Privacy Policy

1. Introduction

Vertocol Inc. ("Vertocol," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you visit our websites, including vertocol.ai and vertocol.com (the "Sites"), use the Vertocol Platform, or engage our services.

Where we process information on behalf of a customer under a Service Agreement, Business Associate Agreement, or data processing agreement, that agreement controls how we handle that information.

2. Information we collect

Information you provide. When you join early access, apply to the design partner program, request a demo, contact us, or engage our services, we may collect your name, work email, company, job title, phone number, and information about the product you are building or your regulated software needs. We do not collect payment card details directly. Payments are handled by third-party payment processors.

Information collected automatically. With your permission where the law requires it, we and our service providers collect information such as IP address, browser and device type, operating system, referring URLs, pages visited, and time spent on pages. We collect this using cookies and similar technologies (see Cookies).

Information from Platform use. If you use the Vertocol Platform, we collect account credentials, project configuration data, compliance artifacts, usage logs, and activity within the Platform. We do not access the content of your software unless it is needed to provide technical support and you give us explicit permission.

Information from other sources. We may receive information about you from business partners, publicly available sources, or service providers that help us understand our audience, and combine it with information we already hold.

3. How we use information

• Respond to your questions and provide the services you request.
• Deliver, secure, and improve the Vertocol Platform and our services.
• Manage early access, the design partner program, and similar programs.
• Send transactional messages, such as onboarding and support responses.
• Send product updates and news where you have opted in or where the law allows. You can unsubscribe at any time.
• Understand how the Sites are used, if you allow analytics cookies.
• Comply with legal obligations, enforce our agreements, and protect against fraudulent, unauthorized, or illegal activity.

Your product information and Client Materials. Information you share with us about your product, documents, code, and other materials is treated as confidential. We do not use it to train AI models, we do not add it to the Vertocol Library, and we do not share it with other customers or prospects.

The Vertocol Library. The Vertocol Library is built from regulatory sources and regulatory interpretations confirmed by regulatory SMEs. It is kept in a de-identified form that does not include your product details, documents, code, or other confidential information.

We do not sell your personal information.

4. HIPAA and protected health information

Vertocol provides compliance infrastructure and services for regulated healthcare software. In delivering some services, Vertocol may act as a Business Associate under HIPAA. Where that applies, we sign a Business Associate Agreement (BAA) with the covered entity or business associate before we access or process Protected Health Information (PHI).

Our website forms and marketing communications are not designed for PHI. Please do not submit PHI or any patient information through our website forms.

5. Legal bases (EEA, UK, and Switzerland)

Where the law requires a legal basis, we process personal information to take steps you request or to perform a contract, with your consent (for example, for non-essential cookies and marketing emails), to comply with legal obligations, and for our legitimate interests in operating and securing the Sites and services and responding to you, where those interests are not overridden by your rights.

6. How we share information

• Service providers that help us run the Sites, the Platform, and our services, and that may use the information only to provide those services to us. These include HubSpot (customer relationship management, forms, and email), Google (Google Tag Manager and Google Analytics, and Google Fonts, which serves the typefaces used on our Sites and receives your IP address and browser details when a page loads), our cloud and website hosting provider Bolt hosting, and email delivery providers.
• Professional advisors such as lawyers, accountants, and insurers, as needed.
• Law enforcement or regulators when required by law or to protect our rights, safety, or property.
• An acquirer or successor in a merger, acquisition, financing, or sale of assets, subject to confidentiality protections.
• Anyone else with your consent or at your direction.

We do not sell personal information, we do not share it for cross-context behavioral advertising (as those terms are defined under applicable state law), and we do not share it with third parties for their own marketing.

7. Cookies and similar technologies

When you first visit the Sites, we ask for your choice before setting any non-essential cookies. Essential cookies are always on because the Sites need them to work. Analytics and marketing cookies stay off unless you allow them.

You can change your choices at any time using Cookie settings in the site footer or the button below. You can also block or delete cookies in your browser settings, although some parts of the Sites may not work as intended.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out, and marketing cookies stay off.

You can read how these providers handle data at Google's partner sites page and HubSpot's privacy policy.

Cookie settings

8. Data retention

We keep personal information only as long as we need it for the purposes in this policy, to comply with legal obligations, resolve disputes, and enforce our agreements. When it is no longer needed, we securely delete or anonymize it.

9. Data security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and regular security reviews. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your personal information.
• Receive a copy of your information in a portable format.
• Object to or restrict our processing, or withdraw consent you have given.
• Opt out of marketing emails at any time by clicking "unsubscribe" in any email or contacting us.

California residents. Under the CCPA, as amended by the CPRA, you have the right to know, delete, and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information as defined by the CCPA. You may use an authorized agent to make a request for you, and we will not treat you differently for exercising your rights.

EEA, UK, and Switzerland. You may also file a complaint with your local data protection authority.

To exercise any of these rights, email privacy@vertocol.com. We will verify your request and respond as the law requires. If we decline your request, you may ask us to reconsider by replying to our response.

11. International transfers

We are based in the United States. Your information may be processed there and in other countries that may not offer the same protection as your home country. Where required, we use appropriate safeguards such as standard contractual clauses.

12. Children's privacy

The Sites and services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it.

13. Third-party links

The Sites may link to third-party websites. We are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party sites you visit.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on the Sites with a new effective date, and where the changes are material and we have your contact details, we will also let you know by email.

15. Contact us

Questions about this Privacy Policy or our data practices? Contact us:

Vertocol Inc.
6977 Navajo Rd. Suite 104, San Diego, CA 92119
privacy@vertocol.com