Privacy notice
Last updated: August 12, 2026
This notice explains what Veriply does with personal data, why it does it, and what you can do about it. It covers everyone the service touches: owners who register a tag, finders who scan one, and anyone who signs up for product news.
Who is responsible
Veriply is run by Nicolas Maskens, 61 rue de Gerlache, B-1040 Bruxelles, Belgique. If you have a question about this notice, or want to exercise any of the rights below, write to privacy@veriply.eu.
Veriply is not required to appoint a data protection officer and has not appointed one. The address above reaches the person who decides these things.
What we process, and why
Each row below is a separate activity, with its own purpose and its own lawful basis under Article 6 of the GDPR.
Your email address, your language, and your notification settings.
- Why
- — Running your owner account: signing you in by email link, and telling you when someone finds one of your items.
- Lawful basis
- — Performance of a contract — Art. 6(1)(b).
- How long
- — As long as you have an account.
The label and the private note you give an item.
- Why
- — Showing a finder what the item is, and reminding you which tag is on which thing.
- Lawful basis
- — Performance of a contract — Art. 6(1)(b).
- How long
- — The life of the tag.
The messages between an owner and a finder, and any location hint the finder types.
- Why
- — Carrying the conversation that reunites an item with its owner.
- Lawful basis
- — Legitimate interests — Art. 6(1)(f): returning lost property, which is what both sides came here to do.
- How long
- — 12 months after the last message.
A finder's email address, if they give one.
- Why
- — Telling a finder that the owner has replied. It is optional, and the owner never sees it unless the finder sends it deliberately.
- Lawful basis
- — Consent — Art. 6(1)(a). Leave the field empty and nothing is stored.
- How long
- — 12 months after the last message.
Contact details either side chooses to share inside a conversation.
- Why
- — Letting the two of you arrange the hand-over directly, if you both want to.
- Lawful basis
- — Consent — Art. 6(1)(a). Nothing is shared until you press the button.
- How long
- — 12 months after the last message.
Your email address, your language, and a record of when you agreed and to which wording.
- Why
- — Occasional news about the product.
- Lawful basis
- — Consent — Art. 6(1)(a). Every message carries an unsubscribe link.
- How long
- — 36 months from your last confirmation, or 36 months after you unsubscribe.
The interface language you choose.
- Why
- — Showing you the site in a language you read.
- Lawful basis
- — Legitimate interests — Art. 6(1)(f), or performance of a contract if you have an account.
- How long
- — A year in a cookie; on your account for as long as you have one.
Your IP address.
- Why
- — Counting requests per minute, so tag pages cannot be harvested in bulk by a script.
- Lawful basis
- — Legitimate interests — Art. 6(1)(f): keeping the service up and protecting the people whose tags it serves.
- How long
- — Under a minute, in the server's memory. It is never written to a file or to the database.
There is no automated decision-making and no profiling. Nothing here is used to advertise to you, and nothing is sold or handed to anyone for their own purposes.
Who else handles it
Three companies process data on Veriply's behalf, under contract and on Veriply's instructions only.
- ·Vercel — hosting and server logs — United States. Server logs are kept for one hour.
- ·Brevo — sending the emails the service has to send — France. Delivery logs are kept for one month, and the content of the emails themselves is not stored at all.
- ·OVHcloud — the database — France.
Beyond those three, data is disclosed only where the law obliges it.
Data leaving the EU
Hosting is in the United States, with Vercel. That transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Vercel is certified. The database and the email service are inside the European Union.
That adequacy decision is currently under appeal before the Court of Justice of the European Union. If it falls, Veriply will move to another transfer mechanism or another host, and this notice will say which.
How long things are kept
The exact periods are in the table above. In short:
- ·A conversation between an owner and a finder is deleted 12 months after its last message.
- ·An owner account lasts as long as you want it. If it holds no active tag and has not been signed in to for 24 months, it is deleted.
- ·A registration that is begun and never confirmed is deleted after 30 days.
- ·A product-news signup you never confirm is deleted after 7 days. A confirmed one is deleted 36 months after your last confirmation, or 36 months after you unsubscribe.
Deleting a record from the live database does not instantly erase it from the daily backups. It disappears from those within 2 days, which is how long backups are kept.
Your rights
You can ask to:
- ·see what is held about you, and get a copy of it;
- ·have anything wrong corrected;
- ·have it deleted;
- ·have its use paused while something is being sorted out;
- ·object to anything done on the basis of legitimate interests;
- ·receive what you gave us in a portable form;
- ·withdraw consent at any time — which does not undo what was lawfully done before you withdrew it.
There is no self-service delete button yet. Write to privacy@veriply.eu and it is done by hand, normally within a month.
If you found something and wrote to an owner, you can have that conversation deleted. You do not need an account: send us the link you were given, which is the only thing that identifies it.
Complaining
If you think your data is being handled wrongly, please tell us first — but you have every right to go straight to the Belgian Data Protection Authority.
Autorité de protection des données / Gegevensbeschermingsautoriteit — Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be
Cookies
Veriply sets three cookies. All three are needed for the site to work, which is why there is no banner asking you to accept them: consent is required only for cookies that are not strictly necessary.
NEXT_LOCALE
Remembers the language you chose.
How long — 1 year
authjs.session-token
Keeps you signed in to your owner account.
How long — Until you sign out
submitted_{claimId}
Remembers that you have just submitted a registration in this browser, so the page can show your email address in full rather than masked.
How long — 24 hours
There is no analytics, no advertising and no third-party tracking of any kind. If that ever changes you will be asked first, and refusing will be exactly as easy as agreeing.
Changes
If this notice changes in substance, the date at the top changes with it — and where the change affects something you agreed to, you will be told directly.