Privacy Policy
Last updated:
This policy explains what personal data Veriso collects when you use veriso.art, the Veriso iOS and Android apps, the Veriso browser extension and Veriso inside AI assistants (ChatGPT, Claude and other MCP clients), why we collect it, who we share it with, how long we keep it and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).
In short: we use your photos and artwork details to produce your analysis, we send them to the AI and image-recognition providers listed below to do so, we never sell your data, and you can download or delete it at any time.
1. Who we are
Veriso (www.veriso.art) is the data controller for the personal data described in this policy. Veriso is operated by Sharon Chicheportiche (Veriso), Khaviva reik 1, Ramat Gan 5252510, Israel, VAT 328971585.
Publication director: Sharon Chicheportiche.
Privacy contact: privacy@veriso.art. General support: support@veriso.art. We have not appointed a Data Protection Officer, as we are not required to; the privacy contact above handles all data protection requests.
2. What data we collect
Account data. Your email address, your name (if you give one), your profile picture (if you sign in with Google or Apple), your password in hashed form (if you sign up with email and password — we never store it in clear text), your plan and subscription status, and the country, region and city you choose in your profile.
Sign-in data. If you sign in with Google or Apple, we receive an identifier for your account with that provider and your email address and name, as allowed by your settings with that provider.
Artwork photos and details. The photos you upload (front, back, signature, labels…) and anything you tell us about the work: dimensions, medium, where it comes from, questions you ask about it. Photos can show other information you did not intend to share (a room, a face, a document) — please crop them if needed.
Analysis results. The reports we generate: attribution, signature reading, period, medium, estimated value range, confidence scores, comparable sales, and any corrections you send us. Results are linked to your account, or to an anonymous analysis identifier if you are not signed in.
Usage data. Which features you use (analyses started and completed, tools used, emails sent to auction houses through Veriso, favourites, tags), the number of analyses per month for plan limits, and aggregated page-view statistics.
Device and connection data. IP address, browser or app type, operating system, language, and a technical device fingerprint attached to each analysis request. We use these for security, fraud and abuse prevention (for example to enforce free-analysis limits) and in server logs.
Payment data. Payments are handled by Paddle, our merchant of record (see section 4). Veriso receives your Paddle customer and subscription identifiers, plan, price, currency, billing interval and payment status. We never receive or store your card number or bank details.
Communications. Messages you send us through the contact form or by email, and the emails you choose to send to auction houses or galleries from Veriso (recipient, subject, message and the photos you attach).
Connected services. If you connect your eBay account to create listing drafts, we store the eBay authorisation tokens (encrypted) and the identifiers of the drafts we created for you.
Veriso browser extension. When you click "Analyse with Veriso" on a supported listing page (eBay, Drouot, Catawiki, 1stDibs), or choose "Analyze image with Veriso" on an image, the extension sends that image, and on listing pages its title and price, to veriso.art to analyse it under your Veriso account, using your existing veriso.art sign-in. The toolbar popup reads your veriso.art session to show which account you are signed in with. The extension does not read or send your browsing history or any other page content, and stores nothing in your browser. Analyses are kept in your Veriso history like analyses made on the website.
We do not ask for, and ask you not to send us, special categories of data (health, religion, political opinions, etc.).
3. Why we use it, and on what legal basis
- Provide the analysis service: read signatures and labels, identify the artist, period and medium, estimate a value range, write your report
- Data used: Photos, artwork details, analysis results
- Legal basis (GDPR art. 6): Performance of our contract with you (art. 6(1)(b))
- Create and manage your account, history, favourites and tags; sign-in
- Data used: Account and sign-in data
- Legal basis (GDPR art. 6): Contract (art. 6(1)(b))
- Billing: subscriptions, plan limits, failed-payment reminders, cancellations
- Data used: Payment data, account data, usage counts
- Legal basis (GDPR art. 6): Contract (art. 6(1)(b))
- Keep accounting and tax records
- Data used: Payment data
- Legal basis (GDPR art. 6): Legal obligation (art. 6(1)(c)) — French Commercial Code, art. L123-22
- Send service emails (analysis ready, password reset, billing notices) and the emails you ask us to send to auction houses
- Data used: Email address, communications
- Legal basis (GDPR art. 6): Contract (art. 6(1)(b))
- Security, fraud and abuse prevention, enforcing free-usage limits
- Data used: Device and connection data, usage data
- Legal basis (GDPR art. 6): Our legitimate interest in protecting the service and our users (art. 6(1)(f))
- Improve the service: measure which features work, fix errors, check the accuracy of analyses against corrections and expert feedback
- Data used: Usage data, analysis results, corrections, photos
- Legal basis (GDPR art. 6): Our legitimate interest in offering an accurate, reliable service (art. 6(1)(f))
- Research and development: build and evaluate new analysis methods, using pseudonymised or aggregated data where possible
- Data used: Analysis results, corrections, photos
- Legal basis (GDPR art. 6): Our legitimate interest (art. 6(1)(f)); you can object at any time (section 6)
- Newsletter and product news, if you subscribe
- Data used: Email address
- Legal basis (GDPR art. 6): Your consent (art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link
We do not sell your personal data, we do not use it for advertising, and we do not allow our AI providers to use it to train their own models (see section 4).
