Privacy notice

The short version

• We collect what you choose to send us through our forms, plus a few technical details, such as the page you sent it from. We store your IP address only as a salted one-way hash, to stop spam.
• We use it to respond to you, discuss our software and services, support our customers, consider job applications and keep the site secure.
• We do not sell your personal information or share it for targeted advertising, and we do not add you to a marketing list without asking.
• The site uses no advertising or analytics cookies.
• Form submissions and their files are deleted automatically 12 months after we receive them, or sooner if you ask.
• You can ask to see, correct or delete your information at any time.

Who we are and how to reach us

Verasoft (“Verasoft,” “we,” “us” or “our”) is a software and services company. We are responsible for the personal information described in this notice and, under the EU and UK General Data Protection Regulations (GDPR and UK GDPR), we are its controller.

If you have a question about this notice or want to exercise your rights, please send us a message, choose “Something else” and tell us your request is about privacy.

What this notice covers

This notice applies to personal information we collect through www.verasoft.com, including through our forms: Request a call, Send a message and Job application. It also applies to the emails and calls that follow when we respond to you.

It does not apply to:

• Information in our customers’ systems. When businesses use Verasoft software and services, any personal information they store or process in them, such as their own clients’ or members’ details, is handled on the customer’s behalf under our agreements with that customer. The customer’s own privacy notice explains how that information is handled. If you have a question about it, please contact the business you deal with. If you contact us instead, we will refer you to them, or pass your request on where our agreement allows.
• Text messages and payments in Verasoft software. Text messages sent through Verasoft software, and payment and billing services, are covered by their own terms and by the agreements with the business that uses them.
• Other websites. Sites we link to, such as LinkedIn, have their own privacy practices.
• Our workforce. Information about our employees and contractors in that role.

Information we collect

Information you give us

You give us information when you fill in one of our forms. Each form marks its optional fields; everything else is required.

Whatever you include in a message or an attached file becomes part of your submission.

Please do not send sensitive information through our forms unless we have specifically asked for it. That includes health information, Social Security, passport or other government ID numbers, payment card or bank account details, passwords or other credentials and information about racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation.

Information collected automatically when you send a form

• The page you sent the form from, and the page that referred you to our site if your browser shares it.
• Campaign parameters in the link you followed (UTM tags, such as the name of a newsletter or campaign).
• Your browser’s user agent, which describes your browser, operating system and type of device.
• The country our hosting provider, Cloudflare, infers from your connection. We also use it to suggest your country on our forms.
• Your IP address, which we store only as a salted one-way hash (a coded value, not the address itself). We use it to limit spam: no more than 10 submissions an hour are accepted from the same connection.
• Our forms use Cloudflare Turnstile: your browser completes a short automatic check before the form is sent. We use only its pass or fail result and do not store it.

When you browse the site

You can browse www.verasoft.com without telling us who you are. We do not use analytics, advertising or social media tracking tools. Like any website host, Cloudflare processes your IP address and standard request information, such as your browser type and the page you asked for, to deliver the site and protect it from attacks. Our hosting environment keeps short-lived technical logs so we can diagnose problems and keep the site secure, and Cloudflare may set strictly necessary security cookies, as described in the cookie notice.

The typefaces our pages use are served from our own site, so displaying them does not share any information with a font provider.

Information from others

Sometimes another person gives us your details, for example a colleague who names you as a contact in a message. We handle that information as this notice describes. If you include someone else’s details in a submission, please make sure they are comfortable with you sharing them.

How we use information

• To respond to you. We read your request, send it to the right team and reply by email or phone.
• To discuss our software and services. We answer questions, schedule and hold the calls you ask for and prepare proposals and quotes.
• To support our customers. We handle support requests from existing customers under their agreements with us.
• To consider job applications. We evaluate applications, contact candidates and make hiring decisions.
• To manage business relationships. If you or your organization becomes a customer, we keep records of our relationship, including in a customer relationship management system.
• To understand how people find us. We look at which pages and campaign links lead to requests, so we can improve the site and how we describe our software and services.
• To keep the site secure. We detect and prevent spam, abuse, fraud and attacks, for example by limiting how many forms can be sent from one connection.
• To meet legal obligations and protect rights. We comply with the law, respond to lawful requests, enforce our terms and establish or defend legal claims.

