Veracue Privacy Policy

1. Who we are and how to contact us

Veracue is operated by Veracue Pty Ltd (ACN 701 056 573, ABN 43 701 056 573), an Australian company based in Queensland, Australia.

For any privacy question, request, or complaint, contact us at:

• Email: privacy@veracue.com

Email is our contact channel for all privacy matters — it is the fastest way to reach our Privacy Officer, and every request in Section 8 can be made this way.

Section 8 explains how we handle complaints. If you are not satisfied with how we handle a privacy concern, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

2. The information we collect

We collect different categories of information depending on how you use Veracue. We have grouped them so you can see exactly what we hold and why. Where a category is optional, we say so, and we explain what happens if you choose not to provide it.

2.1 Account information

When you create an account, we collect your email address, a password if you choose one (stored only as a salted bcrypt hash, never in plain text), an optional display name, and the date you created your account. You can also create an account with your email address and a sign-in link instead of a password: we email you a link, and opening it creates your account and signs you in. You can set a password at any time by resetting it from the sign-in page. Without an email address we cannot create your account or provide the Services.

If you choose to, we also store the roles you tell us you are preparing for and their industries, the practice questions you star, and the date and employer of an interview you add, so that your home page can show them. Each of these is optional, and you can change or remove them on your home page or in Settings at any time.

2.2 Subscription and billing information

If you upgrade to a paid plan, our payment processor (Stripe) handles your card details directly. We never see, store, or process your full card number. From Stripe we receive a customer reference, a subscription reference, your plan tier, your renewal date, and your subscription status. Stripe's handling of your payment information is governed by Stripe's own privacy policy at stripe.com/privacy.

2.3 Calibration data (biometric information)

To tailor how close calls between similar expressions are read for your face, you can optionally calibrate Veracue by taking 7 short photos of different facial expressions. The numerical readings we derive from these photos are biometric templates, a category of sensitive information under the Privacy Act, and we handle them accordingly. We only collect this data with your express consent, given at the moment you choose to calibrate. Choosing not to calibrate simply means your analysis is not personalised; every other feature works normally.

Important: your calibration data is used only to personalise how the Services read your facial expressions. It is never used to identify you, verify your identity, or recognise you — and we do not build or operate any facial recognition or identity-matching capability. Section 4 explains in full what happens to this data, because it is the most sensitive information we handle.

2.4 Practice session data

When you complete a practice session, we collect: the job title and job description you provide (if any); the name of the company you are interviewing with, if you choose to enter one (available on paid plans); any material about that company you choose to paste in (available on Premium and Interview Sprint); the questions generated for your session, or a question you type in to practise yourself; which practice level you chose, meaning how much was on screen to help you answer before you recorded — a written script, a set of talking points, or the question on its own; a transcript of your spoken answer; the numerical analysis of your delivery (scores for what you said, how you said it, the first impression you made, how well your face and words matched, and how steady you stayed, plus underlying signals such as pace, filler words, eye-contact percentage, gaze patterns — for example, whether your gaze suggests you were reading from notes — and how your facial expressions and tone of voice read to a viewer, including which of those reads came up most often in your answer); the written coaching feedback generated for you; the version of our analysis pipeline that produced the result; and the duration and time of your session. As part of that analysis we also record where you paused while answering, how long each pause lasted, and how the loudness of your voice changed across it. This record contains no words from your answer. In a formal interview, recording starts before each question is read to you, so the analysis also covers how you came across while each question was read to you. A short pause before you answer is not analysed: if you start speaking within 15 seconds of the question ending, the time before your first words is left out. If you take longer, your answer is treated as starting one second after the question ended, and the rest of the pause is analysed as part of your answer.

If you use the dictation button, your browser’s own speech recognition transcribes what you say. That audio goes to the provider of your browser’s speech service, not to us: Google in Chrome, Microsoft in Edge, and Apple in Safari, where it may be processed on your device or on Apple’s servers. We never receive that audio, only the resulting text if you keep it.

