Legal
Privacy Policy
VeriVeri — Multi-LLM Consensus Fact-Verification
Version 2.0Last updated: 5 July 2026Effective: 5 July 2026
1. Who we are
This Privacy Policy explains how Northloop Group AB, organisation number 559579-7787, Birger Jarlsgatan 99B, 113 56 Stockholm, Sweden (“VeriVeri”, “we”, “us”), handles personal data — both on this website and in the VeriVeri software you deploy into your own cloud.
Contact for privacy enquiries: alex@northloop.se
Supervisory authority: Integritetsskyddsmyndigheten (IMY) — the Swedish Authority for Privacy Protection — imy.se
2. Two different things, two different roles
“VeriVeri” covers two separate things, and under the GDPR we play a different role in each. This distinction governs the whole policy.
| What it is | Our role under the GDPR |
|---|---|
| veriveri.io — this marketing and documentation website | We are the data controller for the limited data collected here (section 3). |
| The VeriVeri API — the service you deploy from the Azure Marketplace into your own Azure subscription | You are the controller; the software runs inside your cloud, not ours (section 4). |
3. The veriveri.io website (we are the controller)
This section applies to visitors to veriveri.io, where we decide why and how the following data is processed.
3.1 What we collect, and on what legal basis
| Data | Purpose | Legal basis (Art. 6(1)) |
|---|---|---|
| Contact details you send us | Respond to enquiries, arrange a demo or private offer, pre-contract discussions | (b) steps prior to a contract; (f) our legitimate interest in responding |
| Email / message content | Handle and record our correspondence | (f) legitimate interest in business communication |
| Server / access logs (IP, user-agent, timestamps) | Security, abuse prevention, availability, diagnostics | (f) legitimate interest in a secure, working site |
3.2 Cookies & analytics
veriveri.io sets only the cookies strictly necessary for the site to function. We do not use third-party advertising, cross-site tracking, or non-essential analytics cookies, and we do not embed third-party fonts or trackers that would disclose your IP address to third parties (fonts are self-hosted). If we introduce optional analytics in future, we will ask for your consent through a cookie banner first, and you will be able to withdraw it at any time.
3.3 Retention
- Enquiries & correspondence: kept for the duration of our discussions and for up to 24 months afterwards, then deleted.
- Server logs: retained for 90 days, then deleted or anonymised.
3.4 Recipients & international transfers
We keep the recipient list short and bind each processor by an Art. 28 agreement: website hosting on Microsoft Azure (Static Web Apps) in an EU region; email and business-productivity services via Microsoft 365 with EU data residency. We use no third-party analytics or advertising processors. We host and process website data within the EU/EEA. Where a processor may transfer data outside the EEA, we rely on an adequacy decision (Art. 45) or Standard Contractual Clauses with supplementary measures (Art. 46). Website data is protected by appropriate technical and organisational measures (Art. 32) — encryption in transit, access controls, and EU-hosted infrastructure. We do not sell personal data, and do not carry out automated decision-making with legal effect.
3.5 If you acquire VeriVeri through the Microsoft Azure Marketplace
When you acquire or deploy VeriVeri through the Azure Marketplace, Microsoft provides us — as the publisher — with limited details about the acquiring organisation and the person who deployed the offer, typically name, business email, company, country, and the offer/plan acquired. We are the controller for this data and use it to fulfil and support your order, provide the software and updates, and contact you about your deployment. Legal basis: Art. 6(1)(b) (performance of, or steps toward, a contract) and Art. 6(1)(f) (our legitimate interest in supporting our customers). We retain it for the duration of the business relationship and for as long as legal, tax and accounting obligations require, then delete it. Microsoft’s own processing of marketplace and account data is governed by the Microsoft Privacy Statement. You can ask us to stop non-essential contact at any time.
4. The VeriVeri software you deploy (you are the controller)
The software runs entirely inside your own Azure subscription. VeriVeri is delivered as a customer-managed Azure Marketplace Managed Application. When you deploy it, all of its infrastructure — the API, the PostgreSQL database, the Key Vault, and the connections to the AI models — is created in your cloud tenant, in the region you choose. You retain full control over data residency, and the application is designed to support keeping your data within EU boundaries. Content you send for verification is not transmitted to us and is not processed on our systems.
4.1 Roles under the GDPR
- You (our customer) are the controller of the content your users submit for verification — the grounding context and the AI-generated text, which may contain personal data. You decide the purposes and means, and you configure retention, storage and masking (section 4.4).
- We are the software provider — a licensor of the application, not the operator of a hosted service. In normal operation we neither receive nor process your verification content, so for that content we are ordinarily neither controller nor processor.
