Privacy Policy

Effective and last updated: September 17, 2026

This Privacy Policy explains how Verita, LLC ("Verita," "we," "us," or "our") handles information when you use the Verita website at verita.software, the Verita mobile and tablet apps, our emails, and any related services (together, the "Service"). It is part of our Terms of Service.

Contents

1. Scope and roles
2. Information we handle
3. How account connections work
4. How we use information
5. What we never do
6. When information leaves Verita
7. Who at Verita can see your data
8. Cookies, tracking, and analytics
9. Security
10. Retention and deletion
11. Your choices and rights
12. State privacy rights
13. California notice
14. International users
15. Children
16. Mobile app permissions
17. Emails we send
18. Legal requests
19. If something goes wrong
20. If Verita changes hands
21. Changes to this policy
22. Contact us

1. Scope and roles

Verita is business software. A business (the "Customer") creates a company account, connects its financial accounts, and invites people ("Authorized Users"), such as owners, finance staff, board members, investors, and lenders.

• Customer Data. This means the financial and business information a Customer connects to, uploads to, or creates in the Service, including the personal information of people that appears in it. For Customer Data, the Customer decides what is collected and who may see it. We process it only on the Customer's behalf and on its instructions. In the language of privacy laws, the Customer is the "controller" or "business," and we are its "processor" or "service provider."
• Account Information. This means the information we need to run your own login, such as your name, email address, and password. We are responsible for this information, and we use it only as described here.

If you are an Authorized User invited by a Customer, the Customer controls your access, and you may contact the Customer about its data practices. You can also contact us, and we will help.

This policy does not cover third-party websites, apps, or services, even if you reach them through Verita. Examples include your bank, Plaid, QuickBooks, Xero, Gusto, and Finch. Their own privacy policies apply.

2. Information we handle

2.1 Information you give us

• Account details: name, email address, password (stored only as a one-way hash, never in readable form), company name, and job title.
• Company settings: logo, colors, fiscal year, report preparer name, report wording, chosen metrics, and automatic-report schedules.
• Team information: the names and email addresses of people you invite, their access levels, which reports they may see, and which reports they receive by email.
• Content you enter: transaction categories, notes, splits, rules, cash transactions, receipt photos, and metric values you type in (such as customer counts or headcount).
• Messages: email addresses and messages you enter when emailing a report, and anything you send us when you ask for help.
• Billing details (if you choose a paid plan): billing contact and plan. Card numbers are entered directly with our payment processor, and we never see or store full card numbers.

2.2 Information from accounts you connect

Only when you choose to connect an account, and only for the accounts you select, we receive:

• Banks and credit cards (through Plaid): account names, types, last four digits of account numbers, balances, and transactions (date, amount, description, merchant, and category data provided by the institution). We do not receive or store your bank username or password.
• Accounting software (QuickBooks, Xero): chart of accounts, income statement, balance sheet, and related report data, and where available, daily or transaction-level detail.
• Payroll providers (Gusto, Finch): pay-run totals and their breakdown (wages, employer taxes, benefits, retirement contributions), used to match payroll to bank activity. We ask only for the data needed for this, not individual employees' Social Security numbers or bank details.

Each connection gives us a secure access token from the provider. We store that token encrypted, and you can revoke it at any time (see Section 3).

2.3 Information created automatically when you use the Service

• Sign-in security records: which two-factor method you use, the browsers and phones you chose to trust (a name such as "Browser on Mac," and when it was added and last used), and hashed one-time codes that expire within minutes.
• Security and audit records: sign-ins, invitations, changes to settings, reports created, reports emailed (recipient, time, and whether delivery succeeded), and similar actions, with the time and the user who performed them.
• Technical logs: IP address, browser or device type, operating system, pages or API endpoints requested, and error details. Our hosting provider records these to keep the Service running and secure.
• Your view settings: for example, whether you last viewed weekly or monthly numbers, and which metrics you chose to show.

2.4 Information we do not collect

• We do not collect your precise location, contacts, calendar, microphone audio, or advertising identifiers.
• We do not collect bank or accounting-software passwords.
• We do not buy or receive information about you from data brokers or advertisers.
• We do not ask for, and ask you not to upload, government ID numbers, full card numbers, health information, or other sensitive personal information that the Service does not need. If sensitive information appears in data you connect (for example, in a transaction description), we treat it with the same protections as everything else and never use it for any other purpose.