Before your first recording we ask you to agree to this analysis. We keep a record that you agreed: the version of the notice you were shown and the time.

To produce some of these readings, our analysis locates points on your face in the video frames it samples — for example the position of your eyes, irises and eyelids, and how far your brows are raised, your mouth corners turned or your jaw open. We use them to work out where you were looking, and to check whether a read of your expression is backed by the movement it names; where it is not, that read carries less weight in your scores and feedback. These points and measurements exist only while your answer is being analysed and are deleted with your recording, unless you have turned on Keep my recordings (section 2.8), except the timeline described below. We keep only the readings described above, and whether each check found the movement. We never use them to identify you, to verify who you are, or to recognise you in another recording. For each answer we keep a short list of moments from your recording — when you smiled, moved your head or looked away from the camera, with the words you were saying at the time — and one overall figure for how animated your face was. These are written descriptions of what happened, not a biometric template or an image of your face, and no image of your face is kept with them. We keep the same kind of record for your voice: one sentence on how it sounded and up to three moments, with the words you were saying at the time; no audio is kept with it. For each answer we also keep a timeline for watching it back: second by second, how much your face moved compared with the rest of that answer, whether you were looking at the camera, how much your head moved, and how the pitch, loudness and pace of your voice rose and fell compared with your own usual. With the timeline we keep, for each sentence of your answer, when it started and ended and what was measured while you said it: how long your eyes were away from the camera, your pace and loudness against your own usual, the filler words and repeated words, and the pauses, and, for each sentence, which words you gave extra weight to or passed over, how your pitch moved at its end, the kind of each pause around it (a pause to land a point, to find a word, a breath or a long pause), whether it ran on into the next sentence without a pause, and whether your voice trailed off or faded. When you first watch an answer back, our AI provider writes short coaching notes from these measurements and your transcript, and we keep those notes with the timeline. These are numbers describing movement and sound relative to your own answer, not an image of your face, a recording of your voice or a biometric template, and they cannot be used to recognise you. The timeline is deleted when you delete that answer or your account. We also keep a short record of the moments in your answer where those checks found your brows rising or drawing down, or where your voice was louder or wider in pitch than your own usual, with when each moment happened and the words you were saying at the time, and counts of where you paused, used filler words or changed pace. It contains no measurements of your face or voice — only that a moment happened, roughly how marked it was, and where. We use it to improve how we coach delivery. It is deleted when you delete that answer or your account.

When you choose the beginner level, we generate a written answer for that question and show it to you to read aloud. We write it from your job description, the company name if you entered one, your resume if you have one on file, and any company research you pasted. For some questions we first ask you one short, optional question about your answer (for example, what you built). If you type a reply, it is sent with the request to write that script and is not stored. We keep with that answer whether you were asked that question and whether you typed a reply or skipped it, never the reply itself. When you ask for a script from one of your earlier answers, we also write it from that answer’s transcript and the feedback we gave you on it. We do not keep the script. We keep only a one-way fingerprint of it — a short string that lets us tell later whether an answer was read from a script we wrote, without storing the words themselves. If you change the script before reading it, your version is held in your browser, in that tab only — it is deleted when you close the tab or sign out from it. When you record an answer with a script on screen, or with an answer of your own that you pasted or typed in to read from, that text as it was shown, including any changes you made, is sent with the recording so that we can tell whether the answer was read from it. We use it for that comparison and, where the answer was read from it, to check the transcript: where the transcript has different words from that text, short pieces of the text, no more than eight words each, are sent with the sentence of your transcript they belong to, to our AI provider, so that it can check whether the speech recogniser misheard you. Where it did, the corrected words are kept with that answer’s transcript. Otherwise the text is not stored or logged. With each answer we keep what the comparison found and whether you changed the script, never your version of it beyond those corrected words.

