Privacy Policy

Effective date: August 19, 2026

This Privacy Policy explains how Veridical Tech, Inc. ("Veridical Tech," "we," "us," or "our"), a Delaware C corporation, collects, uses, discloses, and protects information when you use SPM, including SPM-Polaris, our websites, documentation, console, APIs, MCP server, and related services (collectively, the "Service").

1. Scope and roles

This policy applies to information we process for our own business purposes, such as account administration, billing, security, and support.

When an organization uses the Service to process prompts, conversations, memories, evidence, or other content on behalf of its users, that organization generally determines why and how the content is processed. In that context, the organization is the controller or business, and Veridical Tech acts as its processor or service provider, as those terms are defined by applicable law.

2. Information we collect

Account and organization information

We collect information used to create and administer accounts, organizations, tenants, and access rights, such as name, email address, account identifiers, organization membership, roles, and authentication events.

Customer Content

We process information submitted to the Service, including prompts, conversations, source text, memory records, retrieved evidence, deletion instructions, configuration, and related metadata ("Customer Content"). The content and sensitivity of Customer Content are controlled by the customer.

Provider and integration information

If you connect an external AI model provider or other integration, we process the configuration and credentials needed to operate that connection. Provider credentials are stored in a protected vault and are not returned through the Service or intentionally written into memory records.

Usage, audit, and technical information

We collect information needed to operate, secure, measure, and audit the Service. This may include request and response metadata, timestamps, model and provider selections, status codes, latency, token accounting, memory and evidence counts, receipt records, IP address, device and browser information, and security logs.

Billing information

Payments are processed by Stripe. We receive subscription, transaction, plan, tax, and payment-status information needed to administer your account. We do not receive or store your complete payment-card number.

Communications

We collect information you provide when you contact support, request access, respond to a survey, or otherwise communicate with us.

Cookies and local storage

Our websites and console may use cookies or similar storage that are necessary for authentication, security, preferences, and core Service operation. We do not use Customer Content for targeted advertising.

3. How we use information

We use information to:

• provide, route, secure, and maintain the Service;
• perform memory ingestion, evidence-gated recall, compression, deletion, and audit functions requested by customers;
• authenticate users and administer accounts, tenants, permissions, plans, and billing;
• monitor reliability, prevent abuse, investigate incidents, and enforce our Terms of Service;
• provide support and communicate about operational, security, billing, or product matters;
• analyze and improve Service performance using operational and usage data; and
• comply with law and protect the rights, safety, and integrity of customers, Veridical Tech, and others.

Where applicable, our legal bases include performing a contract, pursuing legitimate interests in operating and securing the Service, complying with legal obligations, and consent when the law requires it.

4. How we disclose information

We may disclose information:

• To service providers. We use vendors for services such as authentication, infrastructure, database hosting, security, communications, analytics, and payment processing. They may process information only to provide services to us and subject to contractual restrictions.
• To customer-selected providers. When a customer configures an AI model provider or integration, the Service transmits the content and metadata needed to fulfill that request. The provider's own terms and privacy policy apply to its processing.
• At the customer's direction. We disclose information when an authorized customer instructs us to do so, including through configured integrations or organization access controls.
• For legal and safety reasons. We may disclose information when reasonably necessary to comply with law or legal process, investigate fraud or abuse, protect rights or safety, or preserve the security and integrity of the Service.
• In a corporate transaction. Information may be disclosed in connection with financing, due diligence, a merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

5. Data retention and deletion

We retain information for as long as reasonably necessary to provide the Service, maintain security and auditability, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type, plan, customer configuration, and legal requirement.

Authorized users may delete memory sources, clear memory, or close an account using available Service controls. A successful purge removes the affected data from active systems and records the deletion result. Copies that existed in backups, write-ahead logs, or replicas before the purge may remain until those systems complete their normal rotation or expiration cycle. We may retain limited records when required for security, fraud prevention, billing, legal compliance, or the establishment or defense of legal claims.

6. Security

We use administrative, technical, and organizational safeguards designed to protect information, including tenant separation, access controls, protected credential storage, security logging, and deletion receipts. No system can be guaranteed to be completely secure, and customers remain responsible for securing their accounts, credentials, integrations, and use of the Service.

7. International data transfers

Veridical Tech is based in the United States, and we and our service providers may process information in the United States and other countries. Where required, we use recognized transfer mechanisms and contractual safeguards for international transfers.

8. Your rights and choices

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, or to object to or restrict certain processing. You may also have the right to withdraw consent and to appeal a decision regarding a privacy request.

Account and organization administrators can manage certain information directly through the Service. To exercise other rights, contact us at [email protected]. We may need to verify your identity and authority before acting on a request. If we process your information on behalf of an organization, we may direct your request to that organization.

Residents of the European Economic Area or United Kingdom may also lodge a complaint with their local data protection authority. California residents may request the categories and specific pieces of personal information we collect, correction or deletion of eligible information, and information about disclosures, without unlawful discrimination for exercising those rights. We do not sell personal information or share it for cross-context behavioral advertising.

9. Children

The Service is intended for users who are at least 18 years old. We do not knowingly collect personal information from children through accounts directed to them. If you believe a child has provided personal information to us, contact us so we can review and address it.

10. Changes to this policy

We may update this policy as the Service, our practices, or applicable law changes. We will post the updated policy with a new effective date and provide additional notice when required by law.

11. Contact

For privacy questions or requests, contact:

Veridical Tech, Inc.
131 Continental Dr
Suite 305
Newark, DE 19713
United States
[email protected]