Privacy Policy

1. Two very different roles — read this first

Verenna acts in two capacities, and which one applies changes who you should talk to.

For information about the people an organization serves, employs or raises money from — the records inside a customer's workspace — that organization is in charge. It decides what to collect, why, and how long to keep it. We hold and process that information strictly on its instructions, as its service provider. In data-protection terms, the organization is the controller and Verenna is the processor. If your information is in an organization's Verenna workspace and you want to see, correct or delete it, contact that organization. We will help them respond, but we cannot act on their records without their instruction.

For information about the people who run and buy Verenna — account holders, administrators, billing contacts, people who email us or visit our site — we are in charge, and this policy describes what we do with it directly.

An organization can also choose to share some of its records with another organization that uses Verenna. When it does, the receiving organization is in charge of the copy it receives, in the same way. Section 6 explains how that works.

2. Information we hold as the service provider

When an organization uses Verenna, the records it creates may include: identifiers such as name, email address, phone number and postal address; employment information such as role, start date and credentials; operational records such as schedules, hours worked and supervision logs; communications, including email and text messages sent through the platform and voice notes where the organization has authorized them; and free-text notes written by its staff.

The people these records concern may include the organization's staff and contractors, applicants, the individuals it serves and their guardians, and its donors, payers, vendors and other contacts.

We treat this whole dataset as sensitive, because of what it is about and who it concerns — not only the fields a law happens to name. Voice recordings and their transcripts are classified as sensitive explicitly.

We do not decide what goes into these records. The organization does.

3. Information we hold in our own right

Account and profile information: the name, work email address and organization of the people who sign up and administer an account, and their authentication details.

Billing information: the billing contact's name and email, invoices and subscription history. Card details go directly to our payment processor; we do not store them.

Usage and technical information: log records of requests to the Service, including timestamps, the action taken, and technical metadata needed to keep the Service secure and working. Our logging pipeline strips personal information from log records before they are written.

Support and correspondence: what you tell us when you contact support, report a security issue, or ask a question.

4. What we use it for

As a service provider, we use customer records only to provide the Service to that customer: storing and retrieving them, running the features the customer has turned on, sending the communications the customer sends, keeping the Service secure, and helping when the customer asks us to.

In our own right, we use account, billing, usage and support information to run our business: to give people access, to bill and collect fees, to provide support, to keep the Service secure and detect abuse, to understand which features are used so we can improve them, and to send service and administrative messages.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for advertising at all.

5. Our legal grounds (where GDPR or UK GDPR applies)

Where we process customer records as a processor, our instruction comes from the customer, and the customer is responsible for having a lawful basis.

Where we process information as a controller, our grounds are: performance of a contract, for giving account holders access and billing them; legitimate interests, for keeping the Service secure, preventing abuse, understanding usage and improving the product, balanced against the rights of the people concerned; legal obligation, for records we are required to keep; and consent, where we ask for it, which you can withdraw at any time.

6. Who we share it with

Providers who help us run the Service. We publish the full current list — who they are, what they do, where they process data, and their compliance status — at verenna.app/subprocessors. Today they include Amazon Web Services for hosting, database, storage, email, AI inference and transcription; Twilio for text messaging; and Stripe for subscription billing and payment rails. We update that list before a new provider starts processing, with at least 30 days notice.

Each provider is bound by a written data-processing agreement, may use the information only to provide their service to us, and may not use it for their own purposes.

The customer's own people. Records in a workspace are visible to the users that organization authorizes, according to the permissions it sets.

Other organizations, when a customer tells us to. An organization using Verenna can choose to share some of the records it holds with another organization that uses Verenna. It chooses whose records and which fields, and some information can never be shared: dates of birth, identity numbers, private notes, conversations and giving history. Sharing someone's contact details never gives the other organization permission to message them. The receiving organization is then responsible for what it received. We move the information only on the sharing organization's instruction, and we keep a record of each disclosure. If you want to know whether an organization has shared your information, or ask it to stop, contact that organization.

Legal and safety. We may disclose information where we are legally required to, or where it is necessary to protect the rights, safety or property of a person, our customers or us. If we receive a legal demand for a customer's records, we will tell that customer unless we are prohibited from doing so, and we will push back on demands that are overbroad or unlawful.

A business transfer. If Verenna is acquired or merges, information may transfer as part of that transaction. It stays subject to this policy, and we will give notice before any material change.

7. AI features

Some features use large language models to draft and summarize text, and speech-to-text to transcribe voice notes. Both run through a single contracted provider, in the United States, under an agreement that covers this processing.