We also retain the moment-by-moment numerical readings produced during your session — for each sampled instant, the scores describing how your expression and voice read at that moment. We keep these to generate your feedback, to investigate and fix problems, and to improve our analysis models over time. They are deleted when you delete your account.

About the company name. If you enter one, it is text you type yourself — we never extract it from the job description and we never look the company up. We use it for three things: choosing a small number of employer-directed questions from our reviewed question bank, putting the name into the wording of those questions, and, at the beginner level, addressing that employer by name in the script we write for you. We do not use it to generate factual claims about the company: we hold no information about any employer and do not retrieve any. It is stored with that answer alongside the job description, is deleted when you delete that answer or your account, is included in your data export, and is never written to our application logs.

About company research. If you paste material about an employer, it is text you supply — we never fetch it and we never verify it. We use it in two ways only: to check whether your answer engaged with what you read and whether what you said is consistent with it; and, if you choose the beginner level, to write what the script says about that employer, which repeats only what your material says and presents it as something you read. We never treat it as authoritative about the company, and we never add claims about them that your material does not make. It is stored with that answer, deleted when you delete the answer or your account, included in your data export, never written to our application logs, and never used to train anything. Please paste public material only.

We do not store your practice recordings unless you have turned on Keep my recordings (section 2.8). Your video and audio are deleted from our servers within seconds of analysis completing. If an analysis fails, we retain the recording for up to 24 hours to diagnose the failure, after which it is automatically deleted.

Recordings saved in your browser. So that you can watch an answer back later, your browser keeps its own copy of each recording on the device you recorded it on, with the timings needed to play it back against your analysis. That copy stays in your browser and is never sent to Veracue: we cannot see it, and it is not used for anything else. The browser keeps your last 2 answers on Free, 10 on Pro and 30 on Premium or an Interview Sprint, up to 1 GB in all, and removes the oldest first. If you choose a still from one of these recordings for your Veracue card, it is kept in your browser in the same way, is never sent to Veracue, and you can remove it at any time. Your browser may also remove them itself, for example when your device is short of space or, in Safari, after seven days without a visit to Veracue, so they may not always be there. You can delete any of them, or all of them, in Settings, and turn saving off there. Clearing your browser’s site data also removes them, and deleting your account removes them from the browser you delete it in. Anyone who uses the same browser could watch them, so on a shared computer turn saving off or delete them when you finish.

While an analysis runs, and for up to 24 hours after, we keep its progress and result against the attempt so that a dropped connection can recover it without analysing or charging you again. It is deleted after 24 hours.

If you use the Playground, we also collect what you tell us you want to practise, any slide text you paste, and the goal and criteria we write from them. We store the one-line summary of your goal, the criteria you confirmed and the slide points we drew from any slide text. The text you typed and any slide text you pasted are used to produce those and are not stored. With the result we store the feedback written against those criteria: which were met, short lines quoted from your transcript as evidence, the key phrases, and the focus and strength we gave you. If you save a goal, we keep its name and any date you enter, the one-line goal, its current criteria and its slide points, apart from any single answer.

Each attempt keeps the criteria it was scored against, and those are the record of how a goal’s criteria changed. When we suggest changed criteria, we use your latest attempt’s transcript and results. Nothing changes unless you accept, and suggestions you don’t accept aren’t kept. Suggested criteria may quote what you said or name something from your talk. A goal’s name or criteria may name people or employers if you or your talk did. Deleting an answer doesn’t remove words you already accepted into a goal’s criteria; deleting the goal does. Deleting a goal leaves its attempts as ordinary Playground answers, each with its own copy of the criteria.

2.5 Resume information

If you choose to upload your resume, we process it once to extract a structured summary of your work history, education, skills, and experience. We discard the original file immediately after extracting this summary and store only the structured text, linked to your account. We use it to generate interview questions tailored to your actual experience and, where relevant, to inform your coaching feedback. Uploading a resume is optional — without it, questions are generated from your job description or our question bank — and you can delete it at any time from Settings. Section 4 explains how this is handled alongside your other data.

