Privacy Policy
Last updated: 2026-09-24
Summary of Key Points
This Privacy Notice applies to Nicat Əsgərzadə Akif oğlu (doing business as Veridian) ("we," "us," or "our"). It describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you visit our website at https://veridianly.com, download and use our mobile application Veridian, or engage with us in other related ways.
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@veridianly.com.
1. What Information Do We Collect?
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Personal information you disclose to us
The personal information we collect includes the following categories:
- Names
- Email addresses
- Usernames
- Password (hashed)
- Financial account information (bank or provider names, account types, balances, credit limits and payment days, loan and interest details)
- Transaction data (amounts, currency, dates, notes, labels)
- Account reference label (an optional label of up to 8 characters that you can add to an account to tell your accounts apart, for example "4821" or "Work". It is too short to hold a full card number or IBAN. Please don't enter a full account number, a card security code or a PIN. We do not collect payment cards, and we never use this label to charge you or to access your accounts)
- User-generated content (notes, categories, beneficiary names)
- Device information (mobile identifiers for session management)
- Usage / analytics data (GA4 on website)
- Crash and diagnostic data (error messages and stack traces, the app screen or data request that failed, your device model and operating system version, the app version, and a random identifier our error-monitoring provider generates for your installation of the app)
Device and mobile permissions
We may request access to certain features of your mobile device, including:
- Geolocation Information — Our mobile application may request location permission for potential future features. We do not currently collect or process location data. See "14. Location Permission" below. You may grant or revoke this permission in your device's settings.
- Mobile Device Access — We may request access to your device's camera and photo library so you can attach receipt images to transactions. See "15. Camera/Photos" below. You may grant or revoke this permission in your device's settings.
- Mobile Device Data — We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, and hardware model.
Information automatically collected
Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information.
- Log and Usage Data — Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings, and information about your activity in the Services.
- Device Data — We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, and more.
Google API
Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
2. How Do We Process Your Information?
We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process your personal information for the following purposes:
- To facilitate account creation and authentication and otherwise manage user accounts.
- To deliver and facilitate delivery of services to the user.
- To respond to user inquiries/offer support to users.
- To send administrative information to you, including details about our products and services, changes to our terms and policies.
- To protect our Services as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
- To identify usage trends so we can improve the Services.
- To save or protect an individual's vital interest when necessary, such as to prevent harm.
3. What Legal Bases Do We Rely On to Process Your Information?
We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
If you are located in the EU or UK, the legal bases we rely on include: Consent, Performance of a Contract, Legitimate Interests, and Legal Obligations. If you are located in Canada, we may process your information if you have given us specific permission (express consent) or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.
- Consent — We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
- Performance of a Contract — We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you.
- Legitimate Interests — We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms.
- Legal Obligations — We may process your information where we believe it is necessary for compliance with our legal obligations.
- Vital Interests — We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party.
4. When and With Whom Do We Share Your Personal Information?
We may share information in specific situations described in this section and/or with the following third parties. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We have contracts with our third-party service providers. The third parties we may share personal information with include:
- Cloud Computing Services (e.g., DigitalOcean)
- Transactional Email Delivery (e.g., Brevo, operated by Sendinblue SAS)
- Functionality and Infrastructure Optimization (e.g., Open Exchange Rates)
- User Account Registration and Authentication (e.g., Google Sign-In)
- Web and Mobile Analytics (e.g., Google Analytics)
- Application Performance Monitoring and Server Logs (e.g., Grafana Cloud, operated by Raintank, Inc. d/b/a Grafana Labs)
- Crash and Error Monitoring (e.g., Sentry, operated by Functional Software, Inc. d/b/a Sentry)
- Business Transfers — We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Crash and Error Monitoring (Sentry)
Our mobile app uses Sentry, operated by Functional Software, Inc. d/b/a Sentry, to record technical error and crash reports so that we can find and fix faults in the app. Sentry acts as our service provider and processes this data only to provide that service to us, under a data processing agreement.
Reports are only sent from the published production version of the app — never from development or test builds — and only for a sampled share of errors, not for every error. Each report contains the error message and stack trace, which screen or data request failed, your device model and operating system version, the app version, and a random identifier that Sentry generates for your installation of the app. That identifier is specific to your installation of the app, is not connected to your Veridian account, name, or email address, and is replaced if you reinstall the app.
We have configured Sentry so that it does not receive your name, email address, IP address, account or transaction contents, screenshots, screen recordings, or the text shown on your screen. This describes Sentry's crash and error reporting only. It does not describe our other providers — in particular, the performance monitoring our own servers carry out does receive your IP address, as described under "Application Performance Monitoring and Server Logs (Grafana Cloud)" below. Before a report is sent we also remove identifiers and exchange-rate values from the error text. Because an error message can sometimes contain text you typed yourself — a category name you created, for example — we cannot guarantee that no text you entered ever appears in a report.