We do not sell your personal information. We do not share it for cross-context behavioral advertising, meaning advertising targeted at you based on your activity across other businesses’ websites and apps. We do not add you to a marketing list because you sent us a form. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

We do use simple rules to route your request: the form and topic you choose decide which team receives it. These rules only decide who replies to you and how, and our staff review the requests we receive.

Legal bases in the EEA and UK

If you are in the European Economic Area (EEA) or the United Kingdom, the GDPR and the UK GDPR require us to have a legal basis for using your personal information. We rely on the following:

• Steps you ask us to take before entering into a contract (Article 6(1)(b)): responding to call requests and inquiries about our software and services, preparing proposals and quotes and considering job applications.
• Performance of a contract (Article 6(1)(b)): providing support where you are our customer. Where your organization is our customer, we rely on our legitimate interest in supporting it.
• Legitimate interests (Article 6(1)(f)): responding to inquiries and messages, supporting customers, managing business relationships, understanding how people find us, keeping the site and forms secure (including hashing IP addresses and limiting submissions), keeping business records and defending legal claims. We use only what we need for these purposes and weigh them against your rights. You can ask us for more information about how we balance them, and you can object.
• Consent (Article 6(1)(a)): where we ask for it, for example before sending you marketing emails or using any cookies that are not strictly necessary. You can withdraw your consent at any time, without affecting what we did before.
• Legal obligation (Article 6(1)(c)): when the law requires us to keep or disclose information.

We do not ask for special categories of personal data. If you choose to share them, for example health information in a request for a hiring accommodation, we use them only for that purpose, on the basis of your explicit consent or our obligations under employment law (Article 9(2)(a) or (b)).

The fields not marked optional on our forms are needed for us to respond. If you prefer not to provide them, we may not be able to help with your request.

Who we share information with

We share personal information only as described below.

• Our team. The staff who handle your request, through a private dashboard that requires a password and an authenticator code, and through the team email addresses for your request.
• Service providers. Companies that provide services to us under contracts that require them to protect the information and use it only to provide those services, as our processors or service providers:
  • Cloudflare, which hosts the site and provides its security, content delivery, database and file storage;
  • Resend, which delivers the notification and summary emails our team receives about submissions;
  • our business email and productivity providers, which hold those notifications and our correspondence with you.
• Our affiliated companies. Affiliated companies that provide services to us, such as customer relationship management, under the same obligations as our other service providers.
• Professional advisers. Lawyers, accountants, auditors and insurers, when needed and under a duty of confidentiality.
• Authorities and legal process. Courts, regulators, law enforcement or others when the law requires it, or when we believe in good faith that disclosure is necessary to protect the rights, property or safety of you, us or others.
• Business transfers. A buyer, investor or successor in connection with a reorganization, merger, acquisition, financing or sale of all or part of our business, with protections consistent with this notice.
• Others, at your direction. Anyone else you ask us to share it with, or with your consent.

International transfers

We serve businesses around the world, and our service providers operate in the United States and other countries. When you send us information, it is processed in the United States, and it may also be processed in other countries where our team and providers operate. Data protection laws in those countries may differ from the laws where you live, and information held there may be accessible to their courts, law enforcement and national security authorities.

When personal information from the EEA or the UK is transferred to a country that has not been recognized as providing adequate protection, we use the European Commission’s Standard Contractual Clauses and, for information from the UK, the UK International Data Transfer Addendum to them, or another transfer mechanism recognized by law, with additional safeguards where appropriate. You can ask us for a copy of these safeguards; we may remove commercial terms.

For information from other countries, we take the steps their laws require, including reasonable steps to make sure that recipients outside your country protect it.

How long we keep information

• Form submissions and their files are deleted automatically 12 months after we receive them.
• Sooner if you ask. We will delete your submission earlier on request, unless we need to keep it, for example because it relates to an active customer relationship or the law requires us to keep it.
• Permanent removal. A submission deleted before the 12 months are up is held in a protected trash for up to 30 days, in case it was deleted by mistake, and is then permanently erased with its files. Our hosting provider’s backup systems may keep a copy for a short time afterward.
• Customer relationships. If your request leads to a customer relationship, we keep the related records for as long as our agreement and our business needs require, including in our customer relationship management system.
• Emails. Notification emails about your submission, and our correspondence with you, are kept in our business email systems only as long as we need them for the purposes in this notice and for our business records.
• Job applications are kept as described under Job applicants.
• Technical and security logs kept by our hosting environment are short-lived.