2.6 Usage and technical information

To operate the Services reliably, we collect how many practice questions you have used, your IP address (used briefly to identify your country and detect abuse, not stored long-term against your account), your browser type and operating system (from standard request headers), and logs of account actions such as sign-ins, password changes, and subscription changes. To limit repeated sign-in attempts we also keep a one-way hash of the email address and IP for up to an hour; this is never linked to an account. We also use the country your connection comes from (and, in the United States, the state) to decide whether the practice app can be offered to you at all: it is not currently available to people connecting from the European Union or the European Economic Area, or from Illinois, Texas or Washington in the United States.

We also collect the website that referred you to us (for example, a search engine or a link on another site) and any campaign parameters contained in the link you arrived through. This is recorded when you first arrive and held in your browser's local storage until you create an account, at which point it is saved against your account. We keep only the referring website address and page — anything after the "?" in the referring link, which can include search terms, is removed and never stored.

When you use the practice app we keep a short record of the steps you reach: opening your home page, starting a practice run, setting your role, the camera being turned on, allowed, refused or failing to start (with the name of the error), starting and finishing a recording, and opening your results or a playback. Each step is kept with the time and a few fixed details about it, such as whether the camera was allowed. For camera steps we also note whether you were on a phone or a computer: that is a category shared by most of our users, not a fingerprint, and nothing else about your device is kept. We use this record only to find the places where people get stuck so we can fix them. It is kept with your account, does not include your IP address, is never shared with advertisers or ad platforms, and is deleted after 180 days, or sooner when you delete your account.

2.7 Feedback you give us

If you submit feedback on the accuracy of an analysis, or report a problem, we collect your response, any components you flag, and any free-text comment you provide.

2.8 Kept recordings (only if you turn this on)

By default we do not keep your practice recordings: your video and audio are deleted from our servers within seconds of the analysis finishing.

You can choose to change that. If you tick Keep my recordings — when we ask before your first recording, on a results page, or in Settings — then for each answer you record from then on, and for the answers in the practice session you had just finished when you ticked it (which your browser sends to us again at that point; we had not kept them), we keep:

• The recording itself — video and audio — so you can watch it back. Only you can see it. We delete it 90 days after it was recorded.
• Still images of your face, taken twice a second from the recording; measurements of facial movement taken from those images; short silent clips of your face, about 15 seconds each; and, alongside them, the words you said and how your voice and expression read at each moment, the question you were answering, and the readings we showed you. We keep these until you turn the setting off, delete that answer, or delete your account — longer than the 90 days the recording itself is kept.

We treat all of this as sensitive information.

We do not keep any of it if the analysis found your face could not be read reliably in that answer — for example because of the lighting — other than the recording for your own playback.

This is available only if you are 18 or over and do not live in the European Union, the European Economic Area, the United Kingdom or Switzerland, and it is not offered to people connecting from Illinois, Texas or Washington in the United States. If we learn that either is not true, we delete everything kept under this setting.

2.9 Your stories

If you upload a resume, we may suggest a few experiences from it and ask you to tell each one in your own words. You can type or dictate (dictation is handled by your browser’s speech service: see 2.4). We keep what you tell us, a short title, and the Situation, Task, Action and Result parts we sort it into, so we can build practice scripts and questions from your real experience. We only use what you told us: anything you didn’t say is left blank, not guessed. We ask you not to include other people’s names, and we replace any we find with their role. You can edit or delete any story at any time, and they are kept until you delete them or your account. Stories are not used to train any AI model.

3. How we use your information

We use your information only for the purposes described below.

We do not sell your personal information. We do not share your personal information with advertisers. We do not display advertising in our Services, and we do not use your information to target ads. This is a deliberate choice about the kind of product we are building.