Because these reports are not connected to your account, we are not able to look them up by user, and deleting your account will not locate or remove them. Sentry deletes stored error events automatically after 30 days under our plan's standard retention period.
Sentry's own privacy notice is available at https://sentry.io/privacy/.
Application Performance Monitoring and Server Logs (Grafana Cloud)
Our servers use Grafana Cloud, operated by Raintank, Inc. d/b/a Grafana Labs, to record technical performance records, called traces, and to store our servers' technical logs, so that we can measure how quickly our service responds and find faults. Grafana Labs acts as our service provider and processes this data only to provide that service to us, under a data processing agreement.
A trace is created by our own servers when your device makes a request to them, not by the app on your device, and only for a sampled share of requests rather than for every request. Each trace records which request was made (the method and the address path — for example "GET /api/v1/accounts"), how long it took, whether it succeeded, the browser or app identification string your device sends, and the IP address your device connected from. Your IP address is collected and sent to Grafana Cloud as part of these records.
Traces do not contain your name, email address, account balances, transaction amounts, the notes, categories or other text you type, or the contents of any request or response. An address path can include the identifier of a record you were working with, but those identifiers are randomly generated values that mean nothing outside our own database. The query string part of a web address is never recorded.
Our servers also send their technical logs to Grafana Cloud so that we can find and fix faults. A log line is written when your device makes a request to our servers and while our servers handle it. It records when the request was made, which request it was (the method and the address path, as for traces), whether it succeeded, how long it took and the IP address your device connected from. When you are signed in, it also records the random ID of your account and of your current sign-in session, so that we can follow a request through our systems. Logs do not contain your name, email address, password, account balances or transaction amounts, and we do not log the contents of requests or responses. As with traces, the query string part of a web address is not recorded.
Log lines written before the date shown at the top of this notice may also include the email address used to register, sign in, or request a verification or password-reset email. Those older log lines are deleted automatically within 14 days of that date.
Grafana Labs stores this data in the European Union and deletes stored traces and logs automatically after 14 days under our plan's retention period. Traces are not connected to your account, so we are not able to look them up by user. Log lines are linked to your account's random ID, but not to your name or email address. We do not edit or delete individual traces or log lines: deleting your account does not remove them sooner, and they are deleted on the 14-day schedule above. Once your account is deleted, the account ID in older log lines no longer matches any account.
Grafana Labs' own privacy notice is available at https://grafana.com/legal/privacy-policy/.
Transactional Email (Brevo)
We use Brevo, operated by Sendinblue SAS, to send the emails our service needs, such as verifying your email address and resetting your password. We never use it for marketing. Brevo receives your email address, your first name and the content of the email, and acts as our service provider under a data processing agreement.
Brevo keeps a record of each email it sends (the recipient address, subject and delivery status) and a preview of the email for one month, then deletes it automatically. We do not create a contact list or marketing profile for you at Brevo.
Brevo's own privacy notice is available at https://www.brevo.com/legal/privacypolicy/.
5. Do We Use Cookies and Other Tracking Technologies?
We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.
Google Analytics
We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.
6. How Do We Handle Your Social Logins?
Our Services offer you the ability to register and log in using your Google account (Google Sign-In). Where you choose to do this, Google shares a limited set of profile information with us — specifically your name and email address. We do not receive a friends list, profile picture, or other social-graph data, and we do not support Facebook or other social logins.
We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider.
7. Is Your Information Transferred Internationally?
Our servers are located in the Netherlands. If you are accessing our Services from outside the Netherlands, please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information.
If you are a resident in the EEA, UK, or Switzerland, we will not transfer your personal information to countries that are not deemed to provide adequate protection for personal data without appropriate safeguards in place.
Our error-monitoring provider, Sentry, processes crash and diagnostic data in the European Union. Where this involves a transfer of personal data out of the EEA or the UK, that transfer is governed by the Standard Contractual Clauses incorporated into our data processing agreement with Sentry.
Our performance-monitoring and logging provider, Grafana Labs, processes trace and log data, including IP addresses, in the European Union. Where this involves a transfer of personal data out of the EEA or the UK, that transfer is governed by the Standard Contractual Clauses incorporated into our data processing agreement with Grafana Labs.
8. How Long Do We Keep Your Information?
We keep your personal information only for as long as you have an account with us. When you delete your account in the app, you are signed out immediately and your name, email address and sign-in details are erased at once. Everything else is deleted automatically, usually within a few minutes and never later than 30 days after your request. If you ask us to delete your account by email, we delete it within 30 days of receiving your request, or of your confirmation if we are still waiting for it. See our Account Deletion page for details.
