What this site knows about you

The confirmed company and contact details are in the imprint.

This site is a set of static pages. There is no database behind it, no login, no session, and no visitor profile — not because we minimised after the fact, but because none of it was built. That is the reason the sections below are as thin as they are.

We treat that as an engineering claim you can check rather than a promise you have to take on faith. Open your browser's developer tools: the storage panel shows no cookies, while the network panel shows our own assets and the Plausible analytics request.

Every page you open sends our host a request. That request is logged so the page can be delivered and so we can see attacks and faults.

These logs are not combined with any other data, not used to build a profile, and not used to identify individual visitors.

The form asks for your project goal and area, name, email address, company and message. Resend delivers the submission by email to the Veren recipients configured by us. There is no CRM enrichment or marketing automation.

If you write to one of the addresses in the imprint instead, the same applies to that email.

Plausible records aggregated page views, referrers, campaign parameters and selected events such as starting a demo, generating or exporting a blueprint, clicking a consultation link and submitting a contact request. We do not send form entries, documents, transcripts or voice-session content to Plausible.

This site sets no cookies of any kind — not for analytics, preferences or sessions. Plausible operates without storing or reading information on your device, which is why you were not asked to accept analytics cookies.

The interactive worksheets attached to journal articles save your answers in your own browser's local storage so they survive a reload. That data never leaves your device and never reaches us. It is stored because you asked for the worksheet, which is what § 25 (2) TDDDG covers, and you can clear it from the worksheet itself or in your browser settings.

The full account, including how to verify it, is on the cookie page.

The typeface is Poppins. It is downloaded once when we build the site and served from our own domain, so opening a page makes no request to Google or any other font host, and no IP address of yours reaches one.

The same is true of images, video and icons. There is no embedded map, no social widget, no video player from a third-party platform, and no content delivery network other than our host's.

When you submit a question at /explore, we send the conversation so far and selected published Veren content to Anthropic to compose a page. Use general business context without personal or confidential information. We do not store this conversation in a server database, cookies or browser storage. Expiring technical counters limit requests; provider processing follows the terms described below.

Copying a share link explicitly includes your questions and the selected view in its URL fragment. Anyone with the link can read or forward the snapshot. Downloading saves a brief on your device. See Explore data use for the feature's data flow and sharing details.

The demo runs only on fictional organisations, documents and personas. Before the microphone opens you read this, confirm that you will not give real patient data or report real adverse events, and choose between the microphone and the keyboard. The keyboard path delivers the same content.

With the microphone, each utterance is sent to our server, forwarded to the speech recognition processor named below, turned into text and discarded. The reply text is sent to the speech output processor and streamed back as audio. No audio is written to disk or logged, on our side or by instruction to the processors. The session runs over an encrypted connection with a short-lived session token, not a cookie.

The text of the session (what you say, what the assistant answers, which sources and actions were shown) is held in memory on our server for the session and at most 30 minutes after it, then deleted. The end-and-delete control removes it immediately. If you request the transcript by email, we send it once and keep a copy for 30 days to answer questions about it, then delete it.

Processing is governed by the applicable data-protection terms of each provider. Where Art. 28 GDPR requires it, we conclude a data processing agreement. The providers may not use the data for unrelated purposes.

We do not sell personal data, do not share it with advertising networks, and do not transfer it to anyone else except where the law requires it of us.

Our host, our email delivery provider and the language and speech processors of the voice demo are incorporated in the United States. The site is delivered from edge locations, including locations in the EU. Access from outside the EU therefore cannot be ruled out.

International transfers are governed by the contractual safeguards agreed with the respective provider. You can ask us for the relevant details.

• The site is served over TLS. Requests over plain HTTP are redirected.
• The public site is prerendered. It has no application database and no administrative interface exposed to the internet.
• There are no visitor accounts, so there are no visitor passwords to lose.

This describes the website. The controls that apply inside a client engagement are agreed in that engagement, and we answer security questionnaires as part of onboarding rather than claiming an outcome here.

When we build or run a system for you, any personal data in that system is yours. We process it on your instructions as a processor under Art. 28 GDPR, governed by a data processing agreement — not by this notice. Send us your agreement, or ask for ours, at the data protection address below.

If you send us a CV or an open application, we use it to assess that application, keep it while the process runs, and delete it afterwards unless you agree to us keeping it on file.

Business contact details of the people we work with at clients, partners and suppliers are processed to run the relationship, on the basis of Art. 6 (1) (b) or (f).

We do not profile visitors, do not score enquiries automatically, and make no decision with legal or similarly significant effect on you by automated means within the meaning of Art. 22 GDPR. We build AI systems; we do not point them at the people who read this site.

• Access — a copy of the data we hold about you and an explanation of what we do with it (Art. 15).
• Rectification — correction of anything wrong (Art. 16).
• Erasure — deletion, where no retention duty stands in the way (Art. 17).
• Restriction — we keep the data but stop using it while something is in dispute (Art. 18).
• Portability — data you gave us, in a machine-readable form (Art. 20).
• Withdrawal — where processing rests on consent, you can withdraw it at any time, with effect for the future (Art. 7 (3)).

Write to privacy@veren-technology.com. Please say which right you are exercising; it makes the answer faster. We may need to confirm who you are before disclosing anything, and we will not ask for more than that requires.

Our lead authority is the Office of the Commissioner for Personal Data Protection, Cyprus (www.dataprotection.gov.cy), because that is where the controller is established.

Art. 77 GDPR also lets you complain to the authority where you live, where you work, or where you think the infringement happened. For readers in Germany that is the data protection authority of your federal state; in Austria the Datenschutzbehörde; in Switzerland the FDPIC under Swiss law. You do not have to come to us first, though we would rather you did.

We update this notice when what we do changes — a new processor, a new feature that collects something. The effective date at the top of the page changes with it. If a change materially affects people who have already written to us, we say so directly rather than relying on you rereading this page.