- When you join the waitlist we collect your Google sign-in details (name, email, profile photo), your country, and technical data about your connection and browser.
- We use it to run the waitlist, email you about your spot, and keep Veriqium to one real person per account. People, not algorithms, decide who is admitted.
- We do not sell your data, show you ads, use tracking cookies or analytics, or use your data to train AI.
- You can access, correct or delete your data, or leave the waitlist, at any time by emailing [email protected].
This summary is for convenience. The full text below is what applies.
01Who we are
Veriqium (“Veriqium”, “we”, “us” or “our”) is the controller of the personal data described in this Privacy Policy. That means we decide why and how your personal data is processed and are responsible for it under data protection law.
Veriqium is building a platform where verified people complete simple tasks and earn VQM tokens, and where those contributions become trusted data for AI. Today, this website lets you learn about Veriqium and apply for our waitlist.
For any privacy question or to exercise your rights, contact us at [email protected]. We have not appointed a statutory Data Protection Officer because we are not currently required to; our privacy team at that address handles all data protection matters.
02Scope of this policy
This policy covers personal data we process when you visit www.veriqium.com, sign in with Google, apply for the waitlist, use a referral code, or contact us (together, the “Services”). It applies to visitors and applicants worldwide, and includes additional information for people in the European Economic Area (“EEA”), the United Kingdom, Switzerland and the United States.
It does not yet cover the Veriqium contributor platform (identity and uniqueness verification, tasks, wallets and VQM rewards), which is not live. Before we collect any data for those features we will publish an updated or separate notice and, where the law requires it, ask for your consent. See section 13.
03Personal data we collect
From Google, when you choose “Continue with Google”
We use Google Sign-In (OpenID Connect) and request only the basic openid, email and profile scopes. Google shares with us:
- your Google account identifier (a stable number Google assigns to your account);
- your email address and whether Google has verified it;
- your name, first name and last name as they appear on your Google account;
- the web address of your Google profile picture; and
- your Google Workspace domain, if your account belongs to an organisation.
We never receive your Google password and we do not get access to your Gmail, contacts, files, calendar or any other Google data.
Information you give us in the waitlist form
- your full name (pre-filled from Google; you can edit it);
- your country of residence;
- a referral code, if someone invited you;
- your confirmation that you are 18 or older, and the time you gave it; and
- your agreement to receive emails about your waitlist spot, the time you gave it and the version of the text you agreed to.
Information collected automatically
When you sign in or submit the form, we record technical information about the request. Most of it is added by Cloudflare, our network and security provider, or sent by your browser as a matter of course:
- Network data: IP address; approximate location derived from the IP address (country, continent, region, city, postal code, approximate coordinates and time zone); network operator (ASN); and a Cloudflare request identifier.
- Security signals: Cloudflare’s bot-likelihood score, whether the request came from a known automated agent, and a TLS connection fingerprint.
- Browser data: user agent (browser and operating system), preferred languages, platform and mobile indicators, the referring page, and other standard request headers. We never store your cookies or authorisation headers in these logs.
- Data reported by your browser: time zone, language list, screen size and pixel density, and how long the form took to complete.
- Device identifier: a random identifier stored in a cookie on your browser so we can recognise repeat attempts from the same device (see section 8).
We keep a record of every sign-in and submission attempt, including unsuccessful ones, with the data above and the outcome (for example, “created”, “duplicate email” or “rate limited”).
Information we create
- your own referral code, and who referred you (if anyone);
- your waitlist status (pending, approved, invited or declined) and related dates;
- a risk score (0–100), a risk level and the reasons behind it, such as a mismatch between your stated country and your connection’s country (see section 6); and
- notes made by our team when reviewing an application.
When you contact us
If you email us, we receive your email address, the content of your message and anything you attach, and we keep a record of our correspondence.
What we do not collect
We do not use analytics, advertising or social-media tracking tools on this website. We do not ask for government ID, biometric data, payment card details or wallet addresses at the waitlist stage, and we ask you not to send us special category data (such as health, religious or political information).
