Privacy Policy

1. Who this policy covers

This policy applies to:

• Website visitors, anyone who browses veriproof.app or any RJR Labs public web property
• Prospective customers, anyone who contacts us, requests a demo, or registers for a trial
• Platform subscribers, the human account holders, administrators, and authorized users of the VeriProof platform
• SDK integrators, developers who integrate the VeriProof capture SDK into their applications
• Reviewers in Slack and Microsoft Teams, people who get or respond to VeriProof reviews through their organization's Slack workspace or Teams tenant (see Section 6)

It does not govern the AI decision records that your organization submits to the platform. That data is processed solely under your customer agreement and DPA. See Section 5 for the key commitments that apply to that data.

2. Information we collect

Information you provide directly. We collect the information you submit when you contact us, request a demo, create an account, or complete a website form. This typically includes your name, work email address, company name, and job title.

Account and subscription information. To create and maintain a VeriProof account, we collect your name, work email, company, billing contact, and the configuration choices you make during setup (such as data residency rules and deployment model).

Usage and telemetry. When you visit our website or use the platform portal, we collect standard server log data: IP address, browser type and version, operating system, pages visited, referring URL, and timestamps. With analytics enabled, Google Analytics may also receive page and event data, referrer and campaign parameters, device and browser information, and an approximate region. We do not send names, email addresses, inquiry text, record identifiers, or session identifiers to Google Analytics. We do not use browser session recording on the public website. In the platform portal, we collect feature-level usage events to diagnose failures and improve the product. We do not build advertising audiences from this data.

Slack and Microsoft Teams. If your organization connects VeriProof to Slack or Microsoft Teams, we receive the account and conversation identifiers described in Section 6.

Communications. We retain emails, support requests, and form submissions you send us for the purpose of responding to you and maintaining a record of our relationship.

Billing information. Production subscriptions are arranged through a contract and invoice. We keep the billing contacts and records needed to manage the customer account and meet legal requirements.

3. How we use your information

We use the information we collect for the following purposes:

• Deliver the platform. Provision your account, operate the service, and fulfill our contractual obligations under your customer agreement.
• Communicate with you. Respond to inquiries, send service notifications, deliver transactional emails (receipts, security alerts, policy updates), and, where you have not opted out, send product news relevant to your use of the platform.
• Improve and secure the product. Diagnose bugs, analyze aggregate usage patterns, and make the platform more reliable. We never use platform decision records for this purpose.
• Comply with legal obligations. Respond to valid legal process, meet our obligations under applicable law, and assert or defend legal claims.
• Billing and fraud prevention. Process payments, issue invoices, and detect fraudulent or abusive activity.

We do not sell your personal information. We do not use personal information for automated decision-making that produces legal or similarly significant effects about you.

4. Legal bases for processing (EEA and UK)

Where the EU GDPR or UK GDPR applies, we rely on the following legal bases:

You may object to processing based on legitimate interests at any time through our privacy request form.

Switzerland has a separate framework under the Federal Act on Data Protection (FADP). See Section 10 for information about Swiss privacy rights.

5. Customer platform data (AI decision evidence)

AI decision records, the structured evidence captured through the VeriProof SDK or API, are customer data. In managed SaaS, RJR Labs processes that data as a processor or service provider under the customer agreement and DPA. Private Enterprise is coming soon to Azure Marketplace. When it is available, the whole platform will run in the customer's own Azure subscription, completely separate from VeriProof SaaS. Decision records and their integrity ledger will stay there, and the customer will control access to its installation.

