Privacy Policy

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), the Data Fiduciary responsible for your personal data is:

AskVerum™ AI Technologies Private Limited (trading as AskVerum)
c/o Regus
9th Floor, Tower A, Spaze ITech Park, Sohna Road
Gurgaon, Haryana 122018
India
CIN: U62010HR2026PTC149657
GSTIN: 06ABGCA5579G1ZG
Phone: +91 96674 45917
Platform: https://ask-verum.com
Email: info@ask-verum.com

For users in the EEA/UK, AskVerum™ AI Technologies Private Limited acts as data controller for account and usage data described in this policy.

We collect the following categories of personal data, with your consent where required:

Account Information

When you sign in using Google or another provider, we receive:

• Name and email address
• Profile image (if provided by the authentication provider)
• Authentication identifiers

Usage Information

We collect information about how you use the Service, including:

• Pages visited and features used
• Device type and browser information
• Session activity and timing
• Log data and diagnostics

Note: IP addresses are processed only in one-way hashed form for security and abuse-prevention purposes and are not stored in identifiable form.

User Content

Queries, feedback, attachments, and other content you submit are processed to provide the Service and appear in your query history for the life of your account. Investigation text may include sensitive topics (health, finance, legal, or commercial matters) that you choose to submit — please avoid including information you are not authorised to share.

We may use de-identified and aggregated usage statistics (for example error rates, latency, and feature adoption) to improve reliability and security. This is separate from model training — see Section 4.

Launch waitlist (optional)

If you join our pre-launch waitlist, we collect name, email, and mobile number with separate consent checkboxes for email and SMS updates. Waitlist data is used only for launch notifications and early-bird benefits described at signup — not for running investigations.

We use collected information to:

• Provide and maintain the Verum platform
• Authenticate users and maintain session security
• Improve system performance and reliability
• Detect and prevent abuse, fraud, or security incidents
• Conduct analytics and product improvement (in anonymised or aggregated form)
• Communicate important updates about the Service

We obtain your consent before processing personal data for purposes not listed above.

Verum uses third-party AI providers to generate, evaluate, and process responses. Query text is transmitted to these providers for processing. We select providers that operate under appropriate data processing agreements. AI-generated outputs may contain inaccuracies and should not be relied upon as professional advice.

We do not use your investigation queries, uploads, or account data to train AskVerum's models or to improve third-party foundation models. Your content is processed to deliver your investigation, maintain security, and operate the Service — not for model training, as described in our agreements with AI subprocessors.

We do not sell or share personal data for cross-context behavioural advertising.

We use subprocessors to operate the Service. Query text is sent to AI providers for processing; account data stays with our infrastructure vendors unless you explicitly export or share results.

We require subprocessors to process data only on our instructions and under appropriate contractual safeguards (including Standard Contractual Clauses where required for international transfers).

Cross-border transfers (India): Personal data may be processed on servers outside India (including the United States and EU). For Indian users, we rely on your consent (including via /consent where required), contractual safeguards with subprocessors, and applicable DPDP rules for cross-border transfer. You may withdraw consent as described in Section 8.

Essential storage: We use authentication cookies/tokens and local storage (for example session state and theme preference) that are necessary to operate your account. Signing in constitutes consent for these essential technologies.

Analytics: We use Plausible Analytics, which is configured without cookies and without cross-site tracking. Plausible collects aggregated page-view statistics only — not personal profiles. Under GDPR, this generally does not require a separate cookie banner; we disclose it here for transparency.

India (DPDP): Indian users who submit investigations must also accept data-processing consent at /consent before queries are processed. You may disable non-essential browser storage via settings, but essential session cookies are required to use the Service.

We retain personal data only as long as necessary for the purposes below:

You may request earlier deletion subject to legal exceptions — see Section 8 and our privacy-request process below.

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access personal data we hold about you
• Correct inaccurate or incomplete personal data
• Erasure of your personal data (subject to legal retention requirements)
• Withdraw consent at any time (without affecting lawfulness of prior processing)
• Nominate another individual to exercise your rights in the event of death or incapacity
• Raise a complaint with the Data Protection Board of India if your grievance is not resolved

To exercise any of these rights, contact our Grievance Officer (see Section 13). We will respond within the timeframe prescribed by applicable law (typically within 30 days).

