Privacy Policy

1. Data Controller vs. Data Processor

When your firm uploads legal documents, contracts, or client agreements to Verdify, your firm remains the Data Controller. Verdify acts strictly as a Data Processor. It is the responsibility of the firm/lawyer to ensure they have the proper legal basis and client consent to process the uploaded documents using our systems.

2. Our AI Sub-processors & "Zero-Training" Promise

Verdify provides advanced legal intelligence by leveraging industry-leading Large Language Models (LLMs) operated by our sub-processors (Google LLC and Anthropic PBC).

Strict Promise: We access these models exclusively through paid, commercial API tiers whose terms prohibit the provider from using customer content to train or improve their models. Your text, documents, and queries are never used to train, improve, or fine-tune their foundational models. Providers may retain API inputs for a limited period solely for abuse monitoring and legal compliance under their commercial terms, after which they are deleted.

3. Our Sub-processors

Verdify shares data only with the infrastructure sub-processors required to deliver the service:

• Supabase — database, file storage, and authentication (servers in the EU/US)
• Vercel Inc. — application hosting and delivery
• Google LLC — AI processing (Gemini API, paid commercial tier)
• Anthropic PBC — AI processing (Claude API, commercial terms)
• Resend — transactional email delivery (e.g. regulatory monitoring alerts)
• Lenco — payment processing; card and mobile-money details are handled entirely by Lenco and never touch Verdify's servers

We do not sell your data or share it with any third party beyond this list.

4. Data Localization & Cross-Border Transfers

Our database and hosting infrastructure (Supabase, Vercel) is physically located in data centers in the EU and US, and AI processing takes place on Google and Anthropic servers outside Zambia. All transmission is encrypted. By using Verdify — and by ticking the consent box shown before any document upload — you provide express consent to this cross-border transmission of your queries and documents to the sub-processors listed above.

The Zambia Data Protection Act No. 3 of 2021 imposes stricter localisation rules on sensitive personal data (e.g. health information, marital status, biometric data, and similar categories defined in section 2 of the Act). For this reason we strongly advise firms to redact or anonymise sensitive personal data from documents before upload. Verdify maintains a data-localisation roadmap for Zambian-resident storage as regional infrastructure options mature.

5. Data Deletion and Security

Verdify employs stringent tenant isolation: every database query is scoped to your firm by Row-Level Security. Encryption in transit (TLS 1.2+) and AES-256 encryption at rest are standard. If you delete a document from Due Diligence or Firm Memory, the original file, its extracted text, and all associated vector embeddings and analysis records are permanently, irreversibly destroyed via cascading database deletions.

Research queries and generated outputs are retained in your firm's private audit log — accessible only to your firm's administrators — to support professional record-keeping and compliance review.

6. Contact Us

For any questions regarding our data practices, or to issue a Data Subject Access Request (DSAR), please contact the engineering team at Simplenaire AI at verdifyoffice@gmail.com.