We use your information to:

• Provide and operate the Services — authenticate you, deliver practice sessions, generate your analysis and feedback, and manage your account and subscription.
• Personalise your analysis, if you have calibrated, so your results account for your individual range of facial expression.
• Generate interview questions tailored to your experience, if you have uploaded a resume.
• Improve our models over time (see Section 4 for how we do this in a way that protects your identity).
• Process payments, via Stripe.
• Understand how people find Veracue and which of our campaigns lead to people using and paying for it, by counting accounts by the link they first arrived through. This is done inside Veracue and is never shared with advertisers or ad platforms.
• Find and fix the places where people get stuck, from the steps they reach in the practice app.
• Communicate with you: account confirmations, password resets, subscription notices, security alerts, and important service changes. We may also send you up to three emails about getting started and practising: a reminder to record your first answer, a note asking how your first answer went, and your focus from your last answer if you haven’t practised for a week. Each is sent at most once, and never more than one such email in a week (counting our reminders to confirm your email). Every one has an unsubscribe link, and unsubscribing stops all of them, as well as the reminders to confirm your email. We do not send other marketing emails; if we ever introduce them, they will be opt-in and every message will include a simple unsubscribe.
• Detect, investigate, and prevent fraud, abuse, and unauthorised access.
• Comply with our legal obligations.

Kept recordings. If you have turned on Keep my recordings, we use what we keep (section 2.8) to give you playback. We also use the face images, movement measurements and clips to train and test our own face-reading models, so that the reads we show you and other users become more accurate. We consider this directly related to the reason you asked us to keep them: the model being improved is the one that produces the reads on your own recordings.

No person watches or rates your recordings, images or clips, with one exception: Veracue’s own staff may view a small sample to check that the automated reads are correct. We do not sell them, share them, or let anyone outside Veracue use them. If we ever wanted to have other people view or rate them, or to use them for anything else, we would ask you again first, and would use nothing of yours for that until you agreed.

3.1 Automated analysis — what it is and what it is not

Veracue's core feature is automated analysis: software (including AI models) transcribes your answer, reads delivery signals from your video and audio, scores your response, and generates written coaching feedback. This is inherent to the Service and is exactly what you ask us to do when you record a practice answer.

This automated analysis is practice feedback you request — it is not a decision that affects your legal rights, entitlements, or access to anything. No employer, institution, or third party receives it (see Section 5), and no automated decision is made about you beyond the feedback itself. Our analysis reflects impressions a viewer might form, not measurements of your actual emotions or abilities, and it can be wrong. If you believe an analysis is inaccurate, you can flag it using the feedback controls on your results page, and you can delete any answer at any time.

3.2 Creating de-identified and aggregated data

We may create de-identified or aggregated data from the information we collect. Once data is de-identified, it can no longer be linked back to you and is no longer personal information about you. We will not attempt to re-identify de-identified data, except to the limited extent of checking that our de-identification process is working as intended. Section 4 explains how we handle your most sensitive data, including the readings derived from calibration.

4. How we handle your most sensitive data

This section explains, in detail, what happens to your calibration data and resume, because these are the most sensitive things we handle and we want you to understand them clearly.

4.1 Calibration: your face photos are never stored by default

When you calibrate, you take 7 photos. Those photos are sent to our processing servers, where we extract a numerical reading (a small set of numbers describing how your face moves for each expression). The photos are then immediately discarded. We do not keep them in any storage, backup, log, or cache — unless you have separately and specifically opted in to the second consent option described below.

4.2 Your numerical readings

At the moment of calibration, your numerical readings are stored against your account. They power your personalised analysis, and you can delete them at any time from Settings, which turns off personalisation but leaves your account otherwise intact. If — and only if — you tick the separate model-improvement option described below, we also retain your numerical readings (alongside your photos) as part of a research dataset used to improve our face model. You can withdraw at any time by deleting your calibration data in Settings, which removes your readings and photos from the dataset for all future training.

