Effective Date: April 2026
This notice describes how Veritas Orion (“we†or “Veritasâ€) handles personal data in connection with the Veritas Orion platform (“Veritas Orion†or the “Platformâ€), a paid, web-delivered research product that we run on our own managed infrastructure.
1. Scope
This notice applies to anyone who visits, registers for, or uses Veritas Orion. It covers personal data processed when a visitor browses the marketing surface, when a subscriber signs in, and when a subscriber uses any feature of the Platform. It does not cover sites, products, or communications that link out of Veritas Orion — those are governed by the privacy terms of the destination.
2. Our Role
Veritas is the party responsible for deciding why and how personal data is processed in connection with the Platform. We procure, configure, and maintain the servers, databases, and dependencies that make Veritas Orion work. A subscriber interacts with the Platform only through a browser — no part of the Platform is installed, replicated, or administered on a subscriber's side.
3. Categories of Personal Data
Depending on how a person uses the Platform, we may process:
- Identity and contact details such as full name, email address, and telephone number
- Authentication material such as hashed passwords, multi-factor tokens, and session identifiers
- Commercial data such as subscription tier, purchase history, invoices, and tax identifiers (payment card details are handled by our payment partners, not stored on our servers)
- Usage signals such as pages visited, features exercised, allocation inputs, and interaction timestamps
- Device telemetry such as IP address, user-agent string, approximate geography inferred from IP, device type, and browser identifiers
- Communication content when a person writes to support, submits feedback, or triggers a notification
- Messaging preferences including opt-in status for SMS and email alerts
Broker credentials are never received by Veritas. Where a subscriber chooses to link a brokerage account for downstream workflows, authentication occurs directly at the broker's login surface.
4. Where Personal Data Comes From
Most data is supplied by the subscriber at sign-up or while using the Platform. We also generate technical signals (such as device telemetry, session logs, and error traces) as the Platform runs. In a limited set of cases we receive supplementary data from integrated partners — for example, transaction confirmations from a payment processor or a delivery receipt from a messaging carrier.
5. How We Use Personal Data
Personal data is used to:
- authenticate subscribers and run subscription entitlements
- deliver the research outputs, dashboards, and notifications that a subscriber has requested
- send operational messages (password resets, billing events, security alerts)
- invoice, collect payment, and administer renewals
- investigate misuse, protect the Platform and its users, and investigate suspected fraud
- analyse how the Platform is used in aggregate so that we can improve it
- meet obligations under applicable law, regulation, or an enforceable order
6. Legal Bases
Where a legal basis is required (for example, under the GDPR or similar regimes), we rely on one or more of the following:
- performance of the subscription agreement between a subscriber and Veritas
- our legitimate interest in running, securing, and improving a commercial platform
- compliance with a legal obligation
- consent, where explicitly requested — for example, for optional SMS alerts or certain cookies
7. Recipients
Personal data may be disclosed to the following categories of recipient, only for the purposes above and only to the extent necessary:
- Infrastructure and hosting vendors that supply compute, storage, networking, and content delivery
- Payment and billing partners that process subscription transactions
- Communication carriers such as Twilio for SMS delivery and our email transport provider
- Market-data and brokerage integrators that supply reference data or enable account linking
- Security, monitoring, and analytics vendors engaged to help us operate and harden the Platform
- Legal, accounting, and insurance advisors when their services reasonably require access
- Authorities and courts when disclosure is compelled by law or necessary to enforce our rights
- A successor entity in the event of a reorganization, merger, asset transfer, or insolvency event
Veritas does not sell personal data, does not trade it for consideration, and does not disclose it for third-party marketing.
8. International Data Flows
Veritas Orion is hosted on infrastructure that spans multiple jurisdictions. Personal data may be processed in countries other than the country of residence of a subscriber, including jurisdictions whose data-protection frameworks differ from those of the European Economic Area, the United Kingdom, or the subscriber's home country. Where transfers require additional safeguards, Veritas relies on the protection mechanisms recognised under the relevant laws.
9. Retention
Retention periods are driven by the purpose of processing. As a general rule:
- active account data is retained while the subscription is live and for a reasonable wind-down period after cancellation
- billing and tax records are retained for the period required by applicable finance and tax laws
- security, audit, and abuse-detection logs are retained for the shorter of their usefulness and any mandated period
- support correspondence is retained long enough to follow up and document the exchange
When retention is no longer required, data is deleted, anonymised, or de-identified.
10. Safeguards
Veritas maintains organisational and technical safeguards commensurate with the sensitivity of the data and the risks of the Platform, including access controls, logging, encryption in transit, encryption at rest for sensitive stores, and a documented incident-response process. No safeguard provides absolute assurance against misuse or breach.
11. Cookies and Similar Technologies
Veritas Orion uses cookies and related technologies to keep subscribers signed in, remember preferences, measure how the Platform is used, and protect against abuse. A subscriber can control cookies through browser settings, although some categories are necessary for the Platform to function.
12. Automated Decision-Making
The Platform produces model-driven research outputs. It does not make legally binding or similarly significant automated decisions about a subscriber within the meaning of applicable data-protection law. A subscriber remains responsible for any decision taken on the basis of a research output.
13. Rights Available to Individuals
Depending on the applicable law, a person may have the right to:
- ask what data Veritas holds about them and obtain a copy
- have inaccurate data corrected
- have data erased, subject to legal and contractual overrides
- restrict or object to certain processing
- receive data in a portable format
- withdraw consent where processing is based on consent
- lodge a complaint with the competent data-protection authority
Requests may be directed to the contact channel in section 16. Veritas may take reasonable steps to verify identity before acting on a request.
14. Minors
Veritas Orion is designed for adults. It is not offered to, and may not be used by, anyone under 18. If Veritas learns that data has been collected from a minor, the account and related data are deleted.
15. Revisions
This notice may be revised as the Platform and the applicable legal landscape evolve. When a revision materially changes the way personal data is handled, Veritas will communicate the update through the Platform, by email, or both, before the revision takes effect.
16. How to Reach Us
Privacy requests and questions: support@veritasorion.com