Privacy
This notice explains how we process personal data when you visit veft.ai, request a demo, or write to us — including how we measure traffic without cookies — and how the product differs from the website.
Controller
The controller for this website is Autarky Innovation LLC, a limited liability company organised under the laws of New Mexico, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States (“Veft”, “we”). For all privacy matters, write to privacy@veft.ai.
The website and the product are different
This notice covers the website at veft.ai. Inside the Veft product, the roles are different: there, your search firm is the controller of its candidate and client data, and Veft processes those data only on the firm's documented instructions, as a processor under a data processing agreement (Article 28 GDPR). If you are a candidate and have questions about data a search firm holds about you, please contact that firm directly; we support our customers in answering such requests. The data processing agreement and the list of sub-processors are described at /dpa.
Data we process on this website
Server logs. When you visit the site, our hosting provider records the data your browser transmits: IP address, date and time, requested page, referrer URL, and browser and operating system information. We use these logs to deliver the site, to secure it against abuse, and to diagnose faults. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure, reliable website. Logs are deleted or anonymised within [30] days. Demo bookings. The booking calendar at /demo is provided by Google (Google Calendar appointment scheduling) and loads only after you choose to open it. When you load the calendar, your browser connects to Google's servers, and Google processes your IP address and technical data under its own privacy policy. If you book, we receive the name, email address, and appointment time you enter, and we use them to prepare, hold, and follow up on the demo. You are not obliged to provide these data; without them, however, we cannot schedule or hold a demo. Legal basis: Article 6(1)(b) GDPR — steps prior to entering into a contract, taken at your request — and Article 6(1)(f), our legitimate interest in responding to business enquiries. Email and contact form. If you write to us, or use the contact form at /contact, we process your name, email address, and the content of your message in order to answer it. Legal basis: Article 6(1)(b) GDPR where your message concerns a contract or pre-contractual steps, otherwise Article 6(1)(f) — our legitimate interest in handling business correspondence. Our email runs on Google Workspace; the contact form is delivered by Resend to that mailbox. If you reached the site through a campaign link, we attach the campaign parameters described below to your message, so we know which channel prompted your enquiry. Reach measurement. We measure the use of this site with BrandKarma, our own analytics service, which we operate ourselves on our own infrastructure — no third-party analytics provider receives your data. For each page view, and for a small number of interactions — such as choosing to request a demo or clicking a contact link — your browser sends a short signal to our servers, and we record: the page address and the referring page; your browser, operating system, and device type; an approximate location derived from your IP address (country, region, city, and the approximate coordinates of that place — not your precise position); any campaign parameters carried by the link you arrived through (see below); and the date and time. Your IP address is not stored — it is used at the moment of the request to look up the approximate location and to group requests into a visit, and it is discarded before the record is saved. To group requests, we compute a one-way value from your IP address and browser identification together with a secret ingredient that changes every day and is never saved; that value is stored with the day's records to count unique visits, it cannot be reversed to reveal your IP address, and because the ingredient changes daily, visits on different days can be linked neither to one another nor to you. This measurement stores nothing on your device and reads nothing from it — no cookies, no local storage — so it requires no consent under § 25 TDDDG. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in understanding how the site is used. You may object at any time; see “Your right to object”. Campaign measurement. When you reach the site from an advertisement, a newsletter, or a social post, the link may carry campaign parameters — utm_source, utm_campaign, and similar — or a click identifier such as gclid or li_fat_id. We read these from the address of the page you land on and store them with the page view to learn which channels bring visits. In your browser they are held only in the memory of the current page — never written to cookies or any other storage — and closing the tab erases them. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in measuring the effectiveness of our marketing.
Cookies — and what we do not do
The site may set a single cookie, NEXT_LOCALE, when the language you choose differs from your browser's preference — for instance after you switch languages. It stores that choice for the duration of your browser session, is strictly necessary to provide the language version you asked for, and requires no consent (§ 25(2) no. 2 TDDDG). Insofar as personal data are processed in this context, the legal basis is Article 6(1)(f) GDPR — our legitimate interest in serving the site in the language you selected. The booking calendar on /demo is the only third-party embed on this site. It loads only after you activate it on that page; once you do, Google may store or read information, including cookies, on your device to provide the booking function you requested (§ 25(2) no. 2 TDDDG). Google's own cookies are governed by Google's policies. We set no tracking cookies, no advertising cookies, and no social-media pixels or plugins, we load no third-party fonts, and no third-party analytics provider receives your data. Our own traffic measurement — described under “Data we process on this website” — works without cookies and stores nothing on your device and reads nothing from it. That is why this site shows no consent banner.
Recipients
We use a small set of processors, each bound by a data processing agreement: Vercel Inc. (website hosting and server logs, USA), Google LLC (email via Google Workspace and demo scheduling, USA), and Resend, Inc. (delivery of contact-form messages, USA). Google acts as our processor for mail and booking data; for the technical data processed when you load the booking calendar in your browser, Google acts under its own responsibility, as described above. Traffic measurement runs on BrandKarma, our own analytics service, operated by Autarky Innovation LLC on our own infrastructure; measurement data therefore stays with us, and no third-party analytics provider receives it. We do not sell personal data and we do not share it for advertising. Journal content, including images, is retrieved from our editorial system by our servers and delivered to you from our own domain; no visitor data is sent to the editorial system.
International transfers
We are established in the United States, so data you send us is processed there. The GDPR nonetheless continues to apply to our processing under Article 3(2) GDPR, and this notice reflects that. Our processors handling personal data in the United States — Vercel Inc., Google LLC, and Resend, Inc. — are certified under the EU-US Data Privacy Framework, including its UK Extension, and under the Swiss-US Data Privacy Framework; the European Commission's adequacy decision for that framework covers these disclosures, and you can verify both certifications in the list at dataprivacyframework.gov. Beyond the recipients named in this notice, we do not disclose personal data to recipients in third countries.
Retention
We keep personal data only as long as its purpose requires: server logs for up to [30] days; demo and email correspondence for as long as our exchange is active and at most [12] months after the last contact, unless a contract follows or a statutory obligation requires longer retention. Analytics records contain no IP address and no identifier we could link back to you; we keep them for statistical purposes.
Your rights
You have the right of access to the personal data we hold about you (Article 15 GDPR), and the rights to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), and data portability (Article 20). Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Article 7(3)). To exercise any of these rights, write to privacy@veft.ai.
Your right to object
Where we process personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Article 21(1) GDPR). We will then stop processing those data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. This includes the cookieless reach and campaign measurement described above. Because those records carry no identifier we could link back to you, we are generally unable to single out your past page views (Article 11 GDPR); we will act on your objection wherever we can. To object, write to privacy@veft.ai.
Complaints
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of an alleged infringement (Article 77 GDPR). If you are in the United Kingdom, you may complain to the Information Commissioner's Office.
No automated decision-making
We do not use automated decision-making or profiling within the meaning of Article 22 GDPR on this website.
Changes to this notice
We will update this notice when our processing changes; the version published on this page applies. Effective: 13 August 2026.