4.3 The optional model-improvement consent

When you calibrate, you may also choose, by ticking a separate and clearly-labelled option, to let us keep your 7 photos and numerical readings to help train and improve our face model. This is entirely optional and is off by default. If you tick it, your photos and readings are stored privately, accessible only to you and our authorised systems, and you can delete them at any time from Settings. If you do not tick it, your photos are discarded as described in 4.1 and your readings are kept only for your personalised analysis as described in 4.2.

4.4 Resume data

If you upload a resume, we extract a structured summary and discard the original file. The structured summary is linked to your account and you can delete it at any time from Settings. Deleting it reverts your questions to job-description-only generation.

4.5 What happens to model training

If we use our research dataset to train an improved model, we cannot retrain or destroy that model in response to a later deletion request, because the trained model is not personal information about any individual. By choosing to contribute, you understand that your contribution to any model already trained is permanent in this sense. Withdrawing, by deleting your calibration data in Settings, removes your readings and photos from the dataset for all future training.

4.6 Kept recordings

Off unless you turn it on. Turning it off in Settings deletes every kept recording and every image, measurement and clip taken from them; there is no “stop but keep what you have”. Deleting an answer deletes what was kept from it. Deleting your account deletes all of it. Files are removed from storage within 24 hours of the request, usually within the hour. As section 4.5 explains for calibration data, a model that has already been trained cannot be untrained.

5. Who we share your information with

We share information only with the service providers needed to operate Veracue, and only as much as each needs. We do not sell your data and we do not share it with advertisers. The providers we use are:

• Supabase — database, authentication, and storage. Servers located in Australia (Sydney).
• Modal Labs — model inference and analysis processing (your recordings are processed here and deleted within seconds; if you have turned on Keep my recordings, the kept copy is stored with Supabase, above). Servers located in the United States.
• Vercel — web hosting and cookieless website analytics (aggregate visitor and page-view counts; no cookies, and no tracking of individuals across sites). Globally distributed with edge locations including Australia.
• Anthropic — AI coaching feedback, question generation, resume parsing, writing the practice answers used by the beginner level, checking the transcript of an answer read from a script for words the speech recogniser misheard, and, for your stories (section 2.9), suggesting experiences from your resume to tell, sorting the story you tell into its parts, and writing scripts from it, and coaching notes when you watch an answer back, and, for the Playground, writing your goal and criteria and scoring a session against them and suggesting changes to a saved goal’s criteria from your latest attempt. Servers located in the United States.
• OpenAI — text-to-speech, so a practice question can be read aloud to you. OpenAI receives the text of the question only (which, where a question has been tailored to you, can include phrasing drawn from your resume or the name of the company you entered) — never your recording, your transcript, or your account details. The resulting audio is stored with us so the same question isn't re-generated each time. Servers located in the United States.
• Stripe — payment processing. Operates globally under its own privacy framework.
• Resend — transactional email delivery (account confirmations, password resets, reminders, practice emails and similar service emails). A US company; our email is processed through infrastructure located in Japan.
• Sentry — error monitoring, so we can detect and fix faults. Servers located in the United States. Error reports are configured to exclude personal information: we scrub identifying data and do not send personal details by default.

We may also disclose information if required by law, court order, or a lawful request from a government agency, or in connection with a sale or restructure of our business (in which case your information would remain subject to privacy protections at least as strict as those in this Policy).

6. Overseas data storage

Your account information and stored data live in Australia (our database and storage are hosted in Sydney). However, some processing happens with providers located outside Australia, so your personal information may be transferred to other countries — primarily the United States (analysis processing via Modal, AI feedback via Anthropic, spoken questions via OpenAI, error monitoring via Sentry, and Vercel's global edges) and Japan (email delivery via Resend). These countries' privacy laws differ from Australia's. We take reasonable steps, including through our providers' contractual terms, to ensure they handle your information consistently with the Australian Privacy Principles, and we remain accountable to you for their handling of it.

