Privacy Notice

Last updated: 29 September 2026

This notice explains how Vedomia Limited collects, uses and protects your personal data when you visit vedomia.com, use our tools, contact us, or purchase one of our products.

Who we are and our role

For website visits, enquiries, bookings and purchases, the data controller is Vedomia Limited, a company registered in Ireland (company number 796586), registered office: 4 Peatlands, Broomfield, Midleton, Co. Cork, P25 D658, Ireland. You can reach us at contact@vedomia.com or 083 847 5268.

This public notice covers Vedomia’s activity as controller. If we separately agree to process an organisation’s personal data on its behalf, the roles, instructions and safeguards must be set out in the applicable service agreement and data-processing agreement before that processing begins.

What data we collect

Booking & contact forms: your name, email address, organisation name and preferred call slot when you book a demo or send us an enquiry.
Newsletter: your email address, if you choose to subscribe.
Free tools: while you edit our transparency audit, AI disclosure and process-map tools, the “I don’t understand what’s happening” page at /ask/, and the Report in numbers page at /try/leader/, your working draft stays on your device in your browser's local storage. On /try/leader/ the numbers you type, or count from your own list, are never sent to us, and “Start again” removes them. Information leaves your device only when you deliberately choose an action that needs a server: AI analysis, a private share link, a server-generated document or email, or a purchase. The relevant action explains this before you continue. When you export a free draft, its content is used to generate the file and is not kept afterwards.
Optional AI analysis of a policy you upload (process-map tool and the /ask/ page): the process-map tool can read a policy or procedure you upload, or a sentence you type, and draw the process it describes. This is optional and never automatic — you choose it, and for an uploaded file you must also confirm you understand this notice before anything is sent. When you do: the text of your document (or the sentence you typed) is sent once to Anthropic, the AI provider whose model reads it for us, and is processed on servers in the United States. Vedomia does not store the file or its text: it is read once, in memory, and never written to disk. Because the reading takes longer than a web page is allowed to wait, the finished map — the steps and the short sentences quoted from your document as evidence for them — is held briefly on our hosting provider (Netlify) until your browser collects it, including a short retry window if the connection is interrupted. It is deleted after collection and in every case within ten minutes. If the analysis is never completed, the unfinished job is deleted automatically within an hour. Neither the file nor its text is used to train any AI model. The resulting map stays in your browser like any other map. If your document contains personal data, that personal data travels with it — so please do not upload anything you are not permitted to share outside your organisation. If you would rather nothing left your device, use a ready-made template or fill the map in yourself; both routes work without this. The same applies on /ask/: the description you type, or the letter text you paste, is sent once to Anthropic in the same way, and the draft stays in your browser. One addition on /ask/ only: if you name an organisation or programme instead of uploading a document, Anthropic’s model may also search the public web and read official public pages about that organisation, so the draft can cite real timeframes and appeal routes. Those searches are about the organisation, not about you, and the pages used are listed underneath your map. Uploading or pasting a document never triggers a search.
Emailing yourself a free draft: if you choose to have your free process-map draft emailed to you, we receive your email address together with the map content needed to produce that draft. We use them to send you that one email (via Brevo) and we keep your email address, your organisation name and a short note of which tool you used, so we can recognise you if you get in touch. The map content itself is not stored after the email is sent. This is optional — the download works without it — and you are not added to our newsletter unless you tick the box to ask for it.
Purchases: if you buy a paid product (the Vedomia Workspace, €99 for 12 months for one process; or, before 24 September 2026, the AI Transparency Evidence Pack, which is no longer sold), the inputs used to set it up — for the Workspace, the content of your process map — together with your name, email and billing details, are sent to us only at that point. The map content is stored briefly and securely on our hosting provider (Netlify) solely to generate your document, which is then emailed to you (via Brevo). Payment and billing are handled by Stripe; we do not see or store your full card number.
Vedomia Workspace (customers): when an organisation buys a Workspace, we hold the email addresses of the people it invites (their sign-in identity and their role: owner, editor, viewer, or a member who only checks the numbers), the process maps and every saved version, the numbers the organisation types or counts about its process (how many cases reached each step, reasons, hours, amounts, and the answers when it looks again later), its records of changes to a step (what changed and from when, with a role label), the history of activity in the Workspace (who did what and when), the checked versions of its numbers, the read-only share copies it creates, and a record of each report download (when, by whom, which version, and which body it was sent to). Sign-in is by a one-time email link (sent via Brevo); a session cookie keeps a member signed in for 30 days. For all of this content, the organisation is the controller and Vedomia is its processor under our Data Processing Agreement; the organisation can export or delete its Workspace at any time by asking us.
Usage statistics: we run our own first-party, cookieless visit counter. It stores only daily aggregate counts — page paths, referrer domains, interface language and coarse country (a two-letter code from our host’s edge geolocation) — plus counts of how often anonymous actions happen on a page (for example, how many visitors opened a tool or clicked “Book a demo”). Our analytics code does not retain IP addresses, device details or per-visitor identifiers, and it honours the Do Not Track and Global Privacy Control browser signals. Like any web host, Netlify necessarily receives standard request and security data, including an IP address, to deliver and protect the site; that operational processing is separate from our aggregate visitor counter.

