Privacy Policy
Who we are
Verdius Inc., a Delaware corporation ("Verdius", "we", "us"), runs this website, verdius.ai, and the Verdius app at app.verdius.ai. For anything in this policy, write to [email protected].
This policy covers both. If your company has a signed agreement with us, that agreement governs where it differs from this page.
Information we collect
When you book a demo. The form collects your work email, first and last name, company name, company size and monthly ad spend. If you email us, we collect your message and email address.
When you use the app. For your account we keep your name, work email, company, role and a hashed version of your password. We never store the password itself. Each time you sign in we record the session, your IP address and your browser, and we log account events such as sign-ins, password changes and invitations to keep accounts secure.
When you connect an ad platform. We receive the data described under Connected ad platforms below.
What your browser sends. When you visit, our hosting provider records standard request data: IP address, browser and device type, the page requested, the referring page and the time. Every web server receives this in order to deliver a page and protect itself from abuse.
Analytics. We use PostHog to see how people use the website. It records the pages you view, the page you came from, what you click, your browser, device and screen size, and your IP address, which it uses to estimate your location. It also records how you move through and scroll each page, with anything you type into a form hidden. Ad click identifiers are removed from everything it records.
Cookies. The website sets one cookie, from PostHog. It holds a random ID that tells repeat visits apart and lasts 12 months, and PostHog keeps related data in your browser's local storage. The app sets one cookie, which keeps you signed in. It is needed for the app to work and is not used for tracking. You can block or delete cookies in your browser, and the website still works without them.
Ad clicks. Verdius advertises on Google. When you arrive from one of our Google ads, Google adds a click identifier to the page address. If you then book a demo, we send Google that identifier and the time of the request, so Google can count the ad as one that led to a demo request. We do not send Google your name, email, company or anything else you entered in the form. The website holds the identifier only in the open browser tab, and we keep it only until it is sent.
Connected ad platforms
When you connect Google Ads, Reddit or another supported platform, you sign in on that platform, approve access and then choose which ad accounts to share. From the platform we receive the email address or username you signed in with, and the name, ID, currency and time zone of the ad accounts you can reach. For the ad accounts you share, we receive campaign names and statuses, and daily totals for each campaign: spend, impressions, clicks, conversions and conversion value.
Verdius only reads this data. It does not create, change, pause or delete anything in your ad accounts. Some platforms, including Google Ads, offer a single permission that covers both reading and editing, so their approval screen asks for both.
The platform gives us access tokens so we can fetch this data. We store them encrypted and use them for nothing else.
We use connected data only to provide Verdius to your company, for example your forecasts, windows and performance views. We do not sell it or use it for advertising, and we do not use it to train models for anyone else.
You can disconnect a platform at any time in Settings, Connections. Disconnecting deletes its tokens and all data synced from it straight away. You can also remove Verdius from the platform's own account settings.
Google user data. Verdius's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. People at Verdius do not read your Google data unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated for internal operations.
How we use it
To reply to demo requests and arrange a demo.
To provide the app: signing you in, showing your forecasts and performance, and sending invitations, password resets and sign-in links by email.
To measure which of our Google ads lead to demo requests, as described under Ad clicks.
To see how the website is used and improve it, as described under Analytics.
To operate and secure the website and app, including detecting abuse and fixing problems.
To meet our legal obligations.
We do not sell your personal information, and we do not use what you send through the website to train models.
Legal bases
Where the EU or UK General Data Protection Regulation applies, we rely on performing our contract with you or your company, on our legitimate interest in responding to enquiries, in measuring our own advertising, in understanding how our website is used and in running and securing our services, on steps you ask us to take before entering into a contract, on your consent where you have given it, and on compliance with legal obligations.
Who we share it with
Service providers that run our services on our behalf and only on our instructions: Cloudflare, which hosts the website and app and forwards email sent to us; Amazon Web Services, which runs our servers and database in the United States; PostHog, which runs our website analytics in the United States; and Resend, which sends our emails.
Content delivery networks. Some scripts on the website load from jsDelivr and cdnjs, which receive your IP address when your browser requests them.
Google, when you book a demo after clicking one of our Google ads: the ad click identifier and the time of the request, and nothing you entered in the form.
The ad platforms you connect. To fetch your data we send each platform the access it granted us, and it sees those requests.
Authorities and advisers, where the law requires it or to protect our rights.
A buyer or successor, if Verdius is involved in a merger, acquisition or sale of assets. This policy would continue to apply to your data.
International transfers
We are based in the United States and our providers may process data in other countries. Where the law requires it, we rely on appropriate safeguards for transfers, such as the European Commission's Standard Contractual Clauses.
How long we keep it
Demo requests and emails: as long as we need them to respond to you and manage our relationship with you.
Account data: while your account is active. When your company's account closes, we delete its account data and connected ad platform data within 30 days, unless the law requires us to keep something longer.
Connected ad platform data: until you disconnect the platform or your company's account closes. Disconnecting deletes it straight away.
Sign-in and security records: up to 12 months.
Website analytics: up to 12 months.
Request data held by our hosting provider: the short period needed to run and protect our services.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent where we relied on it. We do not sell personal information, and we do not use it for remarketing or to target ads based on your activity on other sites.
To use any of these rights, write to [email protected]. We will not treat you differently for doing so. You may also complain to the data protection authority where you live.
Security
Everything you send to verdius.ai and app.verdius.ai travels over HTTPS. Passwords are stored as salted hashes, ad platform tokens are encrypted, and sign-in, invitation and reset links work once and expire. We use these and other reasonable technical and organizational measures to protect what we hold. No method of sending or storing data over the internet is fully secure, so we cannot guarantee absolute security.
Children
Verdius is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.
Links to other sites
Our website and app link to sites we do not control, such as our social profiles and the ad platforms you connect. Their privacy practices are their own.
Changes to this policy
When we change this policy we update the date at the top of this page. If a change is material, we will say so here, and we will tell account owners by email before it takes effect.