Our core commitments for platform evidence data:

• Tenant isolation. Evidence data is logically isolated per customer account through tenant-scoped access controls and database row-level security. No tenant can access another tenant's data.
• No secondary use. We do not use your evidence data for product analytics, model training, benchmarking, advertising, or any purpose other than operating the platform and meeting our legal obligations.
• Staff access controls. Access to managed environments is role-restricted and logged. Private Enterprise will use the access boundary and support process defined in its deployment agreement.
• Integrity proof for each record. Azure SQL Database Ledger is the default proof provider; a tenant can choose Solana instead. The Solana path publishes fingerprints and transaction metadata to a public network. It never publishes decision content or personal data. Azure SQL Database Ledger stores the record fingerprint and required identifiers inside the approved Azure operating model, with separately protected digests used for verification. Retention and deletion follow the customer agreement. See Data retention and deletion.
• Data residency. For managed SaaS, supported regions are confirmed during your security review. Private Enterprise customers will choose the Azure region within their approved architecture. Contracted regions and responsibilities appear in the customer agreement.
• Sub-processor management. Our current sub-processor list identifies the vendors used to operate VeriProof. Contracted notice terms govern material changes.

For questions about your platform data, contact your account manager or use our privacy request form.

6. Slack and Microsoft Teams integrations

A customer can connect VeriProof to its Slack workspace or Microsoft Teams tenant so reviewers get their reviews, and can respond to them, where they already work. This section explains what the VeriProof apps for Slack and Microsoft Teams receive, keep, and delete. We process this information on behalf of the customer organization that connected the app, under its customer agreement and DPA, and only to run the integration.

What we receive and keep

• The connection. For Slack: the workspace or Enterprise organization ID and name, the VeriProof app's bot user ID, the permissions the workspace granted, and the app's access tokens, which are encrypted at rest. For Microsoft Teams: your Microsoft Entra tenant ID.
• Linked accounts. When a person connects their Slack or Teams account to VeriProof, we keep their Slack member ID or Microsoft Entra object ID, linked to their VeriProof user, with the time they connected. To offer a link in Slack, we look up the Slack account that uses the person's VeriProof work email. In Microsoft Teams, someone who signs in to VeriProof with the same Microsoft account can be connected automatically.
• Message addresses. The Slack direct-message channel or Teams personal chat we post a person's reviews to, and the IDs of the messages we posted, so we can update them as a review moves. Teams chat addresses are encrypted at rest.
• Group review channels. When an administrator chooses a channel for an application's group reviews, we keep the channel's ID and name. For Teams, we also keep the IDs and names of the teams and channels the app is added to, so administrators can choose one. We read the channel's member list to confirm that everyone in it belongs to your organization. We don't keep that list. We keep a one-way digest of it, which tells us when membership changes, and the VeriProof users who are in the channel.

What we read but don't keep

• Account status. We read whether an account is a guest, belongs to another organization, or is deactivated, to keep reviews and decisions with members of your organization. Slack and Microsoft also return profile details such as names and email addresses with these lookups. We don't store them.
• Shared links. When someone shares a link in a conversation the app is part of, Slack or Microsoft Teams sends us the link. We act only on links to VeriProof reviews and ignore everything else.
• Messages to the app. We read what people send the VeriProof app only to recognize commands such as help and reviews.

What appears in Slack and Microsoft Teams

Review messages show the application's name, why the review is needed, the reviewer's role, the due time, the priority, and the case reference. When your administrator lets reviewers decide in Slack or Teams, messages can also show the proposed action and the details the application provided, up to the data limit your administrator sets: public information only, or public and internal information. Confidential and sensitive information never appears in Slack or Teams. A review that needs it opens in VeriProof. Group review posts show less, plus the name of the reviewer who claimed the review.

Answers, reasons, and questions a reviewer enters in Slack or Teams pass through Slack or Microsoft to VeriProof. VeriProof records the decision as customer platform data (see Section 5), under the reviewer's VeriProof account, with a note that it was made in Slack or Microsoft Teams. The decision record doesn't include the Slack or Teams account ID.

Messages we post stay in your Slack workspace or Microsoft Teams tenant. Slack or Microsoft keep them according to your organization's own retention settings and their terms with you. VeriProof doesn't read them back. Slack and Microsoft are providers your organization chose, not VeriProof sub-processors.

How we use it

We use this information only to deliver reviews, confirm who is acting and that they're allowed to, and record their decisions. We don't use Slack or Microsoft Teams data for advertising, sell it, or share it except as this policy describes. We don't use it to train artificial intelligence or machine learning models, including large language models.