How we use your data

To respond to your enquiry or confirm a demo booking.
To generate and deliver any product you purchase, and to provide related support.
To email you a free draft from one of our tools, where you have asked us to.
To send our newsletter, where you have subscribed (you can unsubscribe at any time).
To operate, secure and improve our website and services.

We do not sell or rent your personal data, and we do not share it for third-party marketing.

Legal basis (GDPR)

Contract — to deliver a product or service you have requested or purchased.
Legitimate interests — to respond to enquiries and to keep our website secure.
Consent — where you subscribe to our newsletter; you may withdraw consent at any time.

Who we share data with (processors)

We use a small number of trusted service providers who process personal data on our behalf, under contract:

Netlify — website hosting and secure storage of purchase inputs. Privacy policy.
Stripe — payment processing and invoicing when you make a purchase. Privacy policy.
Anthropic — the AI provider that reads a policy you choose to analyse in the process-map tool, and that drafts a map on /ask/. It receives the text only for that one request and does not use it to train its models. It may hold it for a limited period for abuse monitoring, under its own terms. On /ask/, when you name an organisation, its model may additionally query a web-search index and fetch public pages about that organisation; those queries are run by Anthropic within its own service. Processing takes place in the United States. Privacy policy.
Brevo — sending transactional emails (booking confirmations, product delivery) and our newsletter. Privacy policy.

Web fonts are served directly from vedomia.com (self-hosted), so loading them creates no separate request to an external font provider. The ordinary request to our site is still handled by our hosting provider, Netlify.

International transfers

Some of our processors (such as Stripe, Brevo and Anthropic) process data outside the European Economic Area, in the United States. Where they do, the transfer is protected by appropriate safeguards — such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

Data retention

Booking and enquiry details: up to 12 months, unless we are in an ongoing client relationship with you.
Purchase inputs stored to generate your document: automatically deleted — process-map inputs after 30 days, audit/assessment inputs after 90 days. Invoice and transaction records are kept for as long as Irish tax and company law require.
Vedomia Workspace (customers): everything the organisation keeps in its Workspace is stored for as long as the Workspace exists — access runs for 12 months from purchase unless extended — and is deleted on request, or within 90 days after the Workspace closes. Two kinds of record cannot be changed or deleted from inside the Workspace, because a report that was sent must stay checkable: a checked version of the numbers, and a record of a change to a step. They are removed when the whole Workspace is deleted, or earlier by us on the organisation's written instruction. Anyone holding the ID printed on a checked report can open its verification page: it shows the period, the date it was checked, the checker's role, the map version and whether it is still valid, replaced or withdrawn, never a count or an email. Map versions that a checked version or a report refers to are kept beyond the usual 40. Your email address is your sign-in identity; it is stored with your membership and in the Workspace's activity history. Sign-in links are one-time and expire in 20 minutes; the record that a link was used is deleted after 2 days. A read-only link you create stays available until you switch it off; it carries only the fields chosen for that audience.
Free-draft email requests: your email address and the accompanying note are kept for up to 12 months; the map content is not retained once the email has been sent.
Shared process maps: if you choose to create a share link for a process map, a copy of that map is stored so the link can open it, and is automatically deleted after 180 days. The link is unlisted — it is not published or listed anywhere and search engines are asked not to index it — but anyone who has the link can view the map. Nothing is stored unless you press the share button.
Published Open Book maps: if an authorised representative separately asks us to publish a map and confirms that it is accurate and contains no personal or confidential information, we keep a frozen public copy until the organisation asks us to update or withdraw it. Published maps are intentionally public and may be indexed by search engines.
Newsletter subscription: until you unsubscribe.

Your rights

Under GDPR you have the right to access, correct, erase or restrict processing of your personal data, to object to processing, and to request portability. To exercise any right, email contact@vedomia.com. You also have the right to lodge a complaint with the Data Protection Commission Ireland (dataprotection.ie).

Cookies & local storage

We do not use analytics or advertising cookies, and our own visit counter (see "Usage statistics" above) is cookieless and respects Do Not Track and Global Privacy Control. We use only strictly necessary local storage in your browser to remember your language choice and to preserve your in-progress work in the tools — this data stays on your device. Our host may set a strictly necessary cookie for form-submission security. Customers who sign in to the Vedomia Workspace receive one strictly necessary session cookie (__Host-vd_workspace, 30 days, HttpOnly) so they stay signed in on that device; it holds a signed session reference, not your data, and is removed when you sign out.

Changes to this notice

We may update this notice from time to time. The "Last updated" date above reflects the latest revision.

Contact

Questions about this notice? Write to contact@vedomia.com.