Privacy Policy

Last updated: November 10, 2026

This Privacy Policy explains how Veribl collects, uses, shares and protects personal data when you visit our website, use the Veribl platform, or contact us. It also explains the choices and rights you have.

The short version

We are an EU company based in Riga, Latvia, and we handle personal data under the EU General Data Protection Regulation (GDPR).
For our website and for the people who use the Veribl dashboard, we decide how data is used: we are the controller.
For consumers who scan a product’s QR code, register a product or chat on a product page, the brand decides. We run the page on the brand’s behalf as its processor. See the Privacy Notice for Product Pages.
Website analytics only run if you accept them in our cookie banner. We do not sell personal data, and we do not share it for cross-context behavioral advertising.
We do not use customer content or consumer data to train AI models.

1. Who we are

Veribl (“Veribl”, “we”, “us”, “our”) is a company established in Riga, Latvia. We provide a platform that helps product brands create Digital Product Passports, run QR-connected product pages, manage product registrations and warranties, and support their customers after the sale.

This policy covers the following services (together, the “Services”):

our marketing website at veribl.com;
the Veribl dashboard at app.veribl.com, our REST API, webhooks and connectors (including the MCP connector for AI assistants);
our sales, marketing, events and support communications.

1.1 Controller and processor roles

Veribl as controller. We are the controller of personal data about website visitors, people who sign up for or use a Veribl account (“Business Users”), billing contacts, and people we talk to in sales, partnership and marketing contexts.

Veribl as processor. Our customers (“brands”) use Veribl to publish product pages at go.veribl.com or on their own custom domains, and to collect information from their consumers there. For that consumer data, the brand is the controller and Veribl processes it only on the brand’s documented instructions, under our Data Processing Agreement with that brand. This policy describes that processing only briefly; the details are in the Privacy Notice for Product Pages and in the brand’s own privacy policy.

2. Personal data we collect

2.1 Website visitors

Technical and log data: IP address, browser and device type, operating system, referring URL, pages requested and timestamps. Our hosting and security providers process this to deliver the site and protect it from abuse.
Analytics data (only with your consent): pages viewed, clicks, scroll depth, approximate location derived from IP, campaign parameters, and session recordings with form inputs masked. See the Cookie Notice.
Information you give us: your name, work email, company, role, phone number and message when you book a demo, use a free tool, subscribe to updates, or contact sales or support.
Website chat: the messages you send to the AI assistant on our website, the pages you view during the chat, and any email or website you leave there. An AI service provider generates the answers. Our team reads conversations to follow up when you ask us to and to improve our website, and may add them to the record of your company in our CRM when your network identifies it. We keep website chat conversations for up to 12 months. To keep automated abuse out, the chat uses Cloudflare Turnstile, which checks in the background that a person is using it; Cloudflare’s processing for this is described in the Cloudflare Turnstile Privacy Addendum.

2.2 Business customers and their users

Account data: name, work email, company name, role, password (stored as a salted hash), two-factor authentication settings, and team membership, roles and permissions. If your company uses SAML single sign-on, we receive identity attributes (such as name and email) from your identity provider.
Billing data: billing contact, company and tax details, plan, invoices and payment history. Card and bank details are collected and stored by Stripe; we never see or store full card numbers.
Customer content: the information you upload or create in Veribl, such as product data, serial and model numbers, images, manuals, articles, warranty terms, Digital Product Passport data, brand assets and custom domain settings. Customer content is usually about products, not people, but it can include personal data (for example, a named contact in a passport).
Integration data: if you connect Shopify, we import product and order data you authorize, which can include your shoppers’ order details. If you connect an AI assistant through our MCP connector, or use our API or webhooks, we process the requests and data exchanged through them.
Usage and device data: features used, pages viewed in the dashboard, API calls, IP address, browser and device information, error reports, and an audit log of security-relevant actions (such as sign-ins, permission changes and exports). We use PostHog (EU cloud) for product analytics in the dashboard, including session recordings with form inputs masked.
Communications: support requests, feedback, survey answers and call notes.

2.3 Consumers on brand product pages

When a consumer scans a QR code or visits a brand’s product page, we process data on the brand’s behalf: scan data (timestamp, approximate country or region from IP, device type), product registration and ownership details, proof of purchase, warranty claims, chat messages with the AI support assistant, feedback and reviews, and marketing consent records. The brand decides what it collects and why. Read the Privacy Notice for Product Pages for details.

2.4 Data from other sources

Service providers: payment status from Stripe, email delivery events from our email provider, and identity data from your SSO provider.
Your colleagues: when a teammate invites you to a Veribl account, they give us your name and email.
Public and business sources: for business-to-business sales and partnerships, we may collect professional contact details (name, role, company, work email, public profile) from company websites, trade fair exhibitor lists, professional networks and business data providers.