When we delete it

• Slack. When the VeriProof app is removed from your workspace or its access is revoked, or an administrator disconnects Slack in VeriProof, we delete account links (including ended ones), pending link codes, message records, group review channels, and the workspace details and access tokens. We do this when Slack notifies us, and always within 14 business days.
• Microsoft Teams. When an administrator disconnects Microsoft Teams in VeriProof, we delete account links (including ended ones), pending link codes, chat addresses, message records, team and channel details, group review channels, and the tenant ID. Microsoft doesn't tell us when an organization removes the app in Teams, so disconnect it in VeriProof too, or contact us and we'll delete the data.
• One person. When someone disconnects their own Teams account, we delete their chat address, their review messages, and any pending link codes. We keep a record that they ended the link, so a later Microsoft sign-in doesn't reconnect them automatically. That record is deleted when your organization disconnects Teams, or on request. In Slack, a person's link is deleted when the app is removed or Slack is disconnected.

We keep an audit record that this deletion happened. It holds only counts and VeriProof application IDs. Decisions already recorded stay in VeriProof as customer platform data. So does your administrators' audit history of integration settings, such as which channel was chosen. Both follow the customer agreement.

Questions and requests

People who use VeriProof through their organization's Slack or Teams can make requests through our privacy request form. Because we process this information for your organization, we may involve it in answering your request. If a security incident affects this information, we'll notify the affected customer without undue delay and notify Slack or Microsoft where their terms require it.

7. Information sharing and disclosure

We share personal information only in the following circumstances:

Service providers and sub-processors. We use third-party vendors to operate infrastructure, content delivery, email, CRM, and analytics. These vendors receive only the information needed to provide their service. See the current sub-processor list.

Slack and Microsoft Teams, at your organization's direction. When your organization connects Slack or Microsoft Teams, we send review messages to that service so reviewers can see and answer them there. Section 6 describes what those messages contain.

Legal requirements. We will disclose information when required by law, valid legal process, or regulatory demand, or to protect the safety, rights, or property of RJR Labs, our customers, or the public. Where legally permitted, we will notify you before complying with such a request.

Business transfers. In the event of a merger, acquisition, financing, or sale of substantially all assets, personal information may be transferred to a successor entity. We will provide notice before personal information is transferred and becomes subject to a materially different privacy policy.

With your consent. We may share information for other purposes with your explicit consent.

We do not sell personal information to data brokers, advertisers, or any third party.

8. International data transfers

RJR Labs is headquartered in the United States. If you are accessing the VeriProof platform or this website from the EEA, UK, or Switzerland, your personal information may be transferred to and processed in the United States, which does not have the same data protection laws as your country.

We use the following safeguards for cross-border transfers:

• Standard Contractual Clauses (SCCs). For transfers from the EEA and UK to third countries, we rely on the European Commission’s standard contractual clauses (Module 2: Controller to Processor) incorporated into our DPAs.
• UK IDTA. For UK-origin transfers, we use the UK International Data Transfer Agreement where applicable.
• Data residency options. When Private Enterprise is available, customers will be able to deploy it in an EEA region of their own Azure subscription.

9. Data retention

We retain personal information only as long as necessary for the purposes described in this policy or as required by law:

When an account closes, deletion and export follow the customer agreement, the selected deployment model, and any applicable legal hold.

10. Your privacy rights

EEA and UK (GDPR). Where the EU GDPR or UK GDPR applies, you have the following rights, subject to the conditions in those laws:

• Access the personal information we hold about you
• Correct inaccurate or incomplete personal information
• Erase personal information we no longer have a lawful basis to process
• Restrict how we process your data pending a dispute
• Object to processing based on legitimate interests or for direct marketing
• Portability, receive your data in a structured, machine-readable format
• Withdraw consent where processing is based on consent

You also have the right to lodge a complaint with your local data protection authority.

