Privacy Policy

1. Data We Collect

We collect the following categories of data:

• Account data: email address, organization name, IP address at registration
• Event data: AI agent actions, payloads, timestamps submitted via the API
• Usage data: API calls, session logs, access patterns
• Audit data: records of who accessed event data and when

2. How We Use Your Data

We use your data to:

• Provide the cryptographic audit trail service
• Generate compliance reports and evidence packages
• Detect anomalous behavior and security threats
• Send transactional emails (verification, alerts)
• Improve the Service

3. Data Storage and Security

Event data is stored in PostgreSQL with cryptographic signatures. Signing keys are stored in AWS KMS FIPS 140-2 Level 3 HSMs. Data is encrypted at rest and in transit.

4. Data Retention

Event data is retained for as long as your account is active and for up to 90 days after termination. Audit logs are retained for 12 months. You may request deletion at any time.

5. Data Sharing

We do not sell your data. We share data only with:

• Infrastructure providers (Railway, AWS) under data processing agreements
• Sigstore/Rekor for public transparency log anchoring (event hashes only, no payloads)
• Law enforcement when required by law

6. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Data portability
• Object to processing
• Lodge a complaint with your supervisory authority

7. Cookies

We use session cookies for authentication only. We do not use tracking or advertising cookies. No third-party analytics are embedded in the platform.

8. International Transfers

Data may be processed in the United States. We use standard contractual clauses for transfers from the EU/EEA.

9. Children

The Service is not directed at individuals under 18 years of age. We do not knowingly collect data from minors.

10. Contact

Privacy inquiries: hello@vrlg.tech