Automated results. Veriso analyses are produced automatically by AI models. They are informational opinions, not decisions that produce legal effects on you or similarly significantly affect you within the meaning of GDPR art. 22. You can always ask a human expert to review a work, and you can send us a correction from any report.
4. Who we share it with
We use the following service providers ("processors") to run Veriso. Each processes your data only on our instructions, under a data processing agreement (DPA) that meets GDPR art. 28, and only for the purpose listed. They are not allowed to use it for their own purposes.
- OpenAI, L.L.C.
- What it does for Veriso: AI analysis of artwork photos and report writing
- Data it receives: Photos, artwork details, intermediate analysis text
- Location: USA
- Agreement: OpenAI DPA
- Google LLC (Google Cloud)
- What it does for Veriso: Cloud Vision API (text and signature reading, web detection) and Gemini API (image analysis)
- Data it receives: Photos, artwork details
- Location: USA
- Agreement: Google Cloud DPA
- Anthropic, PBC
- What it does for Veriso: Claude models for analysis, review and report writing
- Data it receives: Photos, artwork details, intermediate analysis text
- Location: USA
- Agreement: Anthropic Commercial Terms and DPA
- SerpApi, LLC
- What it does for Veriso: Reverse image search (finding where an image of the work appears online)
- Data it receives: A link to your uploaded photo
- Location: USA
- Agreement: SerpApi terms
- Perplexity AI, Inc.
- What it does for Veriso: Web research on artists and auction results
- Data it receives: Search terms only (artist names, signature text) — no photos, no account data
- Location: USA
- Agreement: Perplexity API terms
- Vercel Inc.
- What it does for Veriso: Website and API hosting, server logs, cookieless page-view analytics
- Data it receives: All data passing through the service; IP address and device data in logs
- Location: USA (servers in the US and EU)
- Agreement: Vercel DPA
- Neon (Databricks, Inc.)
- What it does for Veriso: Database hosting (accounts, analyses, billing records)
- Data it receives: Account data, analysis results, usage and payment status
- Location: USA
- Agreement: Neon DPA
- Cloudflare, Inc. (R2)
- What it does for Veriso: Storage of uploaded artwork photos
- Data it receives: Photos
- Location: USA (global network)
- Agreement: Cloudflare DPA
- Resend (Plus Five Five, Inc.)
- What it does for Veriso: Transactional emails (sign-in, password reset, analysis and billing notifications) and the emails you send to auction houses
- Data it receives: Email address, name, email content and attachments
- Location: USA and EU
- Agreement: Resend DPA
- Functional Software, Inc. (Sentry)
- What it does for Veriso: Error monitoring (crash and error reports from the website and API)
- Data it receives: IP address, device and browser data, technical error details
- Location: EU (Frankfurt)
- Agreement: Sentry DPA
- Intuition Machines, Inc. (hCaptcha)
- What it does for Veriso: Bot protection on free tools
- Data it receives: IP address, device and interaction data
- Location: USA
- Agreement: hCaptcha privacy
Our AI providers (OpenAI, Google, Anthropic) process your data through their business API offerings, under which they do not use API inputs or outputs to train their models and keep them only for a limited period (typically up to 30 days) for abuse monitoring, unless the law requires longer.
Paddle. Paddle.com Market Ltd (United Kingdom) is our merchant of record: it sells subscriptions on our behalf, processes your payment, issues your invoices and handles sales tax. For that, Paddle acts as an independent controller of your payment data under its own privacy policy. The United Kingdom benefits from an EU adequacy decision.
Services you choose to use. Some recipients act as independent controllers, only when you ask for it: Google or Apple when you sign in with them; eBay if you connect your eBay account; the auction houses and galleries you email from Veriso, which receive your message, your email address and the photos you attach; and ChatGPT, Claude or other AI assistants when you use Veriso through them (see Legal). Their own privacy policies apply.
Public reference sources. To identify artists and comparable sales, we query public databases and auction records (for example Getty ULAN, Wikidata, Europeana, museum collections and public auction results). These queries contain only artwork-related terms such as an artist name or signature text, never your identity.
We may also disclose data when required by law or by a court, to protect our rights or users' safety, or to a successor if Veriso is merged or sold — in which case this policy will continue to apply and you will be informed.
5. How long we keep it
- Account data
- Retention period: For as long as your account exists. When you delete your account, it is deleted immediately from our live database and removed from backups within 30 days.
- Artwork photos and analysis results linked to your account
- Retention period: For the lifetime of your account, so you can revisit your history, unless you ask us to delete specific analyses earlier. Deleted with your account (backups within 30 days).
- Analyses made without an account (website or AI assistants)
- Retention period: Up to 24 months after the analysis, then deleted or anonymised. You can ask for earlier deletion at any time.
- Payment and billing records (subscription, amounts, invoices)
- Retention period: 10 years from the end of the financial year, as required by French accounting law (Commercial Code art. L123-22). Paddle keeps its own records under its policy.
