1. Who we are
Veridanth is an AI-coaching and consultancy platform for students, researchers and institutions worldwide. Veridanth is a subsidiary of Voranox Inc., headquartered in Toronto, Ontario, Canada, and we are the data controller for the personal data described below. For anything in this policy, write to privacy@veridanth.com.
2. What we collect, and why
2.1 Information you give us when you sign in
To create your account we ask for your name and email address, and you set a password — or you can sign in with your Google account instead. We never store your password in the clear: our authentication provider (Supabase, see §4) keeps only a securely hashed version, and Google sign-in gives us a verified email with no password at all.
If you get in touch through our contact form, we also collect the phone number you give us so we can reach you about your enquiry. We don't buy or sell email lists.
2.2 Information you create inside the studio
Studio work is cached in your browser. When you are signed in and account storage is available, studio documents are also synchronised to our server-backed storage so they can be available on your other devices. Homework Studio distinguishes guest drafts, device copies and account sync status. Guest Homework drafts stay in that browser until you explicitly import them into an account workspace or export them.
- AI assistance. When you ask a coach for help, the relevant assignment, attempt, course context, rubric, source notes and project material may be sent to our AI provider (see §4). A photographed assignment is sent when you request transcription. Avoid including personal identifiers or confidential third-party material unless you are authorised to do so.
- Exports. Homework study sheets, project briefs and backups are generated in your browser. Downloading them does not itself send them to another person or service.
- Device copies. Browser data can remain after sign-out. On shared devices, use a separate browser profile and remove your local copies when appropriate.
- Supervisor access. If you give a supervisor access, we store the name you give them, their email address if you add one, a coarse browser label (e.g. ‘Firefox on Windows’) and sign-in times for each browser they use, and the suggestions they send you. No IP addresses. Removed 30 days after access ends; resolved suggestions after 30 days.
The Authorship Trail (Veridanth Docs) stores keystroke batches and revision snapshots on our servers to support its authorship records. Provider processing and retention depend on the applicable service configuration and terms; this page does not promise immediate deletion of AI requests after a response.
2.3 Information we collect automatically when you use the platform
- Usage counts per email (or per hashed IP if you're not signed in) so we can enforce the daily AI quota.
- IP address, but never in the clear: we hash it with HMAC-SHA256 before storing it, so abuse-prevention works without us building a profile.
- Standard server logs (request path, timestamp, user-agent) used for debugging and security.
2.4 Payment information
Subscriptions and engagement payments are processed by Stripe. Card numbers, Apple Pay and Google Pay credentials and the like never touch our servers — only a reference, the amount, the currency and the method (e.g. card) come back to us. We use that to verify the charge succeeded and to remember which account paid.
2.5 Communications
If you message us or message a booked specialist through the platform, we store the message so the other side can read it and so we can mediate disputes.
3. Our lawful bases under PIPEDA (and the GDPR)
- Performance of a contract — providing the Veridanth account, studio and engagements you signed up for.
- Legitimate interests — abuse prevention (hashed-IP quota, server logs), debugging, fraud detection, and improving the service. These interests are tightly bounded; we use the minimum data needed and tell you about it here.
- Legal obligation — tax records, anti-money-laundering checks where applicable, responding to lawful requests from Canadian and other competent authorities.
- Consent — for anything that isn't one of the above (e.g. optional marketing emails or SMS updates), we ask first, and you can withdraw consent at any time. Under PIPEDA, meaningful consent is the anchor for everything above — this policy is how we keep that consent informed.
4. Who else processes your data, and why
We are accountable for what these processors do with your data on our behalf. We chose them for security and reliability and we use each one for one job only:
- Anthropic (United States) — runs the AI models behind every coach in the studio. When you ask for a draft / rewrite / critique, the relevant text plus the studio's context goes to Anthropic for that one call and is returned as a streamed response. Anthropic's commercial terms prohibit using the data to train their models.
- Stripe (United States / Ireland) — processes card, Apple Pay and Google Pay payments. We pass them your email and the amount; they handle the rest.
- Supabase (United States) — our authentication provider and primary application database. It verifies your sign-in (storing only the hashed password) and holds your account profile, subscriptions, bookings, documents and Authorship Trail proofs.
- Resend (United States) — delivers transactional email (sign-in verification and password resets, payment receipts, milestone notifications).
- Twilio (United States) — delivers SMS updates (deadlines, opportunities), only to numbers that have explicitly opted in.