To access, correct, export, or delete your personal data:

1. Email grievance@ask-verum.comfrom your registered account email with subject "Privacy Request" and the action you seek.
2. We verify identity (account email match; additional checks for sensitive requests).
3. We respond within 30 days (GDPR: one month; California: 45 days where applicable).
4. Export: we provide a structured summary of account data and query metadata on request.
5. Deletion: we delete or anonymise account data except where law requires retention (for example payment records).

Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies, AskVerum™ AI Technologies Private Limited acts as data controller for account and usage data. Our lawful bases include:

• Contract (Art. 6(1)(b)): providing the Service you sign up for
• Legitimate interests (Art. 6(1)(f)): security, abuse prevention, product improvement (balanced against your rights)
• Consent (Art. 6(1)(a)): where we ask explicitly (e.g. optional marketing)
• Legal obligation (Art. 6(1)(c)): tax, fraud, and regulatory records

You have the right to:

• Access, rectify, or erase personal data
• Restrict or object to certain processing
• Data portability (structured, machine-readable export on request)
• Withdraw consent without affecting prior lawful processing
• Lodge a complaint with your supervisory authority

International transfers use appropriate safeguards (e.g. SCCs with US subprocessors). Automated decision-making: Trust Scores and AI outputs are informational only — not sole legal or clinical decisions about you.

Exercise GDPR rights: grievance@ask-verum.com. We respond within one (1) month unless extension is required by law.

California residents have rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA. We do not sell or share personal information for cross-context behavioural advertising.

Categories collected (last 12 months):

• Identifiers (name, email, account ID)
• Internet activity (usage logs, device/browser)
• User content (queries you submit — may include sensitive topics you choose to enter)
• Commercial information (subscription tier, payment references via Razorpay)

Sensitive personal information (CPRA): You may submit health, financial, or other sensitive information inside investigation queries. We process it only to deliver your investigation, not for profiling or advertising. We do not use SPI to infer characteristics about you for marketing. You may limit processing by not including SPI in queries, or request deletion via grievance@ask-verum.com.

You may request:

• Access to personal information we hold about you
• Deletion (subject to legal exceptions)
• Correction of inaccurate information
• Limit use of sensitive personal information (we do not use SPI for profiling)

We will not discriminate against you for exercising these rights. Authorized agents may submit requests with proof of authority. Contact: grievance@ask-verum.comwith subject line "California Privacy Request".

We implement reasonable technical and organisational safeguards including encrypted transmission (TLS), hashed sensitive identifiers, role-based access controls, and audit logging. However, no system can guarantee absolute security.

Data breach notification: If we become aware of a personal data breach likely to result in risk to your rights, we will notify the relevant supervisory authority within 72 hours where required (for example under GDPR), and notify affected users without undue delay when the breach is likely to result in a high risk to you. Indian users: we will notify the Data Protection Board and affected individuals as required under the DPDP Act and applicable rules. California users: we will provide notice as required under California law. Report suspected incidents to grievance@ask-verum.com.

Verum is not intended for children under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

For privacy-related queries, concerns, or to exercise your data rights, please contact our Grievance Officer:

Najmul Ahasan
Grievance Officer — AskVerum™ AI Technologies Private Limited
c/o Regus
9th Floor, Tower A, Spaze ITech Park, Sohna Road
Gurgaon, Haryana 122018
India
Phone: +91 96674 45917
Email: grievance@ask-verum.com
Platform: https://ask-verum.com

We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days, or as prescribed under applicable law.

We may update this Privacy Policy from time to time. We will indicate the date of the most recent update at the top of this page. For material changes that expand how we use personal data, we will provide notice by email (to your account address) or a prominent in-product notice at least 30 days before the change takes effect where practicable.

Where the DPDP Act or GDPR requires renewed consent for a new purpose, we will obtain it before processing (Indian investigation users may be directed to /consent). Continued use after the effective date, where permitted by law, constitutes acceptance of non-material updates.