- Security and anti-fraud data (IP address, device fingerprint, risk signals)
- Retention period: 12 months from collection.
- Server and application logs
- Retention period: Between 30 and 90 days, depending on the log.
- Emails to us and support requests
- Retention period: 3 years from our last exchange.
- Newsletter subscription
- Retention period: Until you unsubscribe.
- Aggregated or anonymised statistics
- Retention period: May be kept without limit, as they no longer identify you.
6. Your rights
Under the GDPR you have the following rights over your personal data:
- Right of access (art. 15) — get a copy of the data we hold about you.
- Right to rectification (art. 16) — have inaccurate or incomplete data corrected. You can edit your profile in your account settings.
- Right to erasure (art. 17) — have your data deleted. You can delete your account at any time from your account settings.
- Right to restriction of processing (art. 18) — ask us to stop using your data while a dispute about it is resolved.
- Right to data portability (art. 20) — receive your data in a structured, machine-readable format. Signed-in users can download all their data as a JSON file at /account/export.
- Right to object (art. 21) — object at any time to processing based on our legitimate interests, including research and development use of your analyses, and to any direct marketing.
- Right to withdraw consent (art. 7(3)) — where we rely on your consent (newsletter), withdraw it at any time without affecting earlier processing.
- Right to define instructions about what happens to your data after your death (French Data Protection Act, art. 85).
- Right to lodge a complaint with a supervisory authority — in France, the CNIL (section 12), or the authority of the EU country where you live or work.
To exercise a right, email privacy@veriso.art from the address linked to your account (or tell us which address it is). We may ask for additional information to confirm your identity. We answer within 30 days; if a request is particularly complex we will tell you within those 30 days if we need more time, as GDPR art. 12(3) allows. Exercising your rights is free.
7. International transfers
Veriso is operated from Israel. The European Commission recognises that Israel ensures an adequate level of protection for personal data (Decision 2011/61/EU, confirmed by the Commission's review of 15 January 2024), so data we handle ourselves needs no additional safeguard.
Several of our providers (section 4) are based in the United States, so your data is processed outside the European Economic Area. We only transfer it with the safeguards required by Chapter V of the GDPR:
- the EU–US Data Privacy Framework adequacy decision (European Commission, 10 July 2023), for providers certified under it;
- otherwise, the European Commission's Standard Contractual Clauses (Decision 2021/914), included in each provider's data processing agreement;
- plus additional measures: encryption in transit and at rest, access controls, and limiting what each provider receives to what it needs (for example, Perplexity never receives photos or account data).
You can ask for a copy of the relevant safeguards at privacy@veriso.art.
9. How we protect it
- Encryption in transit: all traffic to Veriso and between Veriso and its providers uses HTTPS/TLS.
- Encryption at rest: our database, photo storage and hosting providers encrypt stored data; connected-service tokens (eBay) are additionally encrypted by Veriso.
- Passwords are stored only as salted bcrypt hashes.
- Access controls: production systems and provider dashboards are restricted to the people who need them, with separate credentials and secrets kept out of the code.
- Photo links are long, unguessable addresses; anyone you share a link with can view that photo, so share them carefully.
- Abuse protection: rate limits, bot protection and fraud signals protect accounts and the free service.
- Regular reviews: we review our code, dependencies and provider list for security issues on a regular basis, and update this policy when the list changes.
If a personal data breach is likely to put your rights at risk, we will notify the CNIL within 72 hours and inform you without undue delay, as GDPR art. 33–34 require. To report a security issue, write to privacy@veriso.art.
10. Children
Veriso is not intended for children. You must be at least 13 years old to use Veriso. In France you must be at least 15 to create an account on your own (French Data Protection Act, art. 45), and in other EU countries the minimum age set by local law (up to 16); below that age, a parent or guardian must consent on your behalf.
By creating an account you confirm that you meet these age requirements. We do not knowingly collect data from children below them. If you believe a child has given us personal data, contact privacy@veriso.art and we will delete it.
11. Contact us about privacy
Email: privacy@veriso.art. We reply within 30 days at the latest.
Post: Sharon Chicheportiche (Veriso), Khaviva reik 1, Ramat Gan 5252510, Israel, VAT 328971585.
12. Complaints to the CNIL
If you think we have not handled your data correctly, you can lodge a complaint with the French data protection authority, even without contacting us first (though we would like the chance to fix it):
- Commission Nationale de l'Informatique et des Libertés (CNIL)
- Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Phone: +33 1 53 73 22 22
- Website: https://www.cnil.fr — online complaint form: https://www.cnil.fr/fr/plaintes
If you live in another EU or EEA country, you can also complain to your local supervisory authority.
13. Changes to this policy
We update this policy when our services, providers or legal obligations change. The "Last updated" date at the top shows the current version.
For a material change — a new category of data, a new purpose, or a new type of recipient — we will notify signed-in users by email and/or in the app at least 30 days before it takes effect. Where a change requires your consent under the GDPR, we will ask for it and not apply the change to you until you give it. Previous versions are available on request.