Privacy Policy

Last updated: 14 July 2026

VerifySignal is operated by Rigel Rise (“VerifySignal”, “we”, “us”). This Privacy Policy explains what personal data we collect through this website and when you unlock the runtime, why we collect it, and the rights you have over it. We are the data controller for the processing described here.

The runtime runs on your machine

This is the most important thing to understand about VerifySignal, and it is a property of the architecture rather than a promise about our conduct. Validations execute on your infrastructure and your CI. We host no execution, and the deterministic runtime itself makes no network calls. The free CLI around it does check in with us — to exchange your unlock token, silently renew your entitlement receipt, download runtime updates, and send the minimal usage ping described below — and none of those calls ever carry your tested application, code, evidence, or credentials.

That means we never receive the application you test, its pages or DOM, the screenshots and network logs the runtime records, or your credentials — evidence stays in your repository, on your disk. Credential values resolve from your environment at run time. Declared secrets and known token shapes are redacted from text evidence (reports, logs, console, and network capture), and a run that would persist a residual secret in that text fails closed and the leaking artifact is quarantined. Screenshots mask password fields and every field a declared credential was typed into, and the page content behind each screenshot is scanned — a token-shaped leak rendered on screen fails the run. Trace and video recording are refused while declared secrets are present unless you explicitly opt in (they embed typed values and cannot be sanitized), and that consent is recorded visibly in the run verdict. The crystallized fixture is stricter still: if it cannot be sealed without a leak, it refuses and writes nothing.

This policy therefore covers only the data you share with us directly — through this website and when you request a runtime unlock.

Information we collect

• Email sign-ups. When you submit your email we store the address along with the locale, which page and call-to-action it came from, the landing path, the referrer, and any campaign or UTM parameters in the link you followed.
• Runtime entitlement. When you request or purchase an unlock we store the email address the entitlement is issued to, a hash of the unlock token (never the token itself), the platform and version of the client that downloads the runtime, and a record of download events.
• Abuse controls. To rate-limit unlock requests we store an HMAC hash of your IP address, email, and email domain. Your IP address is never stored in raw form, and our audit records keep only hashes.
• Payment. Purchases are handled by Stripe, which collects your billing address to calculate tax. We receive the email address associated with the purchase. We never see or store your card details.
• CLI usage ping. When you run a validation with the free CLI, it sends us a minimal, fire-and-forget beacon: the command (run or check), its outcome, your platform, and the CLI version — never your tested application, project content, DOM, evidence, screenshots, or credentials. When a valid entitlement receipt is present, the ping is attributed to its pseudonymous subject (a hash we derive from your email; the ping itself carries no email). We use it to understand engagement with the free product. It never blocks or fails a run — offline is fine — and you can disable it at any time with VERIFYSIGNAL_USAGE_PING=0. Silent entitlement-receipt renewals are recorded the same pseudonymous way.
• Technical data. Our hosting provider processes standard server logs (such as IP address, browser type, and timestamps) to deliver and secure the site.
• Usage analytics (only with your consent). With your consent, Google Analytics and PostHog collect information about how you interact with the site — pages viewed, approximate location, device and browser, and anonymized usage patterns. PostHog is hosted in the EU, may record a replay of your session with all form inputs masked, and does not load at all until you accept. Google Analytics runs under Google Consent Mode with advertising storage denied and IP anonymization on. Decline and no analytics cookies are set.

How we use your data

• To deliver your entitlement and unlock token, and to support you as a customer.
• To process your purchase and meet our tax and accounting obligations.
• To protect the entitlement service from abuse.
• To communicate with you about VerifySignal where you have asked us to or where we have a legitimate interest.
• To operate, secure, and improve this website.

Legal basis (GDPR)

Where the GDPR applies, we rely on: performance of a contract to deliver the entitlement and license you purchased; your consent for analytics and for marketing email; our legitimate interest in securing the service against abuse and in running our business; and legal obligation for tax and accounting records. You may withdraw consent at any time.

Sharing and processors

We do not sell your personal data. We share it only with service providers that help us operate the service: Supabase (database and private artifact storage), Stripe (payments), Resend (delivering entitlement and confirmation emails), and — only where you have consented to analytics — Google (Google Analytics) and PostHog (hosted in the EU). These providers act on our instructions under appropriate agreements.

Data retention

Unlock tokens expire 30 days after they are issued. Email and lead records from free or public sign-ups are kept for no more than 180 days after that token expires, unless you become a customer or ask us to delete them sooner. Records tied to a purchase are kept as long as we need them to honour your perpetual license and to meet our accounting obligations.

Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data; object to or restrict its processing; and request a portable copy. To exercise any of these rights, contact us at the address below. You also have the right to lodge a complaint with your local data-protection authority.

Cookies and analytics

Cookies strictly necessary for the site to function may always be set, including the cookie that remembers your consent choice for 180 days. Beyond those, we use Google Analytics and PostHog to measure usage and improve the site. PostHog loads only after you accept (including its masked session recording); Google Analytics uses Google Consent Mode, storing analytics data only after you accept. Decline and no analytics cookies are set. We do not use advertising cookies. You can change or withdraw your choice at any time via “Cookie settings” in the footer, which reopens the banner.

International transfers

Where data is transferred outside your region, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Changes

We may update this policy from time to time. The “last updated” date above reflects the latest version.

Contact

For any privacy question or request, email thiago@rigelrise.io.