VeRa — Privacy Policy

1. Who we are

VeRa is operated by REDMINDSYS LTD ("RedMindsys", "we", "us", "our"), a company incorporated in England & Wales (Companies House no. 17324029). For the purposes of the UK GDPR and the Data Protection Act 2018, RedMindsys Ltd is the data controller for the personal data described in this policy.

• Registered office: 9 William Holland Close, Browsover, Rugby, CV21 1WF, United Kingdom
• Privacy contact: max@redmindsys.uk

2. What VeRa does (and why that matters for your privacy)

VeRa is an on-screen overlay that fact-checks content. When you activate the lens over content in any app, VeRa (1) captures the selected area of your screen on your device; (2) extracts the text from it using on-device optical character recognition (OCR) running entirely on your phone; and (3) sends only the extracted text of the claim to our servers to retrieve sources and produce a verdict.

The screenshot itself never leaves your device. We do not receive, store, or transmit images of your screen. What we process is the recognised text of the claim you chose to check. Because you can point the lens at any content, the text of a claim may sometimes contain personal data — your own or that of third parties. We minimise what we retain (see section 6).

3. What data we process

Data	Source	Purpose
Recognised text of the claim (may incidentally contain personal data)	Sent from the app after on-device OCR	To retrieve sources and generate a fact-check verdict
Feedback you submit on a verdict	Provided by you	To improve verdict quality
Limited technical/security data — a hashed identifier derived from your IP, and rate-limit data	Generated when the app contacts our backend	Abuse prevention, rate limiting, service integrity

What we do NOT process:

• We do not collect screenshots or images of your screen.
• VeRa has no user accounts and requires no registration.
• VeRa takes no payments in this version.
• We do not store your raw IP address — only a one-way SHA-256 hash used for rate limiting and to de-duplicate feedback, which cannot be reversed to your IP.
• We do not log your request authentication token or authorisation headers.
• The on-device OCR component processes images locally on your device; it does not send that image data to us.

4. Legal bases for processing (UK GDPR Article 6)

• Processing the recognised claim text to deliver the verdict you requested — legitimate interests (Art 6(1)(f)): providing the core function you asked for.
• Handling optional feedback you submit — consent (Art 6(1)(a)).
• Security, abuse prevention, and service integrity — legitimate interests (Art 6(1)(f)).

Any future use of data to improve our models would be introduced only on an opt-in basis with separate, explicit consent and a dedicated notice. We do not do this today.

5. Who we share data with (sub-processors)

We use a small number of trusted service providers that process data only on our instructions and under contract.

Sub-processor	Role	What is shared
Tavily	Source retrieval / search	The text of the claim (to find relevant sources)
Cloudflare	Secure tunnel, hosting, network	Network traffic to our backend, including connection metadata such as IP at the network layer
On-device OCR	Text recognition	Nothing transmitted to us — runs locally on your device

Our AI model currently runs on local/self-hosted infrastructure. When we migrate model inference to a cloud provider, that provider will be added as a sub-processor and this policy updated. We do not sell your personal data, and we do not share it for advertising. A current sub-processor list is available on request.

6. Data retention

We keep personal data only as long as necessary for the purposes above, and deletion runs automatically (on start-up and on a schedule):

• Verdict cache (may contain the claim text): no longer than 90 days, then automatically deleted.
• Request / telemetry records: the claim is stored only as an irreversible hash (not readable text) and deleted within 30 days.
• Feedback you submit: no longer than 12 months.
• Rate-limit and security data: the hashed IP identifier and counters are held only transiently.

7. Your rights

Under the UK GDPR you have the right to access, rectify, erase, restrict, object to, and (where applicable) port your personal data, and to withdraw consent where processing is based on consent. To exercise any of these, contact max@redmindsys.uk. We will respond within one month (extendable by up to two further months for complex requests, with notice). Because VeRa has no accounts, we may need additional information to locate any data associated with you and to verify your identity.

You also have the right to complain to the Information Commissioner's Office (ICO) (ico.org.uk). We would appreciate the chance to address your concerns first.

8. International transfers

Some of our sub-processors process data outside the UK — in particular source retrieval (Tavily) and, when introduced, cloud model inference are likely to involve processing in the United States; Cloudflare operates a global network. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Addendum, or Standard Contractual Clauses, as applicable.

9. Children

VeRa is intended for users aged 18 and over and is not directed at children. We do not knowingly process the personal data of anyone under 18.

10. Security

We protect the service with technical and organisational measures, including request authentication, rate limiting, a CORS allow-list, security headers, and idempotent handling of feedback. No system is perfectly secure, but we work to protect the limited data we process.

11. Changes to this policy

We may update this policy from time to time. We will change the effective date and, for material changes, provide a more prominent notice. Continued use of VeRa after an update means you accept the revised policy.

12. Contact

REDMINDSYS LTD — 9 William Holland Close, Browsover, Rugby, CV21 1WF, United Kingdom · max@redmindsys.uk