04How we use your data and our legal bases
Under the GDPR and UK GDPR we must have a legal basis for each use of your personal data. The table below sets out what we do, and why we are allowed to do it.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your waitlist application, keep you signed in, and let you return to it | Google account data, form data, device identifier, cookies | Steps taken at your request before entering into a contract (Art. 6(1)(b)) |
| Email you about your spot: your invitation, status changes and essential waitlist updates | Name, email address, status | Your consent (Art. 6(1)(a)), which you can withdraw at any time; and steps at your request before a contract (Art. 6(1)(b)) for the invitation itself |
| Keep the waitlist to one real person per account: detect bots, duplicate and fake applications and abuse, and prioritise applications for review | Network, security and browser data, device identifier, attempt history, risk score | Our legitimate interests in keeping the platform human, fair and free of fraud (Art. 6(1)(f)) |
| Review and decide on applications, and admit people at a sustainable pace | Application data, risk score, reviewer notes | Steps at your request before a contract (Art. 6(1)(b)) and our legitimate interests in admitting genuine contributors (Art. 6(1)(f)) |
| Run the referral programme and attribute referrals | Referral codes, referral relationships | Our legitimate interests in growing the community through people you know (Art. 6(1)(f)) |
| Keep the Services secure and available: rate limiting, preventing attacks, investigating incidents | Network, security and browser data, attempt history | Our legitimate interests in securing our systems and users (Art. 6(1)(f)) |
| Enforce our minimum age, eligibility rules and Terms of Service | Age confirmation, country, application data | Our legitimate interests (Art. 6(1)(f)) and, where applicable, legal obligations (Art. 6(1)(c)) |
| Answer your questions and requests, including privacy requests | Contact details, correspondence | Legal obligation for rights requests (Art. 6(1)(c)); legitimate interests otherwise (Art. 6(1)(f)) |
| Comply with law, respond to lawful requests from authorities, and establish, exercise or defend legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and concluded that the processing is proportionate, limited to what is needed, and something you would reasonably expect from a service that promises “one person, one account”. You can ask us for more information about this balancing test, and you have the right to object (see section 10).
Providing your Google account data, name, country and the two confirmations is necessary to apply for the waitlist. If you do not provide them, we cannot accept your application. The referral code is optional.
We do not sell your personal data, use it for targeted advertising, or use it to train AI models.
06Risk scoring and automated decisions
To keep Veriqium to one account per real person, each application receives an automatically calculated risk score based on signals such as: whether your connection comes from an anonymising network like Tor; whether your stated country or time zone differs from what your connection suggests; how many applications came from the same IP address or device recently; whether the browser appears automated; whether the email domain is a known disposable inbox provider; and how quickly the form was completed.
The score is used to prioritise and support human review. It does not, by itself, accept or reject an application. Decisions on admission are made by people on our team, who can see the reasons behind a score and take other information into account. We therefore do not make decisions based solely on automated processing that produce legal or similarly significant effects on you within the meaning of Art. 22 GDPR.
Separately, some automatic safeguards act immediately and temporarily, such as limiting repeated attempts from the same IP address or device within a short period, and ignoring submissions that trip an anti-bot check. These are security measures and do not affect a later, legitimate application.
If you believe an application of yours was handled incorrectly, email [email protected] and a person will review it, explain the main factors involved, and consider your point of view.
07International data transfers
We and our service providers may process personal data in countries other than the one where you live, including the United States, whose data protection laws may differ from yours.
When we transfer personal data out of the EEA, the UK or Switzerland to a country that has not been recognised as providing adequate protection, we use appropriate safeguards: the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or, for recipients certified under it, the EU–U.S. Data Privacy Framework and its UK and Swiss extensions. Where needed, we assess the laws of the destination country and apply supplementary measures such as encryption in transit. You can ask us for a copy of the relevant safeguards at [email protected].
09How long we keep your data
We keep personal data only for as long as we need it for the purposes above, and then delete or anonymise it.
| Data | Retention period |
|---|---|
| Waitlist application (Google account data, form data, referral data, status, risk score, review notes) | While you remain on the waitlist. If you become a Veriqium user, it transfers to your account and the platform’s privacy notice applies. If you ask to leave, or the waitlist closes without you being admitted, we delete it within 30 days, except the minimum needed to honour your request or prevent a removed or declined applicant from re-registering, which we keep for up to 24 months. |
| Sign-in and submission attempt records (network, security and browser data) | 12 months from the attempt, then deleted. Records linked to a confirmed abuse or security investigation may be kept until the matter is resolved. |
| Consent and age-confirmation records | For as long as we rely on them, plus up to 3 years to demonstrate compliance. |
| Correspondence and privacy requests | Up to 3 years after the matter is closed. |
| Cookies | As shown in section 8. |
We may keep data for longer where the law requires it or where it is needed to establish, exercise or defend legal claims, and only for that purpose.
10Your rights
If you are in the EEA, the UK or Switzerland, you have the following rights under the GDPR, UK GDPR or the Swiss Federal Act on Data Protection. Many other countries give similar rights, and we honour requests from anyone, wherever they live, to the extent we reasonably can.
