Privacy policy
Vereon ID is the one sign-in for Vereon's apps (Tale, Trazr, Offr, Register and the others), run by Vereon Ltd ("we", "us"). This page says what Vereon ID holds, why, what it tells the apps you sign in to, who else handles it, how long we keep it, and what you can ask us to do. What you do inside each app is covered by that app's own privacy policy. Write to us about any of it at info@vereon.tech. Last updated 31 October 2026.
Who is responsible
We decide how the information in your Vereon ID is used (we are its "controller"). Once you sign in to one of Vereon's apps with it, what you do in that app is covered by that app's privacy policy.
What we hold
- Your Vereon ID: your name, your email address and whether it's confirmed, the language you chose, and your password, stored only as a one-way scrypt hash (none at all if you only sign in with Google or Microsoft). If you sign in with Google, Google's id for you; with Microsoft, Microsoft's id for your account and its organisation.
- Where you're signed in: each browser signed in to Vereon ID, and for each app you've signed in to, the tokens that keep you signed in there. We store only one-way hashes of them, never the tokens themselves.
- Emails we send you: the code to finish making your Vereon ID, word that one was made with your address and how to take it back if that wasn't you, a link to choose a new password, a note when your password changes, a note if someone tries to sign up with an address that already has a Vereon ID, and, in Vereon Affiliates, word when we pay you. Never marketing.
- Vereon Affiliates: if you join, where you said you'd share your link, the account you want paid into (and your CNIC, for the income tax deducted from payouts in rupees), who made a Vereon ID through your link, what their businesses paid in their first three months and your share of it, and what we've paid you; people who open your link see your first name. If you made your Vereon ID through someone's link, for a year we check what your businesses pay, on Vereon One or an app's own subscription, to work out their share. They see your first name and initial, when you joined, and how far your businesses' first three months are paid: never your email, your businesses' names or what they pay.
- Keeping it safe: counts of attempts, by IP address and by email address, kept for between an hour and a day, so nobody can guess passwords or flood an inbox; and technical logs (time, errors) to keep Vereon ID working. We don't track the pages you visit, and there is no advertising or analytics.
What the apps you sign in to are told
When you choose Continue with Vereon in one of Vereon's apps, Vereon ID tells that app your name, your email address and whether it's confirmed, your language, and an id for you that is the same in every Vereon app. Never your password, and nothing from the other apps you use. Vereon ID only works for Vereon's own apps: no outside company can sign you in with it.
Why we use it, and on what basis
- To give you Vereon ID (signing you in to the apps you choose, and sending the emails above): because it is needed to perform our agreement with you.
- To keep Vereon ID secure, prevent misuse and fix faults: because we have a legitimate interest in a safe, working sign-in, which doesn't override your rights.
We do not sell your information, use it to advertise to you, or use it to train AI models.
Google user data
Signing in with Google (openid, email, profile): we read your name, your email address, whether Google has confirmed it, and Google's id for you, to sign you in or make your Vereon ID. We keep no Google token afterwards, and Vereon ID has no access to your Gmail, your Drive or anything else in your Google Account.
We don't share Google user data with anyone except the Vereon apps you choose to sign in to (as above), use it for advertising, sell it, or use it to train AI models, and no person at Vereon reads it unless you ask us to help with a problem or the law requires it. Vereon ID's use and transfer of information received from Google APIs adheres to the Google API Products User Data Policy, including the Limited Use requirements.
Microsoft user data
Signing in with Microsoft (openid, email, profile): we read your name, your email address, whether Microsoft has confirmed it, and Microsoft's id for your account, to sign you in or make your Vereon ID. Signing in gives Vereon ID no access to your mailbox or files, and we keep no Microsoft token afterwards.
Who else handles it
These providers handle it for us, each only as far as their job needs:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Runs Vereon ID (the pages on Amplify, the sign-in service on Lambda) and sends its emails (SES) | UK (London) |
| MongoDB Atlas | The database, hosted on AWS | Ireland (EU) |
| Only if you choose it: signing in with Google | Worldwide | |
| Microsoft | Only if you choose it: signing in with Microsoft | Worldwide |
And the Vereon apps you sign in to, each told only what is described above.
Nobody else, unless the law requires it.
Sending data outside the UK
Vereon ID runs in the UK (AWS London), and its database is in Ireland, in the EU, which UK law recognises as protecting personal data adequately. Google and Microsoft work where it says above, only when you choose them. When data leaves the UK it is protected the way UK law requires, by the UK's adequacy regulations or by the International Data Transfer Agreement or Addendum in our contract with the provider. Ask us for details.
How long we keep it
| What | How long |
|---|---|
| Your Vereon ID | Until you ask us to delete it |
| A sign-up you haven't finished (before you type the emailed code) | 30 minutes |
| A link to choose a new password | An hour, or until it's used |
| A link to take back a Vereon ID made with your address | 30 days, or until it's used |
| A browser's sign-in | 30 days, or until you sign out |
| An app's sign-in | Up to a year, or until you sign out or change your password |
| Counts of attempts | Between an hour and a day |
| Technical logs | 30 days |
| Database backups | A short rolling period; deleted data leaves them as they roll over |
Your rights
- See your data, and take a copy: write to us, and we send you everything Vereon ID holds about you.
- Correct it: write to us, and we put it right.
- Delete it: write to us from the email address on your Vereon ID, and we delete it, and sign it out everywhere. Your accounts in the apps themselves are theirs to delete, under each app's own privacy policy: deleting your Vereon ID only stops it signing you in to them.
- Object, or ask us to restrict how we use it: write to us.
We answer within a month. You can also complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, your own data protection authority.
Cookies and storage in your browser
Vereon ID sets no advertising or analytics cookies, so there is nothing to opt into. It keeps only what it needs to work: a cookie that keeps you signed in (30 days, or until you sign out), one that lasts the ten minutes of a sign-in with Google or Microsoft, the language you chose, and, while an app is waiting for you to sign in, which app that is. If you open a Vereon Affiliates link and choose to thank whoever sent it, a cookie remembers whose link it was for 60 days, so they're thanked if you make a Vereon ID; it's gone once you sign in. Without your choice, nothing is kept.
Security
Everything travels encrypted. Passwords are stored only as one-way hashes, and so is every sign-in token and emailed link, so a copy of the database couldn't be used to sign in. Too many tries at a password are stopped. If something ever went wrong with your data, we would tell the Information Commissioner's Office within 72 hours and tell you without delay if it put you at risk.
Children
Vereon ID is for people using Vereon's apps for their business, and you must be 18 or over to have one.
Changes
If this page changes in a way that matters, we tell you by email first.