Privacy Policy

Verdict is operated by Therefore Design ("we", "us", "Therefore"), a brand and packaging design studio based in Mumbai, India. For privacy questions write to info@thereforedesign.co.in.

When you sign in via Google we receive your name, email address, and profile picture from Google. We do not see or store your Google password.

When you use the Service we collect: packaging artwork you upload, project metadata you enter (brand name, category, audience notes, competitor references), audit results we generate on your behalf, and a transcript of your audit credit transactions.

When you contact support we store the message, your email, your IP address (used for spam rate-limiting), and the user-agent of your browser.

When you make a payment we receive transaction metadata from Razorpay — order ID, payment ID, amount, currency, payment method type, and status. We do NOT receive or store your full card number, CVV, UPI PIN, or bank login credentials. Card data is held by Razorpay under PCI-DSS compliance.

We use your data to: (a) provide the Service — generating audits, running comparisons, exporting PDFs; (b) process payments and maintain billing records; (c) communicate transactional messages (receipts, alerts, approval emails); (d) improve product quality by reviewing aggregate, anonymised usage signals; (e) comply with applicable Indian tax, accounting, and audit law.

We do not sell your data. We do not use your uploaded artwork to train AI models.

We share necessary data with the following sub-processors, each acting on our instructions:

• Google Cloud — sign-in (OAuth) and the Gmail API used for sending transactional email. • Google Analytics 4 — aggregate, anonymous usage measurement (loaded only after explicit consent; see section 7). • Anthropic, Google AI, and OpenAI — for LLM-powered audit generation. Artwork and project metadata are sent to these providers strictly to generate your audit response. Per their API terms (Anthropic, Google AI Platform, OpenAI API), API inputs are NOT used by them to train their general models. • Emergent Labs — provides the universal LLM gateway used to route requests to the providers above. • Razorpay — payments and reconciliation. • MongoDB Atlas / hosted MongoDB — database storage.

We sign written agreements with these processors where required and review them periodically.

We retain account data, audits, and project metadata for as long as your account is active and for up to 12 months after account deletion to enable reactivation. Razorpay transaction metadata is retained for 8 years to comply with Indian tax law. Support submissions are retained for 24 months.

You can request deletion of your account and associated data at any time by writing to info@thereforedesign.co.in. Required-by-law records (e.g., tax-relevant transaction metadata) cannot be deleted before the statutory period expires.

Subject to applicable Indian data-protection law (including the Digital Personal Data Protection Act, 2023), you have the right to:

• Access — request a copy of the personal data we hold about you. • Correction — ask us to fix inaccurate data. • Erasure — ask us to delete data we hold about you, subject to retention obligations. • Withdraw consent — disconnect a connected Gmail account at any time from Settings; revoke the Google sign-in at https://myaccount.google.com/permissions. • Grievance redressal — write to our Grievance Officer at info@thereforedesign.co.in.

We aim to respond to rights requests within 30 days.

We use a single HTTP-only session cookie ("session_token") to keep you signed in. We also store the same token in your browser's localStorage as a fallback for browser configurations that block cookies.

We use Google Analytics 4 (GA4) to measure aggregate, anonymised usage of the Service — page views, session length, browser/device class, and entry/exit pages. GA4 is only loaded after you explicitly accept the cookie-consent banner shown on first visit; if you decline, no Google analytics script is loaded at all and no GA cookies are set. We do not push your email, your audit content, or any other personally identifying data to GA. IP addresses are anonymised before being sent. You can change your choice at any time by clearing the `v_analytics_consent` key from this site's local storage.

We do not use third-party advertising cookies. We do not run cross-site tracking pixels.

All data is transmitted over HTTPS. Passwords are not stored — we sign in via Google OAuth. Internal admin operations are gated behind a separate password-protected super-admin login with bcrypt-hashed credentials. We monitor authentication anomalies and rate-limit unauthenticated endpoints.

No system is 100% secure. If you suspect a breach involving your account, write to info@thereforedesign.co.in immediately and we'll investigate within 48 working hours.

The Service is not intended for use by anyone under 18. We do not knowingly collect personal data from minors. If you believe we hold a minor's data, please notify us and we'll remove it.

Our database and primary servers are hosted in India and Singapore. Some of our LLM and email sub-processors are based outside India (United States, EU). Where data is transferred internationally, we rely on the standard contractual protections offered by those processors.

We may revise this Policy from time to time. Material changes will be communicated via email and a banner on the Service at least 14 days before they take effect.

Privacy questions, requests, or complaints? Write to info@thereforedesign.co.in.