Privacy Policy

Veytrio provides AI-governance and prompt-risk monitoring software that helps organisations make their staff’s use of generative-AI tools visible and reviewable. In this policy, “Veytrio”, “we”, “us” and “our” mean Junaid Mahmood, a sole trader trading as Veytrio, established in the United Kingdom, who is the data controller for the personal data described in this policy.

You can contact us about anything in this policy by email at contact@veytrio.com. A postal address is available on request.

We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration reference ZC199842 (registered name Mr Junaid Mahmood; data protection fee paid, Tier 1, confirmed 17 July 2026). You can verify this on the ICO’s public register. We have not appointed a Data Protection Officer, and keep whether we are required to appoint one under review.

This policy covers the personal data we decide the purposes and means for — that is, where we act as a controller. That includes visitors to this website, people who enquire about or contact us, and the accounts and security records of people who use our product dashboard.

It does not cover the monitoring data our customers collect using Veytrio. When an employer uses our product to record and review how its staff use AI tools, the employer decides why and how that data is used — the employer is the controller and we act only as its processor, on its documented instructions, under a Data Processing Agreement. The next section explains what that means for you.

If your employer uses Veytrio, it may record your interactions with supported AI tools — such as ChatGPT, Claude, Gemini and Microsoft Copilot — through a browser extension it deploys, and, where it has switched this on, by importing Microsoft 365 Copilot interaction records from its own Microsoft environment. For that monitoring data, your employer is the controller and Veytrio is its processor: your employer decides whether to monitor, whom to monitor, which tools are in scope, how long records are kept, and what is done with them.

To exercise your data protection rights over that monitoring data — access, erasure, objection and the others — please contact your employer, whose own privacy information should describe this processing. If you send such a request to us, we will pass it to your employer without undue delay and tell you we have done so; we cannot act on it independently, because the data is your employer’s to control.

Website enquiries. When you submit our contact form, we handle the details you provide — your name, company, work email, role (optional), company size, what you are interested in, and any message — to respond to your pilot, demo or general enquiry. The submission also includes basic context about your visit (the page you submitted from and, if you have opted in to analytics, the page you first landed on, including any campaign parameters, and the last link you clicked) so we understand how you found us. Enquiries are delivered to us by email through our email provider.

Website analytics. With your consent, we use privacy-friendly analytics (Vercel Web Analytics) to understand aggregate page usage — for example, which pages are visited most. It is cookie-less, does not track you across other sites, and does not build a profile of you. See “Cookies and similar technologies” below.

Technical logs. As with any website, our hosting and email providers generate technical logs that can include IP addresses, request details and timestamps. We also use your IP address transiently to rate-limit our contact form against spam and abuse. We use such logs to operate and secure the site and to investigate misuse.

Within the product (pilot customers). For organisations that use Veytrio, we handle governance-relevant records of AI-tool usage — such as which AI tool was used, timestamps, risk signals and review status — captured primarily from supported browser-based AI tools via a lightweight browser extension, and, where an organisation enables them, from a VS Code integration or the Microsoft 365 Copilot connector. When an employee submits a prompt, its content is transmitted to our hosted service, where an automated redaction step then masks certain patterns; what is stored of that content depends on the customer’s configured retention setting (see “Sensitive content and redaction”). In this product context the customer organisation is the controller and we are its processor.

Our purpose is AI governance: giving organisations visibility and review evidence around how AI tools are being used, and running our own business — responding to enquiries, arranging demonstrations and pilots, managing customer relationships, and keeping our website and platform secure. We do not sell personal data, and we do not use enquiry details for advertising.

Enquiries and business contacts. We handle contact-form and correspondence details on the basis of our legitimate interests (Article 6(1)(f) UK GDPR) in responding to and following up on business enquiries and maintaining B2B relationships; on contract (Article 6(1)(b)) where you are, or are becoming, our customer; and on legal obligation (Article 6(1)(c)) for keeping accounting and tax records. We correspond in a business capacity using business contact details, and you may object at any time.

Optional analytics and attribution. These run only with your consent, which you give through our banner and can withdraw at any time via “Cookie preferences”.

Account and security records (product). Where you have a dashboard account, we rely on our legitimate interests in operating a secure, multi-customer platform, on contract where you are yourself the customer, and on legal obligation where we must retain or disclose records.

Within the product. For the AI-usage data captured on a customer’s behalf, the customer organisation is the controller and determines the lawful basis; Veytrio acts as its processor under a Data Processing Agreement.

This website does not use advertising or cross-site tracking cookies, and sets no non-essential cookies. We use two optional, privacy-friendly technologies, and only after you choose “Accept” on our banner (you can decline just as easily with “Essential only”):

Analytics. Vercel Web Analytics measures aggregate page usage. It is cookie-less, does not track you across other sites, and does not build a profile of you.

Attribution. We store a small, non-identifying note in your browser’s session storage — the page you arrived on and the last link you clicked — so that if you contact us we understand how you found us. It is cleared when you close the tab, and is never written unless you opt in.

