Privacy Policy

1. Who we are

Vrrdict is a risk-intelligence and decision-support service operated by Cretum Inc., a Mini Parakeet, LLC company (“Cretum,” “we,” “us”). This policy covers the Vrrdict website at vrrdict.com, the Vrrdict app, and the Vrrdict API (together, “the Service”). Cretum’s corporate website has its own privacy policy at cretum.ai.

2. Information we collect

We collect the following categories of information:

• Account information. Your email address and sign-in identity, provided through our authentication provider (Clerk).
• Phone number. If you opt in to SMS alerts, the mobile phone number you provide and verify. We use it only to send the text alerts you request.
• Events. The name, location (both the text you enter and the resolved coordinates and ZIP code), and schedule for each event you create.
• Rules. The decision rules you write or configure to govern your events.
• Verdicts and outcomes. The verdicts the Service generates for your events, and any outcomes you report.
• Watch subscribers. The email addresses of people who subscribe to watch a shared verdict page.
• Usage, device, and log data. Standard technical information including IP addresses, browser type, pages visited, and timestamps.

3. How we use information

We use the information we collect to:

• Provide and operate the Service, including generating verdicts for your events.
• Send transactional emails, watch notifications, and outcome reminder emails.
• Send SMS verdict-change alerts to your mobile number, if you opt in.
• Improve the product and understand how it is used.
• Maintain the security of the Service and prevent fraud.

4. AI processing

When you write a rule in plain language, we send that text — together with the event type and the available decision options — to our AI provider (Anthropic) to translate it into structured criteria. Your verdict is then calculated by our own software using fixed logic; no AI decides your verdict.

Data sent to Anthropic for rule parsing is not used to train third-party public models. Anthropic’s data handling practices are governed by its own terms and privacy policy.

5. How information is shared

We share information only with the following categories of recipients and for the purposes described:

Service providers (sub-processors). We use the following providers to operate the Service:

• Clerk — sign-in and identity management
• Neon — database hosting
• Vercel — application hosting and deployment
• Anthropic — AI rule parsing (see Section 4)
• Resend — transactional and notification email delivery
• Twilio — SMS delivery and mobile-number verification (used only if you opt in to SMS alerts)
• Upstash — rate limiting
• Sentry — error monitoring
• PostHog — product analytics
• Axiom — application logging
• Mapbox — geocoding (your event location is sent to resolve coordinates)
• National Weather Service (NWS/NOAA) & AirNow (EPA) — weather and air-quality data (your event location is sent to these public APIs to retrieve relevant signals)

Legal and safety disclosures. We may disclose information if required by law, legal process, or to protect the safety of our users or the public.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Our analytics provider (PostHog) is first-party and is not used for advertising.

6. Public verdict pages

The event name you choose appears publicly — in the page title, the share card, and the page’s web address (slug). Do not include information you want kept private, such as a home address or another person’s full name, in an event name.

A shared verdict page shows a city-level location and the verdict with a rule-free signal summary. We do not expose your precise location, your account identity, or your underlying rules and reasoning, unless you opt in via your sharing settings.

7. Cookies & tracking

We use cookies and similar technologies in the following ways:

• Clerk sets essential cookies required to maintain your authenticated session. These cannot be disabled without losing access to your account.
• PostHog sets first-party analytics cookies to help us understand how the Service is used. You can opt out of analytics tracking using PostHog’s opt-out mechanism.

Visitors from the EU and UK will see a cookie consent banner before non-essential cookies are set.

8. Email & SMS communications

We send the following types of email communications:

• Transactional emails about your account and the events you create (for example, verdict updates or schedule reminders).
• Watch notifications to people who subscribe to a shared verdict page. Subscribers receive a one-click unsubscribe link in every message. We store only their email address, the verdict slug they subscribed to, and an unsubscribe token — nothing more.
• Outcome reminders sent to the event’s creator. These are tied to an event you created, are self-limiting (at most two reminders per event, then they stop), and are not marketing communications.
• SMS verdict alerts to users who opt in from account settings and verify their mobile number. These are transactional alerts about your own events’ verdict changes — not marketing. Message frequency varies with your events, and message and data rates may apply. Reply STOP to unsubscribe at any time or HELP for help, or turn SMS off in your settings.

We do not sell or share your mobile phone number or SMS opt-in information with third parties, and we do not use it for any purpose other than delivering the alerts you request. See our SMS Messaging Program for full details.

9. Data retention & deletion

You can delete individual events at any time. To delete your account and the personal data associated with it, email privacy@vrrdict.com; we will delete or de-identify your personal data within 30 days of a verified request, except for records we are required to keep, which we de-identify.

Operational logs are retained for approximately 90 days. Product analytics data is retained for approximately 24 months, after which it is de-identified or deleted.

If you opt in to SMS, we keep your verified phone number until you remove it, reply STOP, or delete your account, after which it is deleted or de-identified.

10. Your rights & choices

You have the right to access, correct, or delete the personal information we hold about you. Visitors from the EU and UK have additional rights under the GDPR, including the right to object to or restrict processing and the right to data portability. California residents have rights under the CCPA/CPRA, including the right to know, the right to delete, and the right to correct personal information. We keep records required by GDPR Article 30.

To exercise any of these rights, email privacy@vrrdict.com. We will respond within the timeframe required by applicable law.

11. Children’s privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at privacy@vrrdict.com and we will delete it promptly.

12. Aggregate & de-identified data

We build de-identified, aggregated benchmarks and indices, and we never sell raw, user-level rows.

13. Security

We use reasonable administrative, technical, and physical safeguards to protect your information. No transmission over the internet is completely secure, and we cannot guarantee absolute security. If you become aware of a security concern, please report it to security@vrrdict.com.

14. International users

The Service is operated from the United States. If you access the Service from outside the United States, you understand that your information is processed and stored in the United States, where data protection laws may differ from those in your country.

15. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page reflects the date of the most recent version. If we make material changes, we will notify you by email or by posting a prominent notice on the Service before the changes take effect. Continued use of the Service after an update constitutes your acceptance of the revised policy.

16. Contact

If you have questions, concerns, or requests regarding this policy or our handling of your personal information, please contact us at privacy@vrrdict.com.