Privacy Policy

01 Who we are and scope

Verica is a no-code platform for evaluating large language model (LLM) outputs. It lets teams build evaluation datasets, define grading criteria, run evaluations, and gate releases in CI.

This policy covers the Verica web application, our APIs and command-line tools, and the marketing site at verica.app. It does not cover third-party services you connect to Verica, such as model providers, which are governed by their own policies.

For your account information, marketing-site data, and communications, MTN LABS LLC acts as the data controller. For the evaluation content your workspace processes on the platform, we act as a data processor (service provider) on behalf of your organization, which remains the controller of that data.

02 Information we collect

We collect the following categories of information:

• Account information — your name, work email, company, and authentication details when you register or contact us.
• Evaluation content — the datasets, prompts, expected answers, model outputs, grading criteria, notes, and results you create or upload to the platform.
• Model provider keys — API keys you choose to add for third-party model providers, stored in encrypted form as described below.
• Usage data — log data about how you interact with the service, including pages viewed, features used, evaluation runs, timestamps, device and browser type, and IP address.
• Communications — messages you send us, including contact-form messages and support inquiries.

03 How we use information

We use the information we collect to:

• Provide, operate, and maintain the evaluation platform and run the evaluations you request.
• Authenticate users, secure accounts, and enforce per-workspace isolation.
• Respond to your requests, provide support, and communicate about your account or the Service.
• Monitor, debug, and improve the reliability, security, and performance of the service.
• Comply with legal obligations and enforce our terms.

04 Legal bases for processing (GDPR)

Where the GDPR or similar laws apply, we process personal data under the following legal bases:

• Performance of a contract — to provide the platform, operate your account, and run the evaluations you request.
• Legitimate interests — to secure, monitor, debug, and improve the service, and to respond to your inquiries, balanced against your rights.
• Consent — where required, for example for non-essential analytics on the marketing site; you can withdraw it at any time.
• Legal obligation — to comply with laws that apply to us.

05 Your evaluation content

Your evaluation datasets, prompts, model outputs, and results belong to you. We process this content solely to provide the service to you and your workspace, and we do not use it to train our own models or those of any third party.

Content is isolated per workspace. Members of your workspace can access shared content according to the roles you assign. We access your content only as needed to operate the service, provide support you request, or comply with law.

06 Model provider keys (BYOK)

Verica uses a bring-your-own-key model. When you add a provider API key, it is sealed with a split key that the web application cannot decrypt. The key is only reconstructed inside an isolated worker at the moment an evaluation call is made, and is never exposed to the browser or stored in plaintext.

When you run an evaluation, the relevant inputs and outputs are sent to the model provider you configured using your key. That data is then subject to the provider's own privacy and data-use policies. You are responsible for ensuring your use of each provider complies with the terms that apply to your key.

07 How we share information

We do not sell your personal information. We share information only in these circumstances:

• Service providers (sub-processors) — infrastructure, hosting, and analytics vendors that process data on our behalf under contractual confidentiality and security obligations. The current list is published on our Trust Center at verica.app/trust.
• Model providers — the third-party LLM providers you configure, which receive the evaluation inputs and outputs you send through your own key.
• Legal and safety — when required by law or legal process, or to protect the rights, safety, and security of Verica, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

08 Cookies and analytics

We use strictly necessary cookies to keep you signed in and to secure the service. On the verica.app marketing site we use Google Analytics to understand aggregate traffic and improve the site; we do not use advertising cookies. You can control cookies through your browser settings, though disabling some cookies may affect functionality.

09 Data retention

We retain your account information and evaluation content for as long as your account is active or as needed to provide the service. You can delete datasets, runs, and other content from within the platform. When you close your account, we delete or anonymize your content within a commercially reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Deleted content may also persist in encrypted backups for up to 90 days, until it rolls off our backup retention window.

10 Security

We use technical and organizational measures to protect your information, including encryption in transit and at rest, split-key sealing of provider credentials, per-workspace isolation, and access controls. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you of material incidents as required by law.

11 International data transfers

We may process and store information in countries other than where you live. Where we transfer personal data across borders, we rely on appropriate safeguards, such as standard contractual clauses, to protect that data consistent with applicable law.

12 Your rights and choices

Depending on where you live, you may have the right to:

• Access, correct, or delete the personal information we hold about you.
• Object to or restrict certain processing, or request a portable copy of your data.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

13 California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) gives you specific rights: to know what personal information we collect and how we use it (described in this policy), to access or delete it, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out preference where required by law.

To exercise these rights, contact us at [email protected]. We will verify your request and respond within the timeframes required by law.

14 Children's privacy

Verica is a business tool not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, please contact us and we will delete it.

15 Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of Verica after an update means you accept the revised policy.

16 Contact us

If you have questions about this policy or your data, contact us at [email protected], or by mail at MTN LABS LLC (d/b/a Verica), 6900 Tavistock Lakes Blvd, Ste 400, Orlando, FL 32827, United States.