3. How account connections work

• Banks and cards. We use Plaid Inc. ("Plaid") to connect bank and card accounts. You sign in through Plaid's secure flow, not through Verita. By connecting, you acknowledge that Plaid collects and processes your information under the Plaid End User Privacy Policy. Our commitments in this policy apply to everything Plaid sends to us.
• QuickBooks, Xero, Gusto, and Finch. You sign in on the provider's own website and approve the access you grant. Each provider's terms and privacy policy apply to its own handling of your information.
• Disconnecting. You can disconnect an account in Verita, and we will then stop fetching new data and delete the access token. You can also revoke access directly with the provider (for example, in your bank's or Plaid's settings, or in your QuickBooks or Xero connected-apps settings). To also delete data already imported, see Section 10.
• Read-only. Verita asks only for read access. It does not move money, make payments, or change anything in your bank or payroll accounts. Changes to your accounting records are made only if a future feature offers it and you turn it on.

4. How we use information

We use information only for these purposes:

1. To provide the Service you asked for. This covers importing and organizing your data, suggesting categories based on your own company's past choices and rules, calculating metrics, building dashboards, creating and storing PDF reports, running the automatic reports you schedule, sending reports and invitations to the people you choose, and showing your company's branding.
2. To operate your account. This covers signing you in, managing your team and access levels, handling billing if you're on a paid plan, and answering your support requests.
3. To keep the Service and your data secure. This covers preventing fraud, abuse, and unauthorized access, keeping audit records, and investigating security incidents.
4. To keep the Service working. This covers fixing errors and ensuring reliability, using technical logs, and inspecting the data involved only when needed to fix a problem you reported or a failure affecting your account (see Section 7).
5. To send you necessary messages. These include security alerts, invitations, the report emails you or your administrator turned on, receipts, and important notices about the Service or these policies. We do not send marketing emails to Authorized Users.
6. To meet legal obligations and enforce our agreements. See Section 18.

Suggestions and automatic categorization in Verita are generated for your company from your company's own data and settings. One Customer's data is never used to make suggestions for another Customer.

We use Account Information to understand basic Service usage only in simple counts, such as the number of reports created. We never use it to profile you or to market to you on other platforms.

5. What we never do

Without exception, we do not and will not:

• Sell or "share" personal information or Customer Data, as those terms are defined in any law, including sharing for cross-context behavioral advertising.
• Rent, lease, trade, barter, license, or otherwise make your data available to anyone for their own use.
• Use your data for targeted advertising, profiling, credit decisions, lending, insurance, employment decisions, or eligibility decisions of any kind.
• Use your data, including data we or others consider aggregated, anonymized, pseudonymized, or de-identified, for benchmarking, market research, industry reports, investment decisions, or any product or service other than the Service provided to you.
• Use your data to train, fine-tune, evaluate, or improve any artificial-intelligence or machine-learning model. If we ever add a feature that sends data to an AI provider to answer your request, it will be off unless you turn it on, the provider will be contractually barred from keeping or training on your data, and we will update this policy before launch.
• Combine your data with information from data brokers or other outside sources to learn more about you.
• Place advertising in the Service or in our emails.
• Use third-party advertising cookies, tracking pixels, fingerprinting, or session-replay tools.
• Use one Customer's data for another Customer.
• Use data obtained through Plaid, Intuit, Xero, or any other connection provider for any purpose other than providing the Service to the Customer who connected it.

Anyone who receives your data from us to help run the Service (see Section 6) is contractually bound by these same restrictions.

6. When information leaves Verita

We never sell or share your data. It leaves our systems only in the limited situations below.

6.1 When you or your company direct it

• To people you invite. Authorized Users see what their access level allows.
• To people you email reports to. When you or your administrator send a report, or turn on automatic report emails, we deliver the PDF to those addresses. After a report is delivered, we can't control what recipients do with their copy.
• To connection providers you choose. Connecting an account requires exchanging information with that provider (for example, your access token and the request for your data).
• Through your own device. When you share or email a PDF using your phone's share sheet or mail app, that transfer happens on your device and is governed by the app you choose.

6.2 To service providers that run the Service for us

We use a small number of carefully chosen providers. Each may process data only to provide its service to us, under a written contract that requires confidentiality and security, forbids any other use, and forbids selling or sharing. Data is disclosed only as needed for each provider's function.

We will keep a current list of these service providers and give it to any Customer who asks. We will also notify Customers who ask before we add or replace a provider that stores Customer Data.

6.3 When the law requires it

Only as described in Section 18.

6.4 To protect people

We may disclose the minimum information needed if we believe in good faith that doing so is necessary to prevent imminent death or serious bodily harm. We will tell the affected Customer as soon as it is safe and lawful to do so.

There are no other situations in which we disclose your data.

7. Who at Verita can see your data

Access to production systems is limited to the few personnel who need it to run the Service. Our personnel may access Customer Data only:

• when you or your administrator ask us for help and give permission,
• when needed to investigate or fix a security issue, suspected abuse, or a failure affecting your account, or
• when required by law (Section 18).

