Privacy

This notice explains how we process personal data when you visit veft.ai, request a demo, or write to us — and how the product differs from the website.

Draft — bracketed details (address, state of organisation, EU representative, telephone, responsible person for the journal) are to be completed before publication. Review by admitted counsel is pending.

Controller

The controller for this website is Autarky LLC, a limited liability company organised under the laws of [Delaware], [registered address], United States (“Veft”, “we”). For all privacy matters, write to privacy@veft.ai. [Our representative in the European Union under Article 27 GDPR: name, address, email — to be appointed before launch.]

The website and the product are different

This notice covers the website at veft.ai. Inside the Veft product, the roles are different: there, your search firm is the controller of its candidate and client data, and Veft processes those data only on the firm's documented instructions, as a processor under a data processing agreement (Article 28 GDPR). If you are a candidate and have questions about data a search firm holds about you, please contact that firm directly; we support our customers in answering such requests. The data processing agreement and the list of sub-processors are described at /dpa.

Data we process on this website

Server logs. When you visit the site, our hosting provider records the data your browser transmits: IP address, date and time, requested page, referrer URL, and browser and operating system information. We use these logs to deliver the site, to secure it against abuse, and to diagnose faults. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure, reliable website. Logs are deleted or anonymised within [30] days. Demo bookings. The booking calendar at /demo is provided by Google (Google Calendar appointment scheduling) and loads only after you choose to open it. When you load the calendar, your browser connects to Google's servers, and Google processes your IP address and technical data under its own privacy policy. If you book, we receive the name, email address, and appointment time you enter, and we use them to prepare, hold, and follow up on the demo. You are not obliged to provide these data; without them, however, we cannot schedule or hold a demo. Legal basis: Article 6(1)(b) GDPR — steps prior to entering into a contract, taken at your request — and Article 6(1)(f), our legitimate interest in responding to business enquiries. Email. If you write to us, we process your email address and the content of your message in order to answer it. Legal basis: Article 6(1)(b) GDPR where your message concerns a contract or pre-contractual steps, otherwise Article 6(1)(f) — our legitimate interest in handling business correspondence. Our email runs on Google Workspace.

Cookies — and what we do not do

The site may set a single cookie, NEXT_LOCALE, when the language you choose differs from your browser's preference — for instance after you switch languages. It stores that choice for the duration of your browser session, is strictly necessary to provide the language version you asked for, and requires no consent (§ 25(2) no. 2 TDDDG). Insofar as personal data are processed in this context, the legal basis is Article 6(1)(f) GDPR — our legitimate interest in serving the site in the language you selected. The booking calendar on /demo is the only third-party embed on this site. It loads only after you activate it on that page; once you do, Google may store or read information, including cookies, on your device to provide the booking function you requested (§ 25(2) no. 2 TDDDG). Google's own cookies are governed by Google's policies. We use no analytics, no advertising trackers, no social-media plugins, and no third-party fonts.

Recipients

We use a small set of processors, each bound by a data processing agreement: Vercel Inc. (website hosting and server logs, USA) and Google LLC (email via Google Workspace and demo scheduling, USA). Google acts as our processor for mail and booking data; for the technical data processed when you load the booking calendar in your browser, Google acts under its own responsibility, as described above. We do not sell personal data and we do not share it for advertising. Journal content, including images, is retrieved from our editorial system by our servers and delivered to you from our own domain; no visitor data is sent to the editorial system.

International transfers

We are established in the United States, so data you send us is processed there. The GDPR nonetheless continues to apply to our processing under Article 3(2) GDPR, and this notice reflects that. Our processors handling personal data in the United States — Vercel Inc. and Google LLC — are certified under the EU-US Data Privacy Framework, including its UK Extension, and under the Swiss-US Data Privacy Framework; the European Commission's adequacy decision for that framework covers these disclosures, and you can verify both certifications in the list at dataprivacyframework.gov. Beyond the recipients named in this notice, we do not disclose personal data to recipients in third countries.

Retention

We keep personal data only as long as its purpose requires: server logs for up to [30] days; demo and email correspondence for as long as our exchange is active and at most [12] months after the last contact, unless a contract follows or a statutory obligation requires longer retention.

Your rights

You have the right of access to the personal data we hold about you (Article 15 GDPR), and the rights to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), and data portability (Article 20). Where processing is based on consent, you may withdraw that consent at any time with effect for the future (Article 7(3)). To exercise any of these rights, write to privacy@veft.ai.

Your right to object

Where we process personal data on the basis of legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Article 21(1) GDPR). We will then stop processing those data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. To object, write to privacy@veft.ai.

Complaints

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of an alleged infringement (Article 77 GDPR). If you are in the United Kingdom, you may complain to the Information Commissioner's Office.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Article 22 GDPR on this website.

Changes to this notice

We will update this notice when our processing changes; the version published on this page applies. Effective: 22 July 2026.