3. How we use personal data and our legal bases

Under the GDPR (Article 6) we need a legal basis for each use of personal data. This table shows what we do as a controller and why we are allowed to.

Purpose	Data used	Legal basis
Create and run your account; provide the platform, API, integrations and support	Account, customer content, integration, usage, communications	Contract (Art. 6(1)(b)); for users invited by a customer, our legitimate interest in serving that customer (Art. 6(1)(f))
Billing, trials, plan changes, invoicing and collections	Account, billing	Contract (Art. 6(1)(b)); legal obligation for tax and accounting (Art. 6(1)(c))
Service messages: security alerts, trial and billing notices, changes to terms	Account	Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
Keep the Services secure: authentication, 2FA, audit logs, abuse and fraud prevention, rate limiting	Account, technical and log, usage	Legitimate interests (Art. 6(1)(f)); legal obligation where security law applies (Art. 6(1)(c))
Understand and improve the dashboard (product analytics, debugging, error monitoring)	Usage and device data	Legitimate interests (Art. 6(1)(f))
Website analytics and session recordings	Analytics data	Consent (Art. 6(1)(a)), given through the cookie banner
Answer demo requests and enquiries	Information you give us	Steps at your request before a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f))
B2B sales outreach and marketing emails to business contacts	Professional contact details, engagement with our emails	Legitimate interests (Art. 6(1)(f)), or consent where the law requires it (Art. 6(1)(a)). You can opt out at any time.
Comply with law, respond to lawful requests, and establish or defend legal claims	Any relevant data	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))
Corporate transactions (such as a financing, merger or sale)	Any relevant data, minimized	Legitimate interests (Art. 6(1)(f))

Where we rely on legitimate interests, we have weighed them against your rights and you can object (see Section 9). Where we rely on consent, you can withdraw it at any time without affecting processing that took place before.

When we act as a processor for brands, we process consumer data only to provide the Services the brand has set up, under the brand’s instructions. The brand is responsible for having a legal basis, including any consent needed for marketing emails.

4. AI features

Veribl includes features that use AI models:

AI support chat on product pages. Consumers can ask questions about a product. The assistant answers from the content the brand has provided, such as manuals, articles and warranty terms. Consumers are told that they are talking to an AI assistant. Messages and the relevant product content are sent to our AI provider to generate an answer.
AI translations. Brands can translate product content into other languages. The content being translated is sent to our AI provider.
Chat and feedback insights. Brands can see summaries and sentiment of chats and feedback (for example, an “owner health” indicator) to spot unhappy customers and improve support.
MCP connector. Customers can connect their own AI assistant to Veribl through our Model Context Protocol (MCP) connector to read and update their product content. The customer chooses and controls that assistant; data it receives is handled under the customer’s agreement with its provider.

Our AI provider processes data only to provide the feature, under a data processing agreement, and does not use it to train its models. We do not use customer content or consumer data to train AI models.

AI output can be wrong. Customers are responsible for reviewing AI-generated content they publish. None of our AI features make decisions that produce legal or similarly significant effects about a person (within the meaning of GDPR Article 22); for example, warranty claims are decided by the brand, not by AI. We ask consumers not to share sensitive information, such as payment card numbers, government ID numbers or health information, in chat.

5. How we share personal data

We do not sell personal data. We share it only in the following situations:

Service providers and subprocessors who host, secure and operate the Services for us, under written contracts that limit their use of the data. The categories are listed below. Business customers can request the current list of providers under their Data Processing Agreement.
The brand you interact with. Data collected on a product page is available to the brand that runs it. Within a business account, data is visible to that account’s team members according to their roles.
Integrations you or your company enable, such as Shopify, webhooks, the API or an AI assistant connected through MCP. Data then flows to the destination you configured.
Professional advisers such as lawyers, accountants and auditors, under confidentiality duties.
Authorities, when required by law or to protect rights, safety and property. We review requests and push back on those that are overly broad. Where permitted, we notify the affected customer first.
Corporate transactions. If Veribl is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of that deal, subject to this policy.
With your consent or at your direction.

Category	Purpose
Hosting and infrastructure providers	Running, storing, securing and backing up the Services
Payment processor (Stripe)	Payments and billing
Email delivery providers	Sending account emails and emails brands send to their customers
AI service providers	AI chat assistance and translations
Analytics providers	Understanding how our website and product are used (website analytics only with your consent; see our Cookie Notice)

6. International data transfers

We are based in the EU, but some of our providers process data outside the European Economic Area (EEA), mainly in the United States and Canada. When personal data leaves the EEA or the UK, we rely on one of these safeguards:

an adequacy decision of the European Commission (for example, for Canada, or for US companies certified under the EU-U.S. Data Privacy Framework);
the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved, and supplementary measures where needed.

