Privacy Policy
Last updated: 25 October 20261. Who we are
Veracite (https://www.veracite.ch) is a service offered by thinkerlab GmbH (UID CHE-173.548.694), Zielstrasse 25, 9050 Appenzell, Switzerland. thinkerlab GmbH is the controller for the processing described in this policy. Contact: info@veracite.ch
EU Representative (Art. 27 GDPR):
Rechtsanwalt Cornelius Matutis
Berliner Straße 57
14467 Potsdam
Germany
Email: mail@matutis.de
The representative serves as a point of contact for supervisory authorities and data subjects in the EU on matters relating to the processing of personal data. He is not a data protection officer.
2. What we process, why, and on what legal basis
Account. When you create an account, we process your e-mail address, authentication data, language setting, plan and usage counters to provide and secure your account.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
Bibliography verification. When you submit a bibliography, we process the pasted text to parse the individual references and check them against scholarly databases (see section 3).
References typically contain the names of authors and editors of published works; we process these names solely to match each reference against those databases.
Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) and, for author names contained in references, our legitimate interest in providing the verification you requested (Art. 6(1)(f) GDPR).
No AI processing of your text. No large language model or other generative AI system processes your bibliography.
Unsaved results. If you do not save a verification, the input and results are held temporarily and deleted automatically within 24 hours.
Saved history. Saving a verification is optional and available on every plan. Retention depends on your plan: 24 hours on Free; longer periods apply to paid plans (see section 7). You can delete saved verifications and your entire account yourself at any time.
Payments. Purchases are made through our reseller Paddle.com Market Ltd (merchant of record). Paddle processes your payment and billing data as an independent controller under its own privacy policy (paddle.com/legal/privacy). We do not receive your payment card details; we receive transaction details (product, date, country, transaction status) needed to activate your plan and provide support.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations in accounting (Art. 6(1)(c) GDPR).
E-mails. We send transactional e-mails (confirmation, receipts for your account, service notices) on the basis of our contract with you. Product news is sent only with your consent, which you can withdraw at any time via the unsubscribe link.
Support and contact. If you write to us, we process your message and address to answer it. Legal basis: our legitimate interest in responding to correspondence (Art. 6(1)(f) GDPR) or steps prior to entering a contract (Art. 6(1)(b) GDPR).
Server logs and security. Technical data (IP address, timestamps, browser information, requests) is processed in server logs, for rate limiting and for error monitoring, to operate the service securely and diagnose faults.
Legal basis: our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR).
Logs are deleted after 30 days; error reports are configured to exclude the content of your bibliographies.
3. Queries to scholarly databases
To verify a reference, our servers query public scholarly and library databases. The current list is published at veracite.ch/sources. Some of these databases are operated outside Switzerland and the EU/EEA (for example Crossref and OpenAlex in the USA).
These queries contain only the bibliographic details of the reference being checked — such as author names, title, year and identifiers of published works. They are sent from our servers: the databases do not receive your identity, account details or IP address, and cannot link a query to you. The database operators process these queries under their own terms and privacy policies as independent controllers.
Web pages. If you select “Web page”, references with a URL and no DOI may be checked against the cited page when no scholarly source returns a candidate. Our servers send the cited URL to that website, which receives our server IP address but no account details or browser cookies. No JavaScript is executed. Page bodies are not stored; only extracted metadata and the final URL are cached for 24 hours. The website may be operated outside Switzerland or the EU/EEA.
4. Cookies and analytics
Strictly necessary. We use cookies and locally stored settings that are necessary to operate the service: session and authentication cookies, settings you choose (such as language or display theme), and the cookies our payment provider Paddle sets during checkout for the transaction and fraud prevention. These do not require consent.
Analytics. With your consent (Art. 6(1)(a) GDPR), we measure how our website is used with the tracking pixel of Metricool Software, S.L., c/ Téllez 12, Entreplanta H, 28007 Madrid, Spain. Metricool collects information about your visit — such as pages viewed, referrer, approximate location and device and browser information — and may store an identifier on your device for this purpose. If you do not consent, the pixel is not loaded and no analytics data about you is collected. You can make or change your choice at any time at “Cookie Settings” in the website footer.
