Privacy policy

Who we are

Veritabl (“we”, “us”) runs veritabl.app, a tool teams use to ask each other short questions and see the answers live. You can reach us at hello@veritabl.app.

For your account details, we decide how they're used, so we're the controller. For what's inside a workspace (its questions, answers and member list), the organisation that owns the workspace decides how it's used and we process it on their behalf. If your employer invited you, they're your first point of contact about that data.

What we collect

Your account

• Your name and email address.
• Your password, if you use one. It's stored by our authentication provider as a one-way hash, so nobody can read it, including us.
• If you sign in with Google, the name and email address on your Google account. We don't get access to your Google data beyond that.

Your workspace

• The workspace name, its dashboards and its settings.
• Who belongs to it, their role, and the email addresses of people who've been invited.
• The questions admins post, and the answers people give.

Answers through a public link

People without an account can answer through a link an admin shares. We don't ask who they are. Their browser keeps a random token so it isn't asked to answer the same link twice.

Technical information

Like any website, our servers and providers see technical details such as IP address, browser type and the time of a request, which they keep in short-lived logs for security and troubleshooting.

How answers stay anonymous

• Each answer is stored under a token made with a secret key, not under your name, email or account ID. The token lets us count one answer per person and remember that you've answered, without recording who you are.
• Admins see totals and percentages, never who answered what. The raw answers can only be read by our servers, never directly from your browser or theirs.
• Results stay hidden until a minimum number of people have answered (three by default), so small groups can't be singled out. This applies to admins, analytics and exports too.
• CSV exports don't include anything that identifies who gave an answer.
• Written answers are shown word for word, so leave out details that would identify you.

How we use information

• To run the service: sign you in, show your dashboards, record and count answers.
• To send the emails the service needs, such as invitations and sign-in links.
• To keep the service secure and fix problems.
• To reply when you contact us.

We don't sell personal information, use it for advertising, or use workspace content to train AI models.

Who we share it with

We use a small number of providers to run Veritabl:

• Supabase stores the database and handles sign-in and account emails.
• Google, only if you choose to sign in with Google.
• Anthropic powers the optional AI insights and question suggestions on paid plans. We send it question text and summary figures such as counts, averages and the leading answer. We never send names, email addresses or individual written answers.
• Our website hosting provider, which serves the site and keeps standard request logs.

Some of these providers process data outside the UK, including in the United States. Where they do, we rely on the safeguards they offer for international transfers, such as standard contractual clauses. We'd also share information if the law required it.

Cookies and browser storage

We only use what's needed for the service to work: cookies that keep you signed in, and browser storage for your light or dark theme and, on public links, the token described above. There are no advertising or analytics cookies, so there's nothing to opt out of.

How long we keep it

• Workspace content stays until the workspace's admins delete it. Deleting a question or dashboard deletes its answers.
• Your account stays until you ask us to delete it. Email us from your account's address and we'll delete it, usually within 30 days. Answers you've given stay in your workspaces' totals, but they're already not linked to you.
• Backups and logs are deleted on our providers' normal schedules.

Your rights

Under UK and EU data protection law you can ask to see, correct or delete your personal information, ask us to limit or stop using it, or ask for a copy to take elsewhere. Email hello@veritabl.app. For information inside your employer's workspace, we may need to pass your request to them. Because answers aren't linked to you, we can't find or return the answers you personally gave.

If you're unhappy with how we've handled your information, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Security

Data is encrypted in transit. Access to the database is restricted by row-level security, and answers can only be read through our servers. No system is perfectly secure, but we'll tell affected customers promptly if we become aware of a breach.

Children

Veritabl is for workplaces and isn't meant for anyone under 16.

Changes

If we change this policy we'll update the date above, and tell workspace owners about significant changes before they take effect. Also see our terms of service.