Privacy.
This policy describes how personal data is processed when you visit verka.io, sign up through the website or use the Verka service. Processing complies with the EU General Data Protection Regulation (GDPR).
1. Data controller
MS Communication AB, corporate identity number 559589-1648, Gothenburg, Sweden, provides the Verka service and is the data controller for the processing described here ("Verka", "we").
Questions about personal data can be sent to hello@verka.io.
2. Two roles
Data controller. For data about website visitors, people who sign up and users of the service, for example account details, billing and security logs.
Data processor. When a customer connects its marketing accounts and we process personal data on the customer's behalf. That processing is governed by a data processing agreement with the customer, available on request.
This policy primarily covers our role as data controller.
3. Data we process
Visitors and sign-ups
- Email address, company name and role when you sign up through the website
- IP address, to prevent abuse of the sign-up form
- Browser, device and operating system, logged automatically by our infrastructure
The AI and SEO analysis
- Your site's address, your email address and your first name when you order the analysis
- The analysis itself, built only on public information: your site and search data
- IP address in hashed form, to prevent abuse of the form, for at most one day
Customers and users
- Name, email address and login credentials
- Company details, tone of voice, target audience and goals
- Content and settings in the service
- Data from the accounts the customer connects, for example Google Ads, Google Search Console, Google Analytics and Meta
- Which proposals the user approves, edits and dismisses
- Support requests and logs of service usage
- Billing details
4. Purposes and legal basis
- Delivering the service and managing the customer relationship, including tailoring proposals to what the customer has previously approved and dismissed. Basis: contract.
- Responding to sign-ups and contacting you about getting started. Basis: legitimate interest.
- Security, troubleshooting and abuse prevention. Basis: legitimate interest.
- Billing and accounting. Basis: legal obligation.
- Website analytics, ad measurement on the website and marketing emails. Basis: consent.
5. AI processing
Proposals in the service are produced with AI models from Anthropic in the United States. The model receives the material a proposal requires, for example metrics, page content, brand voice and goals. Under Anthropic's commercial terms, data sent through their API is not used to train models.
The processing does not involve automated decision-making that produces legal effects concerning you or similarly significantly affects you.
6. Sub-processors and recipients
We use the following sub-processors:
- Supabase: database and authentication.
- Cloudflare: hosting, networking and caching on a global network. The service's background jobs, which fetch and analyse the data, run in data centres within the EU.
- Anthropic: AI models. United States.
- Resend: email from the service. United States.
- DataForSEO: search data. Receives domains and keywords, normally no personal data.
- Google Analytics: visitor statistics on verka.io, only after your consent. United States.
If you consent to marketing cookies on verka.io, the Meta Pixel and Google's ad measurement collect data about your visit. Meta Platforms Ireland Ltd and Google are then each responsible for the data they receive, and Verka is jointly responsible with Meta for the collection on the website.
Google, Meta and LinkedIn are not our sub-processors. The customer has its own agreements with them, and they are responsible for the data in the customer's accounts. We read from and write to those accounts with the customer's consent.
How we share Google user data. Data Verka accesses from Google APIs, meaning the customer's Google Ads, Google Search Console and Google Analytics data, obtained only after the customer has authorised access via OAuth, is shared, transferred or disclosed solely to the following providers, and only to operate the features the customer uses:
- Supabase: stored in our database on the customer's behalf
- Cloudflare: processed in our hosting infrastructure
- Anthropic (US): analysed by AI models to produce the proposals and analyses the customer sees in the service, and not used to train models
We do not share, transfer or disclose Google user data to any other third party, we do not use it for advertising, we do not sell it and we do not use it to train AI models.
Google API Services compliance. Verka's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Transfers outside the EU/EEA
Anthropic, Resend, Google and Meta process data in the United States. Cloudflare runs the service's background jobs within the EU, but requests from your browser pass through the data centre nearest to you, and Cloudflare's network and caching may process data outside the EU/EEA. Transfers rely on the European Commission's standard contractual clauses, or on the recipient's certification under the EU-US Data Privacy Framework where available.
8. Cookies
The website (verka.io)
We use two kinds of cookies on the website, and you choose each one separately in the cookie banner. Analytics: Google Analytics (GA4) measures traffic on the website. Marketing: the Meta Pixel and Google's ad measurement show which ads lead to visits and sign-ups, and let Meta and Google show our ads to people who have visited the website. Nothing is loaded until you have consented. You can change or withdraw your consent at any time under Cookie preferences in the footer.
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
| _ga | Stores a unique visitor ID to distinguish users | 2 years | Google LLC (US) |
| _ga_* | Stores and counts page views and session state | 2 years | Google LLC (US) |
| _fbp | Marketing: distinguishes visitors so Meta can measure ads | 90 days | Meta Platforms (US) |
| _fbc | Marketing: links a click on a Meta ad to a sign-up | 90 days | Meta Platforms (US) |
| _gcl_aw | Marketing: links a click on a Google ad to a sign-up | 90 days | Google LLC (US) |
The service (app.verka.io)
The service uses cookies required for it to function, for example to keep you signed in and to protect against abuse.
9. Retention
- Sign-ups through the website: 12 months after sign-up if no customer relationship arises
- Hashed IP addresses from the sign-up form: for as long as the sign-up is kept
- The AI and SEO analysis: 90 days after the order, then the analysis, the address and the name are deleted
- Account and customer data: during the agreement and 30 days thereafter
- Billing and accounting records: seven years under the Swedish Bookkeeping Act
- Support requests: up to 24 months
- Logs and security data: normally 30 to 90 days
- Consents: until you withdraw them
10. Security
We take appropriate technical and organisational measures to protect personal data, in accordance with Article 32 of the GDPR. In the event of a personal data breach, we make the notifications and communications required by law.
11. Your rights
You have the right to know what data we hold about you, to have inaccurate data corrected, to have data erased, to have processing restricted, to object to processing based on legitimate interest, to receive your data in a machine-readable format and to withdraw consent.
Contact hello@verka.io to exercise your rights. You can also lodge a complaint with the Swedish Authority for Privacy Protection (imy.se).
12. Deleting data from connected platforms
If you have connected an account from Google, Meta, LinkedIn or another platform and want the data deleted, email hello@verka.io with the subject line "Data deletion request". Include the email address you used for the connection, which platforms it concerns and whether all data should be deleted or only data from a specific account.
We handle the request within the time limits set by the GDPR.
13. Changes
We may update this policy. The date at the top shows when it was last updated.