We use no advertising or cross-site tracking technologies.
5. Recipients
We use the following processors, who process personal data on our behalf and under our instructions:
- Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA — application hosting, content delivery, server logs, report generation; server-side processing runs in the Frankfurt (Germany) region
- Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 — database and authentication; data is stored in the Frankfurt (Germany) region
- Fly.io, San Francisco, CA, USA — reference parsing; runs in the Frankfurt (Germany) region
- Upstash, Inc., San Jose, CA, USA — queueing, caching and rate limiting; data is stored in the Frankfurt (Germany) region
- Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA — transactional e-mail
- Functional Software, Inc. (Sentry), San Francisco, CA, USA — error monitoring; data is stored in Sentry's EU region (Frankfurt, Germany)
- Metricool Software, S.L., c/ Téllez 12, Entreplanta H, 28007 Madrid, Spain — web analytics (only with your consent)
Paddle.com Market Ltd, Judd House, 18–29 Mora Street, London EC1V 8BT, UK, processes checkout and billing data as an independent controller, not as our processor.
The scholarly databases listed at veracite.ch/sources are likewise independent operators of their own services (section 3).
We do not sell personal data. Institutional customers may request our data processing agreement at info@veracite.ch.
6. Transfers outside Switzerland and the EU/EEA
Primary processing and storage take place in the Frankfurt (Germany) region. The exception is e-mail dispatch through Resend, whose account data is stored in the USA.
Our service providers are established in the USA (Vercel, Fly.io, Upstash, Resend, Sentry), Singapore (Supabase), Spain (Metricool) and the United Kingdom (Paddle), and may access personal data from outside Switzerland and the EU/EEA.
The following safeguards apply:
- Vercel, Fly.io, Upstash and Sentry (USA) are certified under both the EU–U.S. and the Swiss–U.S. Data Privacy Framework.
- Resend (USA) is certified under the EU–U.S. Data Privacy Framework; for transfers from Switzerland, our contract with Resend incorporates the EU Standard Contractual Clauses as amended for Swiss law.
- Supabase (Singapore): transfers are safeguarded by the EU Standard Contractual Clauses with the UK and Swiss addenda, which form part of our contract.
- Metricool (Spain) is established in the EU.
- Paddle (UK): the UK is recognised as providing adequate data protection by both the European Commission and the Swiss Federal Council.
In addition, our contracts with these providers incorporate the EU Standard Contractual Clauses where applicable. Copies of these safeguards are available in the providers' published data processing agreements or from us on request.
Queries to scholarly databases outside Switzerland and the EU/EEA contain only bibliographic details of published works, as described in section 3.
7. Retention
- Unsaved verifications: deleted automatically within 24 hours. Deleted data may persist in encrypted database backups for up to 7 days before being overwritten.
- Saved verifications: saving is not available on Free. 12 months on Thesis Pass; for as long as your subscription is active on Individual and Pro — or until you delete them.
- Account data: until you delete your account; deletion is self-service in your account settings.
- Transaction records we receive from Paddle: 10 years (Swiss accounting law, Art. 958f OR).
- Server logs: 30 days. Support correspondence: 24 months.
8. Your rights
You have the right to access, rectify and delete your personal data, to restrict its processing, to receive it in a portable format, and to withdraw consent at any time with effect for the future. You also have the right to object, on grounds relating to your particular situation, to processing we base on legitimate interest (Art. 21 GDPR). Write to info@veracite.ch.
You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU/EEA, with your local supervisory authority.
9. No automated decision-making about you
Verification verdicts are statements about bibliographic references, produced by deterministic matching rules; they are not automated decisions about you and have no legal or similar effect on you. We do not profile our users.
10. Changes
We will update this policy as the service evolves. Material changes will be announced in the application; the current version is always available on this page. Last update: 20.10.2026.