- Vercel (United States) — hosts the website and runs serverless functions on our behalf.
- Upstash (United States) — holds the short-lived quota counters described in §2.3, and serves as a legacy fallback datastore.
- Kroki (European Union) — renders diagrams. When you press Render in Diagram Studio, that diagram's source text is sent to Kroki and an image comes back. Nothing else about you is sent, and the source is not stored by us in transit. Diagram Studio says so on the page, because a study design or a flow chart with real names should never leave the platform silently. If you self-host Kroki, set
KROKI_URLand nothing leaves your own infrastructure.
To be honest about residency: your data is processed in Canada, the United States and the European Union, depending on the service. We rely on each processor's data-processing agreement and security commitments (including, for EU/UK data, Standard Contractual Clauses or an adequacy decision) to keep your data protected. If you object to this, do not create an account.
5. How long we keep things
- Account profile (email, name) — while your account is open. Deletion requests are reviewed with applicable retention obligations and any open engagements. We confirm completion after the necessary steps are performed.
- Subscription records and booking history — 7 years after the last transaction, for tax and audit obligations.
- Quota counters — daily counters expire automatically after 24 hours; the burst counter expires in under a minute.
- Server logs — retention depends on the hosting and monitoring services in use and operational requirements.
- Authorship Trail proofs — associated with the document and handled as part of a document or account deletion request. Copies already exported or shared with others cannot be removed from their devices by Veridanth.
- Studio content — device copies remain in your browser until removed. Signed-in studio records may also be synchronized to your account as described in §2.2. Removing a device copy does not by itself guarantee deletion from backups or other devices.
- Supervisor access — removed 30 days after access ends; resolved suggestions after 30 days.
Data & privacy controls let you export account and synced studio records and track an account-deletion request. A request does not immediately delete data or cancel recurring billing. Device backup & recovery covers work stored in this browser.
6. Your rights
Under Canada's PIPEDA you have the right to:
- Know what we hold about you (this policy + a written response on request).
- Access a copy of your personal data.
- Correct anything that's inaccurate.
- Erase your account and the personal data attached to it, subject to the retention rules in §5.
- Object to processing based on our legitimate interests.
- Withdraw consent for any consent-based processing.
- Complain to the Office of the Privacy Commissioner of Canada if you think we've mishandled your data — see priv.gc.ca.
6.1 If you're in the EU, EEA or UK (GDPR)
You additionally have the GDPR rights to data portability (a machine-readable copy of the data you gave us), restriction of processing while a dispute is resolved, and to lodge a complaint with your local supervisory authority (or the UK ICO). We do not make automated decisions with legal or similarly significant effect about you.
6.2 If you're a California resident (CCPA/CPRA)
You have the rights to know, delete and correct your personal information, and the right to non-discrimination for exercising them. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of — but the request channel below works for California requests too.
To exercise any of these, write to privacy@veridanth.com. We respond within 30 days.
7. Cookies
We use first-party cookies only, and only for the platform itself to work:
vd_session— proves you're signed in. HTTP-only, signed, 30-day expiry.vd_quota— mirrors today's AI-usage count so the dashboard reads quickly. Server state is the source of truth; this cookie is just a display cache.vd_sv— only for supervisors you invite; proves a browser signed in to one supervisor page. HTTP-only, sent only to that page's API, up to 30 days.
We do not run third-party analytics or advertising cookies. You can block our cookies in your browser settings, but the sign-in flow won't work without vd_session.
8. Security
- All traffic is over HTTPS.
- Session and sign-in tokens are HMAC-SHA256 signed with a secret that lives only on the server.
- IPs are HMAC-hashed before they're used as quota keys, so we never persist them in the clear.
- Payments are handled directly by Stripe — card, Apple Pay and Google Pay credentials never touch our servers.
- Webhook signatures are verified in constant time; in production we refuse any webhook that isn't signed.
No system is perfectly secure. If you spot a vulnerability, please write to security@veridanth.com.
9. Children
Veridanth is built for adults and older students. You must be at least 16 to create your own account. If you're under 16, please ask a parent or guardian to set up the account on your behalf.
10. Changes to this policy
We'll update this page when our practices change, and bump the “Last updated” date at the top. If a change materially reduces your rights or expands what we collect, we'll let you know by email before it takes effect, and you'll have a chance to delete your account before the new policy applies to you.
11. Contact
Privacy questions or requests: privacy@veridanth.com
Security disclosures: security@veridanth.com
Anything else: hello@veridanth.com