After your account is deleted we keep a small record of the deletion for 12 months, so that we can show that we carried out your request and answer any question or complaint about it. We rely on our legitimate interest in being able to demonstrate that we comply with data protection law. If you deleted your account in the app, the record contains the date of the request, the date deletion finished, whether it was confirmed with a password or through Google sign-in, and a one-way hash of the email address. It does not contain your name, your email address, your account ID or any of your financial data, and the hash cannot be converted back into an email address. Because the same email address always produces the same hash, we can use it to check whether a deletion was requested for an address someone gives us. If you asked us by email, the record is instead our email exchange with you about the request, together with a note of the dates we received, verified and completed it. Either record is deleted 12 months after the request.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible, then we will securely store your personal information and isolate it from any further processing until deletion is possible.
Some technical records are held by our service providers and are deleted automatically on their own schedules. Deleting your account does not remove them sooner: crash and error reports (30 days), performance traces (14 days) and server logs (14 days), described in section 4; and the records our email provider keeps of each email we send you (one month from sending), also described in section 4.
9. How Do We Keep Your Information Safe?
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information.
Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
10. Do We Collect Information From Minors?
We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Services.
If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@veridianly.com.
11. What Are Your Privacy Rights?
Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws, including the right to request access, correction, or deletion of your personal information, as well as the right to withdraw consent where we are relying on your consent to process your information.
If you would at any time like to review or change the information in your account, you can do so in the app or contact us. You can delete your account yourself in the app at any time, or ask us to delete it by email, as described below, in section 8 and on our Account Deletion page.
We will respond to requests to access, correct, port, or delete your personal information within one month of receiving the request, as required under applicable data protection law. If your request is complex or we receive a number of requests, we may extend this period and will tell you if we do.
To get a copy of the personal information we hold about you, email privacy@veridianly.com from the address linked to your account. We will send it to you free of charge in a commonly used, machine-readable format within one month.
Account Information
To review or change the information in your account or to terminate your account, you can:
- Log in to your account settings and update your user account.
- Contact us using the contact information provided.
- In-app: open Settings, scroll to the bottom and tap 'Delete account'. See our Account Deletion page for step-by-step instructions.
- By email: email privacy@veridianly.com from the address linked to your account, with 'Account Deletion Request' in the subject line. We will ask you to confirm from that address, then delete your account within 30 days of receiving your request.
12. Controls for Do-Not-Track Features
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If you are in the EEA, the UK, or another region with cookie-consent requirements, the primary way to control non-essential tracking on our website is the cookie consent banner described in our Cookie Policy, not the DNT signal.
13. Do United States Residents Have Specific Privacy Rights?
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information.
Categories of Personal Information We Collect
The table below shows the categories of personal information we have collected in the past twelve (12) months. We only collect personal information from you for the following purposes: facilitating the delivery of our Services; receiving help through our customer support channels; and responding to your inquiries.
Sources of Personal Information
We collect personal information from the following sources: directly from you when you provide it, automatically as you use the Services, and from third-party service providers (e.g., Google Sign-In).
Your Rights
You have rights under certain US state data protection laws. These rights include:
We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. We have not sold or shared personal information in this way in the preceding twelve (12) months.
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects
How to Exercise Your Rights
To exercise these rights, you can contact us by emailing us at privacy@veridianly.com. Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf.
California Shine The Light Law
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, account name, and an app-installation identifier generated by our error-monitoring provider | YES |
| B. Personal information as defined in the California Customer Records statute | Name, contact information, education, employment, employment history, and financial information | YES |
| C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | NO |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other similar network activity | Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements | YES |
| G. Geolocation data | Device location (permission declared in app manifest; not currently collected or processed) | NO |
| H. Audio, electronic, sensory, or similar information | Images and audio, video or call recordings created in connection with our business activities | NO |
| I. Professional or employment-related information | Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | NO |
| J. Education Information | Student records and directory information | NO |
| K. Inferences drawn from collected personal information | Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual's preferences and characteristics | NO |
| L. Sensitive personal Information | Account login information and financial information including account access details | YES |
14. Location Permission
Our mobile application requests access to your device's location. We request this permission but currently do not collect or process location data. This permission may be used in future features.
15. Camera/Photos
Our mobile application may request access to your device's camera and photo library for attaching receipt images to transactions.
16. Do We Make Updates to This Notice?
Yes, we will update this notice as necessary to stay compliant with relevant laws. We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
17. How Can You Contact Us About This Notice?
If you have questions or comments about this notice, you may email us at privacy@veridianly.com or contact us by post at:
Nicat Əsgərzadə Akif oğlu 44 Jafar Jabbarli street Baku, Yasamal AZ 1065 Azerbaijan
18. How Can You Review, Update, or Delete the Data We Collect From You?
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information.
To request to review, update, or get a copy of your personal information, please email us at privacy@veridianly.com. To delete your account, use the in-app option (Settings → Delete account), or email us from the address linked to your account as described on our Account Deletion page.