- Access: obtain confirmation of whether we process your data and a copy of it.
- Rectification: have inaccurate data corrected or incomplete data completed.
- Erasure: have your data deleted, including leaving the waitlist.
- Restriction: ask us to limit how we use your data, for example while we check its accuracy.
- Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another organisation.
- Objection: object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
- Withdraw consent: withdraw consent to emails at any time, using the unsubscribe link in any email or by contacting us. This does not affect processing that happened before you withdrew.
- Human review: ask a person to review any decision about your application, as described in section 6.
- Complain: lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. In the UK this is the Information Commissioner’s Office; EEA authorities are listed by the European Data Protection Board. We would appreciate the chance to address your concern first.
How to exercise your rights
Email [email protected] from the address on your waitlist application, or tell us which address it is. To protect your data, we may need to confirm that the request comes from you, for example by asking you to reply from that address or sign in with the same Google account. You may use an authorised agent, who must provide proof of their authority.
We respond within one month of receiving your request. If a request is complex or we receive many, we may extend this by up to two further months and will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive.
11Additional information for U.S. residents
This section supplements the policy for residents of California and other U.S. states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others (together, “U.S. privacy laws”). Terms such as “personal information”, “sell” and “share” have the meanings given in those laws.
Categories of personal information collected in the past 12 months
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email address, Google account ID, IP address, device identifier, referral code | Cloudflare, hosting and email providers, professional advisers |
| Internet or network activity | Browser and device characteristics, request headers, sign-in and submission history | Cloudflare, hosting providers |
| Geolocation data | Approximate location derived from IP address (not precise geolocation) | Cloudflare, hosting providers |
| Characteristics of protected classifications | Confirmation that you are 18 or older | Hosting providers |
| Inferences | Risk score and reasons used to detect fraud and duplicate accounts | Hosting providers |
Sources, purposes and retention periods for each category are described in sections 3, 4 and 9. We do not collect sensitive personal information as defined by U.S. privacy laws. Google Sign-In means we never receive your account password.
No sale or sharing
We do not sell personal information, “share” it for cross-context behavioural advertising, or process it for targeted advertising or profiling that produces legal or similarly significant effects, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. Because we do not sell or share, we do not offer an opt-out link; we nonetheless honour Global Privacy Control signals as a request to opt out.
Your rights
Depending on your state, you may have the right to know what personal information we collect, use and disclose and to access it; to correct it; to delete it; to obtain a portable copy; and to opt out of sale, sharing, targeted advertising and certain profiling. We will not discriminate against you for exercising these rights. Submit requests as described in section 10; we will verify your identity by matching information you give us with the information we hold, and respond within 45 days (which we may extend once by 45 days where permitted).
If we deny your request, you may appeal by replying to our decision or emailing [email protected] with the subject line “Appeal”. We will respond to appeals within the time required by your state’s law. If you are not satisfied with the outcome, you may contact your state Attorney General.
12Children
The Services are intended only for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, contact [email protected] and we will delete it.
13The Veriqium platform and blockchain data
When we invite you to the Veriqium platform, you will be asked to verify that you are a real, unique person, may connect an EVM-compatible wallet, and will be able to complete tasks and receive VQM. Those features will involve additional processing, which may include identity or liveness checks, wallet addresses, the content of your contributions and records written to a public blockchain.
We will explain that processing in a dedicated notice before it begins, including any use of third-party verification providers and whether any biometric data is involved, and we will obtain your explicit consent where the law requires it. You will be able to decline and leave the waitlist at that point.
Please be aware that information recorded on a public blockchain is, by design, visible to anyone and generally cannot be changed or deleted by us or anyone else. We intend to keep personal data off-chain.
14How we protect your data
We use technical and organisational measures appropriate to the risk, including: encryption in transit (HTTPS) for all traffic; signed, tamper-proof and host-bound cookies; verification of every Google sign-in token with Google’s published keys; restricted, private network access to our database; the least access necessary for our staff; and monitoring for abuse.
No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay where the risk is high.
15Third-party websites
Our website contains links to other websites, such as Google. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.
16Changes to this policy
We may update this policy as our Services and the law develop. We will change the “Last updated” date at the top whenever we do. If a change is material, for example a new purpose or a new category of data, we will give you notice by email or on the website before it takes effect and, where the law requires it, ask for your consent.
17Contact us
For questions about this policy or your personal data:
- Email: [email protected]
Our Terms of Service explain the rules for using the Services.