How we protect information

• Information is encrypted in transit between your browser and our site (HTTPS with TLS).
• Uploaded files are stored privately. They are never publicly accessible, and only signed-in staff can download them.
• Our staff dashboard requires a password, a code from an authenticator app (two-factor authentication) and a Cloudflare Turnstile check. It limits failed sign-in attempts and signs people out after 12 hours without activity.
• Access is limited to the staff who need it for their work.
• IP addresses are stored only as salted one-way hashes.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your information, or an interaction with us, is no longer secure, please contact us right away.

If there is a security breach

If a security breach affects your personal information, we will investigate it and notify you, regulators and others as the law requires, including the breach notification laws of US states and, where they apply, the GDPR and UK GDPR, Canada’s PIPEDA, Australia’s Notifiable Data Breaches scheme, New Zealand’s Privacy Act 2020 and India’s Digital Personal Data Protection Act, 2023.

Information we do not collect through the site

The site does not ask for Social Security numbers, driver’s license or other government ID numbers, financial account numbers or payment card numbers, and we do not take payments through it.

Your rights in the EEA and UK

If you are in the EEA or the UK, you have the right to:

• Access your personal information and receive a copy of it;
• Rectification: have inaccurate or incomplete information corrected;
• Erasure: have your information deleted;
• Restriction: ask us to limit how we use your information, for example while we check its accuracy;
• Portability: receive the information you gave us in a structured, commonly used, machine-readable format, or have it sent to another organization;
• Objection: object to our use of your information based on legitimate interests and, at any time, to direct marketing;
• Withdraw consent where we rely on it, without affecting what we did before;
• Complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, the data protection authority where you live or work, or where you believe an infringement took place (listed at edpb.europa.eu).

Some of these rights have limits; for example, we may need to keep information to meet a legal obligation. If a limit applies, we will explain it. We would welcome the chance to address any concern, so please contact us first if you can. See How to make a request.

Your rights in the United States

California

This section applies to California residents, including job applicants, to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA), applies to us. It supplements the rest of this notice.

Notice at collection. This privacy notice is our notice at collection. Each of our forms links to it before you send anything. It describes the categories of personal information we collect, why we collect them and how long we keep them.

Categories collected in the past 12 months. We collected the following categories from you, from your browser or device and from people who contacted us on your behalf:

We use these categories for the business purposes described in How we use information and keep them for the periods in How long we keep information: form submissions are deleted 12 months after we receive them. We disclosed each category for a business purpose to the service providers and affiliated companies described in Who we share information with, and we may disclose it to professional advisers and authorities as described there.

No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Sensitive personal information. We do not ask for sensitive personal information. If you include it in a submission, for example in a résumé, we use it only for the purposes the CCPA permits without offering a right to limit, such as handling your request, and we do not use it to infer characteristics about you.

Your rights. Subject to exceptions in the law, you have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, our purposes and the categories of third parties we disclose it to;
• Delete personal information we collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of your personal information. We do not sell or share it, so there is nothing to opt out of, and we honor opt-out preference signals as described under Browser signals below;
• Limit the use of sensitive personal information. Because we use it only for permitted purposes, there is nothing further to limit;
• Not be discriminated or retaliated against for exercising your rights, including as a job applicant.

You can make a request yourself or through an authorized agent; see How to make a request. We do not disclose personal information to third parties for their own direct marketing purposes (California Civil Code § 1798.83).

Other states

Many other states have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Where one of these laws applies to us and to your information, you may have the right to confirm whether we process your personal information, and to access, correct or delete it or obtain a portable copy. These laws also give you the right to opt out of targeted advertising, the sale of personal information and profiling used for decisions with legal or similarly significant effects. We do not do any of these things.

Many of these laws do not cover information about people acting in a business or employment role. Wherever you live, you can still ask us to see, correct or delete the information you sent us, and we will do so unless we need to keep it as described in this notice.

Appeals. If we decline your request, you can appeal by replying to our decision, or by contacting us as described in How to make a request with “Appeal” in your message. We will respond within the time your state’s law requires, generally 45 to 60 days, and explain our decision. If we deny your appeal, you can contact your state attorney general.

Browser signals

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of the sale and sharing of your personal information wherever the law requires. Because we do not sell or share personal information, honoring the signal does not change how we handle it.

Do Not Track. We do not track visitors across third-party websites over time, and we do not knowingly allow third parties to do so through our site. For that reason, and because there is no common standard for interpreting Do Not Track signals, our site does not change its behavior when it receives one.