You can ask us for more information about these safeguards at [email protected].

7. How long we keep data

We keep personal data only as long as we need it for the purposes above, then delete or anonymize it.

Data	Retention
Account and customer content	For as long as the account is active. After an account is closed, we delete personal data within 30 days, except as described below and in our encrypted backups, which are kept for up to 12 months and then overwritten.
Published Digital Product Passports	Published passport versions stay publicly available for at least 10 years after the latest version, even if the customer cancels or closes its account, because EU product rules require passports to remain accessible. We ask customers not to put personal data in passports beyond what the law requires.
Billing and tax records	7 years, or longer if accounting and tax law requires.
Security and audit logs	For as long as needed to secure the Services and investigate incidents, then deleted.
Website and product analytics events	Raw events up to 14 months; aggregated statistics that no longer identify anyone may be kept longer.
Sales and marketing contacts	Until you opt out or object, or after 2 years without any interaction. We keep a minimal suppression record so we don’t contact you again.
Consumer data on product pages (as processor)	As set by the brand. Brands can delete individual consumer records at any time; all consumer data is deleted or returned when the brand’s contract ends, as set out in our Data Processing Agreement with that brand.

We may keep data longer where needed to comply with law, resolve disputes or enforce our agreements.

8. Security

We protect personal data with technical and organizational measures, including:

encryption in transit (TLS 1.2 or higher) and at rest;
strict separation of each customer’s data within the platform;
role-based permissions, two-factor authentication and SAML single sign-on;
an audit log of security-relevant account activity;
signed webhooks;
least-privilege access for our staff and regular dependency updates;
an incident response process, including notifying customers and authorities as required by law.

No system is perfectly secure. If you find a vulnerability, please report it to [email protected]. More detail is on our Trust page.

9. Your rights

9.1 EEA and UK

Under the GDPR and the UK GDPR you have the right to:

Access your personal data and get a copy of it;
Rectify data that is inaccurate or incomplete;
Erase your data in certain cases;
Restrict how we use your data in certain cases;
Data portability: receive data you gave us in a machine-readable format, or have it sent to another company;
Object to processing based on legitimate interests, and to direct marketing at any time;
Withdraw consent at any time, where we rely on consent;
Complain to a data protection authority (see Section 14).

9.2 United States

Depending on where you live, US state privacy laws (such as the California Consumer Privacy Act, as amended) may give you the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale, sharing for cross-context behavioral advertising, or use for targeted advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for using your rights. You may use an authorized agent; we may ask for proof of their authority. If we deny your request, you can appeal by replying to our decision.

9.3 Consumers of brands that use Veribl

If you registered a product, chatted or left feedback on a brand’s product page, the brand controls that data. Please contact the brand directly. If you send your request to us, we will forward it to the brand and help it respond. Every marketing email sent through Veribl contains an unsubscribe link.

9.4 How to make a request

Email [email protected]. Business Users can also update most account details in the dashboard. We may need to verify your identity before acting on a request. We respond within one month, which may be extended by two further months for complex requests; we will tell you if that happens. Requests are free unless they are clearly unfounded or excessive.

10. Marketing choices

You can unsubscribe from our marketing emails using the link in any of them, or by writing to us. Service messages about your account, security and billing are not marketing and will continue while you have an account.

11. Children

The Veribl website and dashboard are for businesses and are not directed at children. We do not knowingly collect personal data from children under 16 for our own purposes. If you believe a child has given us personal data, contact us and we will delete it. Product pages are run by brands, which are responsible for any age-related requirements of their own products and audiences.

12. Cookies and similar technologies

We use strictly necessary cookies to run our website and the dashboard (for example, to keep you signed in and protect forms). Analytics tools on our website, Google Analytics 4, PostHog and Microsoft Clarity, load only after you accept them in the cookie banner, and you can change your choice at any time using the “Your Privacy Choices” link at the bottom of every page. Product pages run for brands use only strictly necessary cookies unless the brand enables something else. Full details, including a list of cookies, are in our Cookie Notice.

13. Changes to this policy

We will update this policy when our practices change. We will post the new version here with a new “Last updated” date and, for material changes, notify account owners by email or in the dashboard before the change takes effect. Where the law requires your consent to a change, we will ask for it.

14. Contact us and complaints

Questions, requests or concerns about privacy: [email protected]. Security reports: [email protected]. Other legal matters: [email protected].

Veribl, Riga, Latvia.

We would like the chance to resolve any concern first, but you have the right to lodge a complaint with a supervisory authority. Our lead authority is the Latvian Data State Inspectorate (Datu valsts inspekcija), dvi.gov.lv. You can also complain to the authority in the EU country where you live or work, or, in the UK, to the Information Commissioner’s Office.