Privacy notice
What personal data overunity.ai holds, why, and for how long. No special-category data, no raw IP addresses, and no advertising or analytics cookies.
Last updated 2026-07-30
Who is responsible for your data
The controller is Verity AI, based in the United Kingdom.
Registered address: Verity AI Ltd (company number 16116354), 23 Plantagenet Drive, Rugby, England, CV22 6LB. Email: sotiris@verityai.co.
The UK GDPR and the Data Protection Act 2018 govern how we handle personal data.
What we hold, and why
This table lists every category of personal data the platform holds. It is the complete list.
| Data | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Account: email, password hash, account role, verification timestamp | You, at sign-up | To operate your account | Performance of a contract |
| Practitioner profile: display name, headline, country and city, engagement types, seniority, availability, day and hourly rate, years of experience, biography | The practitioner enters it | To list the practitioner on the bench and match them to roles | Performance of a contract |
| Vetting evidence: kind, description, optional URL, verification status and dates | The practitioner supplies it; an admin verifies it | To substantiate competence claims | Performance of a contract |
| Roles: title, brief, engagement type, seniority, budget range, start, duration, location, remote policy | The hirer enters it | To match and introduce | Performance of a contract |
| Matches: fit score, the named signals behind it, confidence | Computed by the platform | To shortlist | Performance of a contract |
| Introductions: status, timestamps, a note from the hirer | The hirer requests it | To make and track the introduction | Performance of a contract |
| Contact messages: optional name, optional email, the message, the originating page | The public contact form | To answer the enquiry | Legitimate interests |
| Admin audit: action, outcome, a salted hash of the IP address, the affected record | Recorded automatically | Security | Legitimate interests |
| Rate-limit counters, keyed by a bucket string containing a salted IP hash | Recorded automatically | Abuse prevention | Legitimate interests |
| DSAR log: what was requested, the requester email, dates, what was done | A data subject request | To evidence compliance | Legal obligation |
Lawful bases in plain terms
A practitioner's profile is published at their own request, under their contract with us. Running accounts and providing the service rest on the same basis.
Legitimate interests means we have a genuine, limited reason that does not override your rights. For contact messages it is answering you. For audit and rate-limit records it is keeping the service secure.
Nothing on the site is processed on the basis of consent.
What we never collect
We do not collect or store special-category data. We go further than that. We hold no nationality, no date of birth, no right-to-work status, no health data, no ethnicity, no religion, no sexual orientation, no trade-union membership and no biometric data.
Please do not send us information of that kind, for example in a biography or a contact message.
We never store a raw IP address. Security and abuse-prevention records store only salted hashes of IP addresses. A salted hash cannot be turned back into the original address.
Cookies
The site sets one cookie: a strictly necessary session cookie for signed-in users. It keeps you signed in. Nothing more.
There are no advertising cookies and no analytics cookies.
UK cookie law does not require consent for strictly necessary cookies. That is why there is no cookie banner on this site. None is required.
The Assay tool runs in your browser
Assay is a free tool on the site. It runs entirely in your browser.
The job text you paste into Assay is never transmitted to us. We do not see it, store it or process it.
Assay has an optional AI drafting feature. If you choose to use it with your own API key, your browser talks to that provider directly. We are neither the controller nor the processor of that content.
How long we keep data
| Data | Retention |
|---|---|
| Contact messages | 24 months |
| Admin audit records | 12 months |
| Rate-limit counters | 7 days |
| DSAR log | 6 years |
| Account, profile, role and introduction data | The life of the account, plus 6 months. Then deleted. |
Processors and international transfers
These processors handle data for us:
| Processor | What they do |
|---|---|
| Vercel Inc. | Hosting and serverless execution. |
| Turso / libSQL | The database. |
| GitHub, Inc. | Contact messages are mirrored to a private issue tracker, so an enquiry cannot be lost. |
| Search Console only. Aggregate search statistics, with no personal data. |
Transfers outside the United Kingdom
Some of these processors handle data outside the United Kingdom.
Those transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards.
Security
- The site is served over HTTPS only. Passwords are stored as scrypt hashes, never as passwords. No raw IP address is stored anywhere; where a caller needs identifying, a salted hash is used instead. Administrative access requires a password and a second factor from an authenticator app, and every attempt is recorded.
- Passwords are stored as hashes, never in plain text.
- IP addresses are stored only as salted hashes.
- Rate limiting and audit logging run automatically to detect abuse.
Your rights
You have the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability and the right to object.
The data rights page explains each right and how to exercise it. In short: email sotiris@verityai.co and we will respond within one month.
We do not make decisions with legal or similarly significant effect by solely automated means. Fit scores are shown to people, with their reasons, and people decide.
Complaints
You can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.
We would like the chance to resolve a problem first. Please contact us if you can.