Privacy Policy

Veridex is a browser extension that warns you about phishing and scam emails in Gmail and Outlook on the web. It has two states:

• Without AI protection. Veridex does not analyze your email. The extension icon stays grey and no email content is read or sent. This is how Veridex works until you turn on AI protection. The extension still sends a small amount of technical data, described under “Without AI Protection” below.
• AI protection. Requires that you sign in and give explicit consent. Each email you open is then sent to Veridex servers and analyzed by Veridex AI. You can withdraw your consent at any time, and Veridex goes back to not analyzing your email.

Veridex is advisory only. It never blocks, quarantines, or deletes email; it shows you a risk indicator and you decide what to do.

Veridex never stores email bodies on its servers. Veridex does not sell your data and does not show advertising.

Until you sign in and consent to AI protection, Veridex does not analyze your email, and no email content leaves your device. Veridex has no on-device verdict mode: the icon is grey and shows no risk result.

Even before you sign in, the extension does the following:

• Creates a random device ID when you install it.
• Sends the device ID and the extension version to Veridex when it is installed and each time it starts.
• Logs an event to Veridex each time a risk indicator is shown in Gmail.

None of this includes email content. The Enable Veridex toggle in the extension stops scanning and stops these events.

The extension keeps the following in your browser's local extension storage:

• Settings and your consent record (whether you agreed to AI protection, when, and under which version of the consent text).
• A capped sender history: sender addresses, sender domains, sender display names, and which of your addresses a sender wrote to, with how often and when last seen. It is limited to 1,000 senders, 500 domains, 500 display names and 1,000 sender-recipient pairs; the oldest entries are removed when a limit is reached.
• Your account email and sign-in session, cached so you stay signed in.
• Housekeeping data: the random device ID described above, usage counts, identifiers of email threads already checked, and a short activity log (up to 50 entries with the risk level and detection types, no email content).

Uninstalling the extension removes this local data. Data already sent to Veridex is covered under Retention and Deleting Your Data.

AI protection requires that you sign in and give explicit consent. You can withdraw consent at any time in the extension (Account → Privacy). Without it, Veridex does not analyze your email.

When AI protection is on, each email you open in Gmail or Outlook on the web is sent to Veridex servers and analyzed by Veridex AI (which uses OpenAI, see Service Providers) to set its risk indicator. This includes:

• the subject;
• the sender's name and email address;
• the body, truncated to 3,000 characters;
• Gmail only: up to 2 short snippets of earlier messages in the same thread, each with its sender and date.

The links in the email are also sent to Veridex servers. Veridex checks them (with query strings removed) and their hosts against abuse.ch URLhaus, a public malware URL list. Links are not part of the text sent to OpenAI for this badge.

Full analysis is part of AI protection and runs only when you ask for it. When you click Analyze on an email, the extension sends the following to Veridex servers:

• subject and body (up to about 8,000 characters of the body);
• sender address and display name;
• recipients and reply-to;
• the date;
• the links in the email;
• up to 10 earlier messages from the same thread.

Veridex sends the email content to OpenAI for analysis. The version sent to OpenAI contains the subject, body, sender address and name, date, links with query strings removed, earlier thread messages, and the reply-to domain (not the full reply-to address). Recipient addresses are not included in the OpenAI request.

Other lookups made during a full analysis:

• abuse.ch URLhaus: the links (query strings removed) and their hosts.
• rdap.org / IANA: the sender's domain, to look up how long ago the domain was registered. Veridex uses IANA's RDAP bootstrap data to find the registry's RDAP server for the domain, and falls back to rdap.org.
• DNS: the sender's domain, to look up its SPF and DMARC records.

If you use chat to ask questions about an analyzed email, your messages and the analysis context (the subject, the sender's domain, the verdict, and Veridex's reasoning and advice) are sent to OpenAI.

Veridex does not store chat content. Veridex logs only technical counts such as the number of turns and the length of messages, together with a hashed device identifier.

