Privacy Policy

This Privacy Policy explains how Dab of Oppo Ltd ("we", "us", "our"), trading as Veritai and Warden by Veritai, collects and uses personal data when you use the Warden platform (the "Service"). We are the data controller for the personal data described here.

1.1 Dab of Oppo Ltd is a company registered in England & Wales under company number 07730436. Registered office: 2 Brentford Business Centre, Commerce Road, Brentford, TW8 8LG, United Kingdom.

1.2 For any privacy question or to exercise your rights, contact us through warden.veritai.ch/contact or at info@veritai.ch.

We collect and process the following categories of data:

We process your personal data on the following legal bases under UK GDPR:

3.1 Where we rely on legitimate interests, we have considered that these are not overridden by your rights, and you may object to this processing (see clause 8).

4.1 Some features of the Service use a third-party artificial-intelligence provider to generate suggested remediation, library-health assessments, and summaries from your scan findings. Our AI sub-processor is OpenAI (OpenAI, L.L.C.), based in the United States.

4.2 The data sent to OpenAI is limited to technical scan findings and is designed not to include your account credentials or billing data. OpenAI states that data submitted through its API is not used to train its models and is retained only for a limited period for abuse monitoring before deletion.

4.3 Because OpenAI processes data in the United States, this involves an international transfer outside the UK. That transfer is protected by appropriate safeguards as described in clause 7 (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).

We do not sell your personal data. We share it only with service providers who help us run the Service, each under a contract that requires them to protect it:

5.1 We may also disclose data where required by law, to enforce our Terms, or to protect our rights, users, or the security of the Service.

5.2 Our support system is operated in-house on the same infrastructure as the Service, so support messages are not shared with a separate ticketing provider.

6.1 We keep your account and scan data for as long as your account is active. When you cancel, your account is closed and we retain your scan data for 60 days. If you re-subscribe within that period on the same or a higher plan, we restore your data. After 60 days, all of your scan data, domain data, reports, and account profile are permanently and irreversibly deleted ("hard deleted") and cannot be recovered.

6.2 The only exception is financial and transaction records (such as invoices and payment records), which we are legally required to keep for at least six years for tax and accounting purposes. These are retained separately from your scan and domain data and are held solely to meet that legal obligation, even after your account and all other data have been hard deleted.

6.3 We may keep aggregated or anonymised data, which does not identify you, for analytics and service improvement.

7.1 Our primary hosting is in the EU (France). Where any provider processes data outside the UK or EEA, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

7.2 You can request more information about these safeguards using the contact details in clause 1.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability; and
• withdraw consent at any time where we rely on consent.

8.1 To exercise any of these rights, contact us using the details in clause 1. We will respond within the time required by law.

8.2 If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. We would ask that you contact us first so we can try to resolve it.

9.1 The Service and our marketing site use cookies and similar technologies that are necessary to operate the Service, to remember your session, and to measure website usage through Matomo.

9.2 Our marketing site uses the LinkedIn Insight Tag to measure the effectiveness of advertising. You can control non-essential cookies through your browser or our cookie controls where provided.

10.1 We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and secure hosting. As a security company, we hold ourselves to the standards we help our customers meet.

10.2 No system is completely secure, and we cannot guarantee absolute security, but we work to protect your data and to respond promptly to any incident.

11.1 The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

12.1 We may update this Privacy Policy from time to time. Where changes are material, we will give reasonable notice. The "last updated" date at the top shows when it was last revised.