Content sent to those models is not used to train them, and is not retained by the provider for its own purposes. We have opted out of provider-side content storage for service improvement at the account level, so the setting cannot be re-enabled per-service by accident.

We do not send information to any consumer AI product, and the platform is built so that a direct call to an unapproved AI vendor is refused rather than merely discouraged.

8. Where information is processed

Verenna is hosted in the United States, in the AWS us-east-1 region. All processing takes place there. A policy at our cloud-account level refuses the creation of resources in other regions, so this is enforced by configuration rather than by convention.

If your organization is in the European Economic Area, the United Kingdom or Switzerland, transferring information to us means transferring it to the United States. We rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum for UK transfers, incorporated into our Data Processing Addendum.

One exception is outside anyone's control: when a text message is delivered, the recipient's mobile carrier handles it, and that carrier follows the recipient's phone number rather than our region.

9. How we protect it

Encryption. Everything at rest is encrypted with keys we manage — the database, object storage, the cache and our secret store. Everything in transit uses TLS 1.2 or better, end to end.

Separation between organizations. Two independent layers keep one customer's records away from another's: the data-access layer refuses any query against tenant-scoped data that does not carry the organization's identity, and the database itself enforces row-level security bound at the transaction boundary. Cross-tenant isolation has its own dedicated category of automated tests, with a floor on the number that must exist.

A tamper-evident audit trail. Every change of state is recorded. The audit table refuses updates and deletions at the database level, so history cannot be rewritten even by a compromised application.

Keeping personal information out of logs. A redaction step runs over every log record before it is written, and the same function is applied to audit context and to error responses.

Access control. Access within a workspace is governed by role-based permissions, and every denial is recorded. Access to our production infrastructure requires multi-factor authentication at the identity provider; there are no long-lived individual credentials.

Multi-factor authentication for application users is on by default for new organizations. Each organization's administrators can change how strictly it is enforced and which method is used. We recommend keeping it on.

Change control. Automated compliance and security checks run against every change before it ships, and the same set re-runs daily against the main branch.

No security is perfect. If a breach affects your information we will act on it, notify affected customers without undue delay, and give them what they need to meet their own notification duties.

10. How long we keep it

Customer records: for as long as the organization's subscription lasts. After termination, records stay available for 30 days so the organization can export them, then are deleted from live systems and age out of encrypted backups on our normal cycle. An organization can also ask us to delete specific records earlier.

Audit records: 7 years. These exist to prove what happened to a record and by whom, so they outlive the records themselves.

Voice recordings: retained by default, with deletion available on request. An organization can ask us to delete audio after transcription.

Account and billing information: for as long as the account is open, and afterwards for as long as we need it to meet tax, accounting and legal obligations.

Compliance documentation: at least 6 years.

11. Your rights

Depending on where you live, you may have the right to access the personal information held about you, to have it corrected, to have it deleted, to receive a copy in a portable form, to object to or restrict certain processing, and to withdraw consent you gave. You also have the right not to be discriminated against for exercising these rights.

If your information is in an organization's Verenna workspace, that organization decides these requests. Contact them. If you are not sure who they are, write to us at privacy@verenna.app and we will point you in the right direction; we will not disclose their records to you, but we will not leave you stuck either.

If your information is held by us in our own right — you have a Verenna account, or you contacted us — write to privacy@verenna.app and we will respond within the time the applicable law allows, and in any event within 30 days.

If you are in the EEA or the UK you may also complain to your local data-protection authority. We would rather you came to us first.

12. Cookies and tracking

We use cookies that are strictly necessary to run the Service: to keep you signed in, to keep your session secure, and to remember essential preferences.

We do not use advertising cookies, we do not run third-party ad trackers, and we do not track you across other websites.

13. Children

Verenna is a tool for organizations, not a consumer product, and we do not knowingly collect information directly from children.

An organization may hold records about minors it serves — that is a normal part of nonprofit work. Where it does, the organization is the controller: it is responsible for the lawful basis, for any parental or guardian consent required, and for the notices it gives. We process those records as we do any other, under the protections described in section 9.

14. Changes to this policy

We may update this policy. Each version is published with a version number and an effective date, and earlier versions are retained.

For a change that materially affects how we handle personal information, we will give at least 30 days notice before it takes effect, by email to account administrators and in the product.

15. Contact us

Privacy questions and rights requests: privacy@verenna.app. Security reports: security@verenna.app. Legal and contractual questions, including a copy of our Data Processing Addendum: legal@verenna.app.

Verenna is a United States company. Its formal corporate details will be published here once incorporation completes; until then, correspondence to the addresses above reaches the people responsible.