• Flagged emails. When a full analysis of an email comes back suspicious or malicious (a yellow or red result), Veridex saves the sender address, the subject, Veridex's analysis (which may summarize the email, for example the reasons and advice shown to you), and the hosts of flagged links. These are deleted 90 days after they are first saved.
• Your sender lists: the senders you have blocked or trusted.
• Technical metadata for every full analysis: a device identifier, the verdict, risk level and risk score, the attack type, the IDs of the detection rules that fired, the sender, reply-to and link domains, timing, the file types of attachments (extensions only), the email client (Gmail or Outlook), the extension version, and your response to the result. It does not contain subjects, bodies or full email addresses. It is kept until your account is deleted.
• Device records: the device ID and extension version the extension sends, and the events it logs when a risk indicator is shown (see Without AI Protection).
• Your consent records: whether and when you agreed to or withdrew AI protection, and under which version of the consent text.
• Account basics: your account, plan, organization membership and usage counts, used to run the service and apply plan limits.

When Veridex flags an email, it records what you did (for example dismissed it, overrode the verdict, blocked the sender, abandoned it or proceeded), how long you took to decide, and whether you overrode Veridex's verdict. This is linked to your account.

If you belong to an organization on Veridex, its administrators can see, for each email Veridex flagged for you: the sender domain, the verdict, the risk level, the date, the detection flags, the action you took and the time you took to decide. They do not see the sender's email address, the subject or the email body.

Veridex does not use your email content, chat messages, or analyses to train AI models.

Veridex uses these providers to run the service:

• OpenAI: AI service provider for analysis, classification and chat. OpenAI privacy policy
• Vercel: website hosting and website analytics.
• Render: backend hosting.
• Clerk: authentication and account data.
• Stripe: billing.
• abuse.ch URLhaus: link reputation.
• rdap.org / IANA: public domain registration data (RDAP).
• DNS: public DNS lookups for a sender domain's SPF and DMARC records.

Veridex does not sell your data and does not use it for advertising.

This section covers veridexhq.com, not the extension.

• Vercel Analytics: counts page views so we can see how the website is used. Vercel also hosts the website.
• veridex-region cookie: set when you first visit, based on your country, so we can show you country-specific content such as local statistics and pricing. It holds only a region code (ae or intl) and expires after 30 days.
• Clerk session cookies: if you sign in on the website (sign-in, welcome, dashboard and organization pages), Clerk sets cookies that keep you signed in.
• Browser storage: the dashboard reads a device_token value in your browser's local storage to link your extension's device ID to your account, and stores veridex_linked_user_id so it does not link the same device twice. During extension sign-in, the website temporarily keeps the extension's return address in session storage (veridex_ext_redirect_uri) and clears it when sign-in finishes.

Veridex does not use advertising cookies.

• Flagged-email analyses (sender address, subject, analysis and flagged link hosts): 90 days from when they are first saved.
• Technical metadata for every full analysis: until your account is deleted.
• Other account data (sender block and trust lists, consent records, usage counts, device records and your account): until your account is deleted.
• Billing records: held by Stripe, under Stripe's own retention rules.

To delete your data, email support@veridexhq.com. We complete deletion within 30 days.

Deletion covers everything Veridex stores about you: flagged-email analyses, technical metadata, sender block and trust lists, consent records, usage counts, device records and your account. Billing records are held by Stripe, so Stripe's retention rules apply to them.

To remove the data stored in your browser, uninstall the extension.

The Veridex extension asks for exactly these permissions and nothing else.

Permissions

• storage: keeps your settings, consent record, sender history and sign-in session in your browser.
• scripting: lets the side panel run the extension's email-reading code in your open Gmail or Outlook tab.
• sidePanel: shows Veridex in Chrome's side panel when you click the toolbar icon.

Host permissions

• https://mail.google.com/*: reads emails you open in Gmail.
• https://outlook.office.com/*: reads emails you open in Outlook on the web.
• https://outlook.live.com/*: reads emails you open in Outlook.com.
• https://api.veridexhq.com/*: talks to Veridex servers for device registration and usage events, sign-in, consent, AI protection, analysis and chat.

Veridex's use of information received from Google APIs and Chrome extension data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Veridex is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, please contact us.

If we change how Veridex handles data, we will update this page and its “Last updated” date. If the AI protection consent text changes in a material way, the extension will ask for your consent again.

Privacy questions and deletion requests: support@veridexhq.com