Switzerland (FADP). You can request information about the personal data we process about you and request correction or deletion where applicable. Use our privacy request form to exercise your rights. The Swiss data protection authority explains these rights and how to make a request.

California (CCPA/CPRA). If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and share
• Delete personal information we hold about you (subject to exceptions)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• Limit use and disclosure of sensitive personal information where the CCPA provides that right
• Non-discrimination, we will not discriminate against you for exercising your rights

California residents may submit requests through our privacy request form.

All users. To make a privacy request, use our privacy request form. Include a description of your request and enough information to verify your identity. We respond within the period required by applicable law.

11. Data security

We implement organizational and technical security measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

• Encryption in transit and managed encryption controls for supported data stores
• Azure Key Vault-backed key management for managed Azure services
• Role-based access controls, tenant isolation, and logged Staff operations
• Automated dependency and code security checks in the delivery workflow
• Documented incident response, vulnerability management, and recovery procedures

For full details on our platform security architecture, see our Security page.

No method of transmission or storage is completely secure. To report a vulnerability, contact us to arrange a secure way to share the details. Do not include credentials or sensitive technical details in the form. For security assessment requests, use the VeriProof security form.

12. Cookies and tracking technologies

Necessary cookies. We use session and security cookies that are required to operate the website and platform portal. These cookies remain enabled.

Google Analytics. We use Google Analytics for aggregate website measurement. We use page views and a limited event list to understand traffic, website performance, inquiry conversions, simulator use, and workflow evaluation. Google advertising storage, Google Signals, advertising personalization, and Google Ads links are disabled.

HubSpot. We use HubSpot for customer relationship management and lead attribution from submitted inquiry details. HubSpot processes inquiry form responses on our behalf. That processing is separate from analytics consent. We do not load HubSpot's browser tracking scripts on the public website.

Consent. We ask every visitor before non-essential analytics begin, wherever they are. That covers the European Economic Area, United Kingdom, Switzerland, and Canada, where opt-in is required, and it applies everywhere else too. Nothing from Google Analytics loads until you allow it. Every visitor can reopen Cookie settings in the website footer and withdraw consent. We honor Global Privacy Control signals by declining non-essential analytics.

Declining analytics does not prevent you from sending an inquiry. Inquiry details go to HubSpot to let our team respond, even when website analytics are denied.

Withdrawing consent stops future analytics and clears available first-party analytics storage in your browser. It does not remove information that providers already included in aggregated reports.

What we do not do. We do not use website analytics for ad retargeting or personalized advertising. We do not sell browsing data or use cross-site tracking for advertising.

13. Children's privacy

The VeriProof platform and website are for business professionals, not children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have collected information from a child, tell us through our privacy request form. Identify the request clearly so we can delete the information promptly.

14. AI and automated processing

VeriProof helps organizations govern AI actions and retain evidence of their decisions. We do not make automated decisions that produce legal or similarly significant effects about you as an individual when operating the platform. We process the decision records customers submit about their own AI systems. The platform does not profile individuals or generate automated outcomes about its end-users.

If you are a customer integrating VeriProof into an AI system that makes decisions about individuals, you are the data controller for that processing and are responsible for your own legal basis, notices, and rights-response obligations under applicable law.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, legal requirements, or product features. When we make material changes, we will:

• Update the effective date at the top of this page
• Notify platform customers by email at least 14 days before the change takes effect
• Include a summary of what changed on this page

What changed on October 5, 2026. We added Section 6 on the VeriProof apps for Slack and Microsoft Teams: what they receive and keep, what appears in those services, how we use the information, and when we delete it. We added matching notes to Sections 1, 2, 7, and 9, and renumbered the sections after Section 5. Nothing about our existing practices changed.

Continued use of the platform or website after the updated effective date constitutes acceptance of the revised policy.

16. Contact and data protection inquiries

For privacy questions, data subject requests, DPA inquiries, or concerns about our data practices:

RJR Labs LLC Privacy Team Privacy request form

We verify the request, confirm its scope, and respond within the period required by applicable law.