Canada, Australia, New Zealand and India

Canada

Where Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), or a similar provincial law, applies, we collect, use and disclose your personal information with your consent, which you give when you send us a form, for the purposes described in this notice, or as the law otherwise permits. You can withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, although we may then be unable to help with your request. You can ask to access and correct your personal information. As described under International transfers, your information is processed in the United States. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where applicable, your provincial privacy commissioner.

Australia

Where Australia’s Privacy Act 1988 and the Australian Privacy Principles apply, you can ask to access and correct your personal information. You can browse the site without identifying yourself, but we need your name and contact details to respond to a request. Your information may be disclosed to recipients in the United States and other countries where our service providers operate. To complain about how we have handled your information, please contact us first; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand

Where New Zealand’s Privacy Act 2020 applies, you can ask to access and correct your personal information. We will respond as soon as reasonably practicable, and no later than 20 working days after we receive your request. Your information may be disclosed to recipients outside New Zealand, as described under International transfers. If you are not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

India

Where India’s Digital Personal Data Protection Act, 2023 applies, we process the personal data you give us for the purpose for which you provided it, or with your consent, which you can withdraw at any time. You can ask for a summary of the personal data we process about you, and ask us to correct, complete, update or erase it. You can also nominate another person to exercise your rights if you die or become unable to do so. You can raise a grievance with us using the contact details in this notice and, if it is not resolved, complain to the Data Protection Board of India.

How to make a request

To exercise any of your rights, send us a message and choose “Something else.” Please tell us that your request is about privacy, what you would like us to do, where you live and the email address you used when you contacted us. If we gave you a reference number (it starts with “VS-”), please include it.

Verification. To protect your information, we verify requests before acting on them, usually by matching the details you give us with the information we hold and confirming the request from the email address you used. We may ask for more information if needed, and we use it only to verify your request.

Authorized agents. Someone else can make a request for you if you give them signed, written permission or they hold a valid power of attorney. We may ask the agent for proof of their authority and ask you to confirm your identity directly with us.

Response times. We will respond:

• within one month for requests under the GDPR and UK GDPR, which we may extend by up to two further months for complex or numerous requests;
• within 45 days for requests under US state privacy laws, which we may extend by up to a further 45 days when reasonably necessary. We confirm California requests within 10 business days of receiving them;
• within the time other applicable laws require, for example 30 days under PIPEDA and 20 working days under New Zealand’s Privacy Act 2020.

If we need more time, we will tell you why. Requests are free, although where the law allows, we may charge a reasonable fee for, or decline, requests that are manifestly unfounded, excessive or repetitive. If we cannot fully meet a request, we will explain why.

Complaints. If you are unhappy with how we handled your request, please tell us. You can also appeal as described under Your rights in the United States, or contact the authority named in this notice for where you live.

Children

Our site is meant for businesses, professionals and job seekers. It is not directed to children under 13, and we do not knowingly collect personal information from them, consistent with the US Children’s Online Privacy Protection Act (COPPA). For visitors in the EEA and the UK, the site is not directed to anyone under 16. If you believe a child has sent us personal information, please contact us and we will delete it.

Job applicants

When you apply for a job, we use your application to evaluate your qualifications, contact you, arrange interviews and make hiring decisions. We keep it for up to 12 months so that we can consider you for other roles that may suit you, unless you ask us not to, and then delete it automatically. If you are hired, your application becomes part of your employment records, which we keep as employment law requires.

To withdraw your application or ask us not to keep it for other roles, send us a message and choose “Careers.”

Verasoft is an equal opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status or any other characteristic protected by law. If you need an accommodation during the hiring process, please tell us; we will use what you share only to provide it.

Calls, emails and marketing

• Phone numbers. We use your phone number only to respond to your request, for example to arrange or hold the call you asked for, or to call you back about a support issue. We do not use it for automated, prerecorded or artificial-voice marketing calls or text messages.
• Emails. The emails we send you respond to your request. We do not add you to a mailing list because you contacted us.
• Marketing. If we ever offer marketing emails, such as a newsletter, we will send them only to people who opt in. Each one will identify us, include our postal address and an easy way to unsubscribe, and we will honor unsubscribe requests promptly, as the US CAN-SPAM Act and, for recipients in Canada, Canada’s Anti-Spam Legislation (CASL) require.

Changes to this notice

We may update this notice as our practices or the law change. We will post the updated notice on this page with a new effective date. If we make a material change, we will tell you more prominently, for example with a notice on our site, and where the law requires, we will ask for your consent.