- Support access (the one exception). The Marketplace managed-application model grants our support group a role on the managed resource group in your subscription so we can assist when you ask us to. Where that access lets us process personal data in your environment at your request, we act as your processor under a Data Processing Agreement (Art. 28) — see our DPA.
4.2 What the software processes
| Data element | What it is | Where it lives |
|---|---|---|
| Grounding context + AI text | The pair submitted to the verification endpoint; may contain personal data of your data subjects | In transit to your AI models; at rest in your database only if payload storage is on (4.4) |
| Verdicts & issues | The verification result derived from the pair | Returned to your caller; audit-logged in your database |
| Operational metadata | Request IDs, token counts, latency, cost, model/source used, an operator identifier | Your database and logs, in your subscription |
| API keys & operator identities | Credentials and the identities of your dashboard operators | Hashed / secured in your Key Vault and database |
4.3 Where content goes — the AI models you choose
To reach a verdict, the software sends each verification to the AI models you connect; these are your sub-processors, under your control:
- Azure AI Foundry models in your own Azure subscription (the default) — governed by your Microsoft agreement and kept in your chosen region.
- Optional external LLM providers you may add (for example the OpenAI or Anthropic APIs), which may run in another cloud or on your own infrastructure. If you enable these, content leaves your Azure boundary for that provider, which may involve a transfer outside the EEA depending on where that provider processes it. You are responsible for assessing that transfer and putting appropriate safeguards in place (Art. 46) before enabling it. External providers are off unless you add them.
4.4 Privacy controls built in (data protection by design — Art. 25)
- Payload storage off: store only verdicts and technical metadata — no source text, claims or issues at rest.
- PII masking: optional redaction of names, addresses, emails, phone numbers and IDs in stored records before they are written.
- Retention & automatic erasure: a configurable retention window (default 30 days) with an automatic purge sweep.
- Right-to-erasure endpoint: an operator API to delete stored records by request ID, user identifier, or date, to help you satisfy erasure requests (Art. 17).
- Data residency in your control: you choose the deployment region, and the application is designed to support keeping your data within EU boundaries; the database and Key Vault are private, with no public network exposure.
- No phone-home: the deployed application sends VeriVeri no verification content, usage telemetry, licence check, or heartbeat. Any diagnostics it emits (e.g. Azure Application Insights) are written to your own Azure Monitor workspace, under your control.
Because you control the deployment, you choose these settings. For personal data we recommend payload storage off (or masking on) with a short retention window, and completing a DPIA (Art. 35) where your use is likely to be high-risk. Where your content may contain special-category data (Art. 9) — for example health, biometric or similar information — you are responsible for identifying a valid Art. 9 condition before processing it; the payload-off and masking controls above are designed to help you minimise such data at rest.
4.5 Security (Art. 32)
The software is built to let you run it securely: TLS in transit; a private database with EU residency; secrets held in Key Vault (never in code or logs); API keys stored only as peppered hashes; role-based dashboard access that denies by default; rate limiting; and an audit log. Operating these controls within your environment is your responsibility as controller.
4.6 Data Processing Agreement
If you require a DPA to govern support access, or a records-of-processing (Art. 30) entry for your files, contact alex@northloop.se. Our standalone DPA is published at veriveri.io/dpa.
5. Your rights & how to exercise them
Under the GDPR you have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting prior processing.
- For website data (section 3): contact us at alex@northloop.se. We respond within one month (Art. 12(3)).
- For data inside a deployed VeriVeri instance (section 4): the controller is the organisation that deployed it — please direct your request to them. If you reached them through us, we will help route it.
You also have the right to lodge a complaint with a supervisory authority (Art. 77) — our lead authority is IMY (imy.se) — and you may also complain to the authority where you live or work.
6. Breaches, children & changes
6.1 Personal-data breaches
For website data, we assess and, where required, notify the supervisory authority within 72 hours (Art. 33) and affected individuals where the risk is high (Art. 34). For a deployed instance, breach obligations rest with you as controller; the software’s logging and audit trail are designed to support your assessment.
6.2 Children
The website and the software are intended for business use and are not directed at children.
6.3 Changes to this policy
We may update this policy; the “Effective” date above marks the current version, and material changes will be highlighted on this page.
7. Contact
Northloop Group AB · Org. nr 559579-7787 · Birger Jarlsgatan 99B, 113 56 Stockholm, Sweden · alex@northloop.se.
We have not appointed a Data Protection Officer; our processing does not meet the Article 37(1) thresholds that would require one. Privacy questions go to alex@northloop.se.