providers process data in the United States. For Stripe, Google, Postmark, New Relic, Sentry, Railway and Cloudflare, the transfer relies on the EU–US Data Privacy Framework, under which these companies are certified, with the EU standard contractual clauses as a fallback where their agreements provide it. For OpenAI, OpenRouter and Brave, which are not certified, the transfer relies on the EU standard contractual clauses in their data processing agreements (GDPR Art. 46(2)(c)). You can ask us for a copy of these safeguards at support@vertif.ai.
How long we keep data
Task source content is retained until you delete the conversation or account, or until an earlier expiry applies. Expired or deleted sources are no longer available for reading or reuse; their content is removed by deletion or cleanup. An answer may remain in a retained conversation after its source expires, with the source marked unavailable. Deleting a conversation removes its retained source content; it does not delete a separate copy you explicitly carried into another task. Financial and security records have separate retention requirements. Deleting content in Vertifai cannot recall information already sent to a provider.
Other data is kept as follows:
- Your account: while the account exists. When you delete it, deletion is scheduled after a 7-day grace period in which you can cancel it; then your content is deleted and the account record is stripped of your email address, sign-in details, preferences and payment references.
- Tasks run without an account: answers and task content are cleared 30 days after the task finishes.
- Files you attach to a message: temporary copies, removed after 24 hours.
- Data exports: the download is available for up to 30 days, or for a shorter time if data in the export is due to be deleted sooner; you are then told the earlier date.
- Support reports: the text for 180 days, attached evidence for 30 days. Other support messages for 180 days after they are sent.
- Security notices (such as a changed email address): 180 days after sending.
- Sign-in: a session lasts up to 30 days after it was last renewed; password reset links expire after 1 hour; a Google sign-in in progress expires after 10 minutes.
- Video analyses: stored analysis files are removed after 365 days and transcripts are cached for up to 7 days; your analysis history stays until you delete it or the account.
- Payment and credit records: kept after the account is deleted, without your email address, because bookkeeping law requires them (at least five years after the end of the financial year).
- Security records: kept to protect accounts and to document how requests were handled; when you ask, we remove the IP address and browser details from them.
- Server logs and backups: Server and application logs are kept for up to 30 days (Railway, New Relic) and error reports for up to 90 days (Sentry). Database backups are kept for up to 3 months and then deleted automatically.
Data security
We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that no security measures are perfect or impenetrable.
Your rights
You have the right to:
- Access the personal information we hold about you.
- Have inaccurate information corrected.
- Have your account and data deleted.
- Receive your data in a portable format.
- Restrict processing, or object to processing based on legitimate interests.
- Withdraw a consent at any time, without affecting processing before the withdrawal.
You can export your data and delete your account from the account page. For the other rights, write to support@vertif.ai; we answer within one month. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).
Contact us
If you have questions or comments about this Privacy Policy, please contact us at support@vertif.ai.