Until you choose, neither of these runs and nothing optional is stored on your device. We remember your choice in your browser’s local storage so we don’t ask again (recording your own preference does not itself need consent). You can change your choice at any time using “Cookie preferences” in the footer — declining also clears anything stored under an earlier opt-in.

Separately, our product dashboard (used by customer administrators) uses only cookies that are strictly necessary to sign you in and keep the session secure; it sets no analytics, advertising or tracking cookies, so no banner is shown there.

Within the product, when an AI prompt is captured its content is transmitted to our hosted service and an automated redaction step is applied there, on our servers, before storage. Redaction identifies certain patterns — such as credentials, email addresses, and common identifiers — and masks them to reduce unnecessary exposure. It is a risk-reduction control only: it is not guaranteed to remove everything, it does not detect every category (for example, it does not identify personal names or most special-category data), and it is not a compliance guarantee. Redaction is applied on every capture path and is not configurable. What is then stored of the prompt — including, on the default setting, the original text alongside the redacted version — is governed by the customer organisation’s configured retention setting.

As a controller, Veytrio does not make any decision about you based solely on automated processing that produces legal or similarly significant effects. Within the product, the risk classifications and activity summaries generated about AI use are produced by deterministic, rule-based logic as decision-support information for the employer’s authorised staff — not findings of wrongdoing — and our customer agreements require meaningful human review before any employment consequence. Questions about how your employer uses those outputs should go to your employer.

Within the product, access is role-based and tenant-scoped, and administrative actions are recorded in an audit trail; only authorised users within a customer organisation can review that organisation’s activity. Our own operations staff (a platform-owner role) can access customer environments where needed to operate and support the platform; those actions are logged, and connector-configuration changes require a recorded support reason. Because our data is held in a hosting provider’s managed database, it is technically accessible to that database operator; we address this through contract and access controls.

We take steps designed to protect personal data appropriate to the risk, including: encryption in transit over HTTPS as provided by our hosting platforms; role-based access controls; logical separation of each customer’s data enforced at the application layer and covered by automated tests; hashed or encrypted storage of credentials and integration secrets; and audit logging of administrative and platform-owner actions. No system is invulnerable, and we do not promise that incidents cannot occur. If a personal data breach we are responsible for is likely to result in a risk to individuals, we will notify the ICO in accordance with Article 33 UK GDPR, and affected individuals where Article 34 requires it.

We keep personal data only as long as we need it for the purposes above, then delete or anonymise it. Enquiry correspondence is kept for as long as needed to deal with your enquiry and any ongoing relationship. Accounting and tax records are kept for the period required by UK law (generally up to six years after the relevant financial year). Retention of product data is configured by the customer organisation and agreed during onboarding. Some technical and security logs are retained by our providers under their own terms.

The application servers and database that run our product are configured in the European Union (Frankfurt), so data held in the product is processed and stored in the EU; UK-to-EU transfers rely on the UK’s adequacy regulations for the EU. Some of our providers are headquartered in the United States, so some personal data — for example, the delivery of website enquiry emails, or provider-side administration — may be transferred outside the United Kingdom.

Where a restricted transfer occurs, we rely on an appropriate safeguard — UK adequacy regulations (including, for certified US recipients, the UK Extension to the EU–US Data Privacy Framework), or the ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses together with a transfer risk assessment. You can ask us for information about the transfer mechanisms that apply to your data. For pilot customers, hosting and data residency are confirmed at onboarding, and a Data Processing Agreement is available on request.

We rely on third-party infrastructure and service providers to operate. Our current core providers are: Vercel (website and product dashboard hosting, and website analytics); Resend (delivery of website enquiry emails); Render (product application and database hosting); and Microsoft (Entra ID) (sign-in identity for the product dashboard). We do not share personal data with advertising networks or data brokers, and our platform contains no payment processor, so it holds no card or bank details. The full sub-processor list for a deployment is confirmed as part of onboarding and any applicable Data Processing Agreement.

Where we are the controller, you have the right under UK data protection law to:

• access a copy of your personal data;
• have inaccurate data corrected or incomplete data completed;
• have your data erased in certain circumstances;
• restrict or object to how we use it (including objecting to any direct marketing, which we will always stop);
• data portability, where applicable; and
• withdraw consent at any time, where we rely on it, without affecting earlier processing.

To exercise any of these rights, contact contact@veytrio.com. We do not charge a fee unless the law allows one, and we will respond within one month (extendable by up to two further months for complex or numerous requests, in which case we will tell you). If your request concerns your employer’s monitoring of your AI use, your employer is the controller — please send it to your employer, and if you send it to us we will pass it on and tell you we have done so.

If you are unhappy with how we have handled your personal data, please contact us first at contact@veytrio.com so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to us first does not affect your right to go to the ICO.

Veytrio is business software provided to organisations for workplace use, and our website and communications are directed at businesses. We do not knowingly collect personal data from children, and the Services are not offered to consumers.

We may update this policy from time to time — for example, when our providers, hosting arrangements or legal obligations change. We will publish the updated version at this same location with a new date. Please check back for the latest version.