7. How long we keep your information

8. Your rights, choices, and how we handle complaints

We make it easy to exercise your rights directly in the app wherever possible.

Access. You can request a copy of the personal information we hold about you. Much of it is available directly through Settings; for anything else, contact us at privacy@veracue.com. We respond to access requests within a reasonable period (our aim is 7 business days) and we do not charge for making a request. Your data export includes a download link for each kept file, the steps you reached, the practice emails we sent you, your Playground sessions, labelled as such, and your saved Playground goals.

Correction. If anything we hold about you is inaccurate, out of date, incomplete, or misleading, it can be corrected. You can change your name in Settings, or contact us to correct anything else. Where you ask us to correct something, including your email address, we will take reasonable steps to do so. If we decline a correction request, we will tell you why in writing, and you can ask us to attach a statement of your requested correction to the information.

Deletion. You have several options:

• Delete an individual answer (History)
• Delete your calibration data, which turns off personalisation (Settings)
• Delete your calibration photos, if you opted in to keeping them (Settings)
• Delete your resume (Settings)
• Turn off Keep my recordings, which deletes everything kept under it (Settings)
• Delete your entire account, which removes your account information, subscription information, calibration data, photos, resume, and session data (Settings → Account)

Everything that is linked to you can be deleted.

Withdraw consent. You can withdraw consent to calibration data collection at any time by deleting your calibration data in Settings.

Complain — and how we will handle it. If you believe we have mishandled your personal information or breached the Australian Privacy Principles, email privacy@veracue.com with a description of your concern. We will: (1) acknowledge your complaint within 7 days; (2) investigate it, which may include asking you for further detail; and (3) give you a written response within 30 days setting out what we found and what we will do. If you are not satisfied with our response, or we do not respond in time, you can complain to the Office of the Australian Information Commissioner (www.oaic.gov.au, 1300 363 992).

We will never treat you less favourably for exercising any privacy right.

9. How we protect your information

The technical and organisational measures we use include:

• Encryption in transit — all connections use HTTPS with strong TLS.
• Encryption at rest — our database and storage providers encrypt stored data.
• Password hashing — passwords are stored only as salted bcrypt hashes, never in plain text, with an 8-character minimum.
• Row-level access controls — our database enforces that you can only access your own data.
• Server-side authorisation — every sensitive operation is verified server-side; we do not rely on client-side checks for security.
• Rate limiting — to prevent abuse of our systems.
• Logging and monitoring — we log security-relevant events and monitor for unusual activity, including automated error monitoring configured to exclude personal information.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will promptly assess it, take steps to contain it, and notify you and the OAIC in accordance with the Notifiable Data Breaches scheme, including a description of what happened, the kinds of information involved, and the steps we recommend you take.

When you log out, your session is ended and your refresh token is invalidated. For technical reasons inherent to how secure sessions work, an active access token may remain valid for a short period (up to approximately one hour) after logout; if you are using a shared device, we recommend closing the browser.

10. Age requirement

Veracue is for adults. The Services are only available to people aged 18 or over, are not directed at anyone under 18, and we do not knowingly collect personal information from anyone under 18. When you create an account you confirm you are at least 18 years old. We record when you confirmed you are 18 or over. If you believe a person under 18 has provided us with personal information, contact us at privacy@veracue.com and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. If we make material changes — particularly to how we handle sensitive information or your rights — we will notify you by email and in the app. Minor changes (clarifications, formatting, contact updates) may be made without notice. The "Last updated" date always reflects the most recent change.

12. Contact us

For any question about this Policy or how we handle your information:

• Email: privacy@veracue.com (general support: support@veracue.com)

We aim to respond to privacy inquiries within 7 business days.

This Privacy Policy is governed by the laws of Queensland, Australia.