Personnel with access are bound by written confidentiality obligations and these rules. Viewing Customer Data for any other reason is prohibited and grounds for removal from the company.

8. Cookies, tracking, and analytics

• Strictly necessary cookies only. The website sets a signed session cookie that keeps you signed in and protects forms from forgery. It contains no advertising or tracking information and is cleared when you sign out and expires after 14 days.
• No advertising, social-media, or cross-site tracking cookies. We don't use third-party analytics that follow you across websites.
• Fonts are hosted by us. The website loads its fonts from our own servers, so viewing a page doesn't send your information to a font provider.
• Do Not Track and Global Privacy Control. We don't track you or sell or share your data, so there is nothing to opt out of. We still treat a Global Privacy Control signal as a valid opt-out request wherever the law requires.
• Browser storage. The website may remember simple preferences in your browser. The mobile app stores your sign-in token in your device's secure storage (Keychain on iOS, Keystore on Android) and cached report files in its private cache.

If we ever want to add privacy-friendly usage analytics, they will not use cookies that identify you, will not track you across sites, and will be described here before they are turned on.

9. Security

We use administrative, technical, and physical safeguards designed to protect your data, including:

• encryption in transit (HTTPS/TLS) for the website, the apps, and the API,
• additional application-level encryption of connection access tokens,
• passwords stored only as salted bcrypt hashes,
• required two-factor sign-in (an authenticator app or emailed one-time codes), with single-use recovery codes stored only as hashes and authenticator keys stored encrypted,
• optional Face ID, Touch ID or fingerprint sign-in on phones. Your face or fingerprint never leaves your device, and we never receive or store biometric data. Your phone confirms it's you and then unlocks a sign-in key that is kept in its secure storage and that you can revoke at any time,
• strict separation of each Customer's data, with access checks on every request,
• role-based access levels (Company admin, Admin, Editor, Viewer, Report viewer), including limits on which report types a person may see,
• short-lived signed download links (15 minutes) for opening reports on phones, and invitation links that expire after 14 days and work only for the invited email address,
• protection against cross-site request forgery, security headers, and rate limits on sensitive actions such as sending email and invitations,
• audit logs of sensitive actions, and a "sign out on all devices" option,
• the principle of least privilege for our personnel and providers.

No system is perfectly secure. You help protect your account by using a strong, unique password, keeping your devices secure, inviting only people you trust, and removing access promptly when someone leaves. Tell us right away at support@verita.software if you suspect unauthorized access.

10. Retention and deletion

• While your account is active, we keep your data so the Service can show your history and reports.
• You can delete things any time. Owners and admins can delete saved reports, disconnect accounts, and remove people. Deleting a report deletes its PDF file.
• Closing your company account. An owner can ask us to close the account and delete everything. We disconnect every connected account, revoke the access tokens, and delete Customer Data from our active systems within 30 days. Copies in backups are overwritten on our normal backup cycle, and in any case within 90 days. Until then, backups stay encrypted and are not used.
• Leaving a company. If you are removed from a company, you lose access right away. Your login remains (for other companies you belong to) until you ask us to delete it.
• Export before you go. You can download your saved reports at any time. On request, we will provide an export of your Customer Data in a common, machine-readable format before deletion.
• Inactive and unpaid accounts. If an account is closed for non-payment or inactivity, we will email the owners at least 30 days before deleting data.
• Limited records we keep longer. We keep only what the law requires or what is needed for security and legal claims. Examples are billing records (typically 7 years, for tax law), records of privacy requests (24 months), and minimal security logs (up to 12 months). These records are restricted and used for nothing else.

11. Your choices and rights

Wherever you live, you can ask us to:

• access the personal information we hold about you and get a copy in a portable format,
• correct inaccurate information,
• delete your information,
• restrict or object to processing,
• withdraw consent where we rely on it (for example, by disconnecting an account), and
• stop optional emails. You can turn off automatic report emails under Settings → My settings (website) or Reports → Email me new reports (app).

Email support@verita.software from the address on your account. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, as some laws allow, we will say why, and the extension will be no longer than 45 more days. We will verify your identity before acting, usually by confirming control of your email address. We will never charge you for a reasonable request, and we will never treat you differently for making one.

If your request is about Customer Data controlled by a company you belong to, we may forward it to that company and help it respond, as privacy laws require of service providers.

Authorized agents. You may use an authorized agent where the law allows. We may ask for signed permission and may ask you to verify your identity directly.

Appeals. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line. We will respond within 60 days. If you are still unsatisfied, you may contact your state attorney general.

