Data Processing Agreement

Version 1.0 — July 22, 2026

1. Parties and Roles

This Data Processing Agreement ("DPA") forms part of the agreement between the customer accepting the VeraCita Terms of Service (the "Customer", acting as data controller) and MindtheGap Sarl (CHE-398.557.351), operating under the VeraCita brand, incorporated in Geneva, Switzerland ("VeraCita", acting as data processor), and applies whenever VeraCita processes personal data on the Customer's behalf in the course of providing the VeraCita verification services (the "Service").

2. Subject Matter, Duration, Nature and Purpose

VeraCita processes personal data contained in documents, text, and URLs the Customer submits, solely to provide claim and citation verification and the related deliverables described in the Terms of Service. Processing lasts for the duration of the Customer's use of the Service and ends in accordance with Section 9. VeraCita processes such data only on the Customer's documented instructions — submitting content for verification constitutes the instruction — unless processing is required by law, in which case VeraCita will inform the Customer before processing unless the law prohibits it.

3. Categories of Data and Data Subjects

• Data categories: any personal data contained in Customer-submitted documents, text, or source URLs (which the Customer controls); account and contact data (name, email); billing metadata; technical usage data.
• Data subjects: the Customer's users, and any individuals referenced in the content the Customer submits.

Zero-Knowledge mode. In Zero-Knowledge mode (the default), the submitted document never leaves the Customer's browser and is not received or stored by VeraCita; extracted claim text is transmitted directly from the browser to the AI provider for analysis. In this mode VeraCita's processing on the Customer's behalf is limited to billing and session metadata.

4. Processing Locations

• Storage: all Customer data stored by VeraCita is stored exclusively in Switzerland (AWS, Zurich region, eu-central-2).
• AI processing: AI inference runs in Switzerland and the EU via AWS Bedrock; embedding computation uses Microsoft Azure.
• Switzerland holds an EU adequacy decision; transfers between Switzerland and the EU/EEA proceed on that basis. Where a subprocessor processes personal data outside Switzerland or the EEA, VeraCita ensures appropriate safeguards (adequacy decision or standard contractual clauses).

5. Security

VeraCita implements appropriate technical and organizational measures under Art. 32 GDPR and Art. 8 Swiss FADP, including: encryption in transit (TLS 1.2+); encryption at rest on Swiss infrastructure; client-side document parsing (raw files are not uploaded in Zero-Knowledge mode); role-based access controls and least-privilege credentials; isolated per-account data; and no use of Customer data for AI model training.

6. Confidentiality

VeraCita ensures that persons authorized to process personal data are bound by confidentiality obligations, contractual or statutory.

7. Subprocessors

The Customer grants general authorization for the following subprocessors. VeraCita will give at least 30 days' notice of intended additions or replacements (via this page and, for account holders, by email), during which the Customer may object on reasonable data-protection grounds; if no resolution is found, the Customer may terminate the affected Service. VeraCita remains fully liable for its subprocessors' performance.

Payment processing is performed by Stripe as an independent controller and is governed by Stripe's own terms and privacy policy.

8. Assistance and Breach Notification

• VeraCita will assist the Customer, insofar as possible and taking into account the nature of the processing, in responding to data-subject requests (access, rectification, erasure, portability, restriction, objection) and in meeting the Customer's obligations under Art. 32–36 GDPR.
• VeraCita will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, providing the information reasonably required for the Customer's own notification obligations.

9. Retention, Deletion and Return

• Uploaded source files (Server mode) are deleted once processing completes.
• Verification session data (claims, evidence, results) is retained so the Customer can return to their session, and can be deleted by the Customer at any time through the Service.
• Upon termination of the Service or on the Customer's written request, VeraCita will delete or return all personal data processed on the Customer's behalf, unless retention is required by law (e.g., billing records under Swiss commercial law).

10. Audit and Information

On written request, no more than once per year, VeraCita will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by the Customer or an agreed independent auditor, at the Customer's expense, with reasonable notice, and without access to other customers' data or VeraCita's proprietary technology.

11. General

• In case of conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA prevails.
• Liability under this DPA is subject to the limitations in the Terms of Service to the extent permitted by applicable data-protection law.
• This DPA is governed by Swiss law; place of jurisdiction is Geneva, Switzerland.
• VeraCita may update this DPA; material changes will be notified to account holders and reflected in the version and date above.

12. Contact

MindtheGap Sarl (operating as VeraCita)
Geneva, Switzerland
CHE-398.557.351
admin@veracita.ai