12. State privacy rights

Many U.S. states have consumer privacy laws, including Texas (the Texas Data Privacy and Security Act), California, Colorado, Connecticut, Virginia, Utah, Oregon, and others. Depending on where you live, you may have the rights described in Section 11, plus the right to opt out of the sale of personal data, targeted advertising, and profiling that has legal or similarly significant effects.

Verita does not sell personal data, does not process personal data for targeted advertising, and does not profile people in ways that produce legal or similarly significant effects. We extend these protections to every user, whether or not a particular law applies to us or to you.

Sensitive data. We do not seek to collect sensitive personal data. If any appears in Customer Data, we process it only to provide the Service at the Customer's direction, and never sell it or use it to infer anything about anyone.

Nevada. We do not sell covered information as defined in Nevada law.

13. California notice

This section supplements the rest of this policy for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"). In the past 12 months, we collected the following categories of personal information, only from the sources and only for the purposes described in Sections 2 and 4:

We have not sold or shared personal information in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only to provide the Service, so no "limit the use" link is required. We still honor any request to limit. We disclosed the categories above for business purposes only to the service providers and recipients described in Section 6. Retention periods are described in Section 10. California residents may exercise their rights as described in Section 11.

Shine the Light. We do not disclose personal information to third parties for their direct-marketing purposes.

14. International users

The Service is designed for businesses in the United States, and data is stored and processed in the United States. If you use the Service from another country, your information will be transferred to the United States, where privacy laws may differ from yours. Where the law of your country (for example, the GDPR or UK GDPR) applies, our legal bases are these:

• performing our contract with you or your company,
• our legitimate interest in securing the Service (always weighed against your rights),
• your consent, which you can withdraw at any time, and
• compliance with legal obligations.

You may also complain to your local data-protection authority. On request, we will sign a data processing agreement with standard contractual clauses.

15. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

16. Mobile app permissions

• Camera and photos: only when you choose to add a receipt photo. We upload only the photo you pick.
• Files and sharing: to save a report PDF temporarily so you can open, share, or email it through your device.
• Mail: only to open your device's mail app with a report attached, when you ask.
• Network: to talk to Verita's servers.

The app does not request location, contacts, microphone, Bluetooth, or tracking permission. It contains no advertising or third-party analytics software. You can change permissions at any time in your device settings.

17. Emails we send

• Report emails are sent only when a person in your company sends one, or when report emails are turned on for you. Each recipient gets a separate message, so recipients can't see each other's addresses. Replies go to the person who sent the report.
• Invitations are sent only when an owner or admin invites you.
• Service and security messages (for example, password or security alerts) can't be turned off while you have an account, because they protect you.
• Our emails contain no advertising and no tracking pixels, and we don't track clicks on their links.

18. Legal requests

We disclose Customer Data to governments or in litigation only when legally compelled by a valid subpoena, court order, search warrant, or equivalent legal process. When that happens, we:

• review every request for legal validity and scope, and push back on requests that are unclear, overly broad, or improper,
• first ask the requester to seek the data from the Customer directly, where appropriate,
• notify the affected Customer before disclosure, so it can seek protection, unless the law prohibits notice or there is an emergency involving danger of death or serious injury, in which case we notify as soon as the restriction ends, and
• disclose only the minimum data the process requires.

We do not give any government "backdoor" or bulk access to our systems. We may also use or disclose information as needed to enforce our Terms, to defend legal claims, or to protect the security of the Service. Any such use is limited to what is strictly necessary for that purpose.

19. If something goes wrong

If we learn of a security breach affecting your data, we will notify affected Customers without undue delay, and within 72 hours of confirming it where feasible. We will tell you what happened, what data was involved, what we are doing, and what you can do. We will also notify regulators and individuals as the law requires.

20. If Verita changes hands

If Verita, LLC is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its business, Customer Data will not be sold as a separate asset. It may transfer only as part of continuing to provide the Service to you, and only to a successor that agrees to be bound by this Privacy Policy, including every commitment in "Our promise" and Section 5. We will notify Customers at least 30 days before any such transfer. During that time, owners may export their data and have it deleted instead.

21. Changes to this policy

We may update this policy to reflect changes to the Service or the law. If we make a material change, we will post it here with a new date and email the owners and admins of every company at least 30 days before it takes effect.

We will never apply a change that weakens the commitments in "Our promise" or Section 5 to data we already hold, or to any Customer, without that Customer's express, opt-in consent.

Earlier versions of this policy are available on request.

22. Contact us

Verita, LLC
Austin, Texas
Email: support@verita.software (please include "Privacy" in the subject line)

If you have a concern, please contact us first. We will do our best to resolve it.