Skip to main content

Privacy notice

Last updated 26 September 2026

This notice covers this website and the connectivity audit request form on it. It is written in plain English on purpose. If anything here is unclear, ask us and we will explain it.

Who is responsible

VEREA is a project of Naranjo Cloud LTD, a company registered in Cyprus under number HE477975. Naranjo Cloud LTD operates this site, is the controller of the personal data described here and is referred to in this notice as ‘we’. You can reach us at:

What we collect

We collect what you type into the connectivity audit request form, and the contents and headers of any email you send to hello@verea.dev. The form asks for:

  • Your company name and your role.
  • Your work email address.
  • The connectivity providers you use today, if you choose to tell us.
  • An approximate range for the number of active connections you run.
  • The institutions and countries that matter to your product.
  • A description of the connectivity problem you want looked at.
  • Confirmation that you have read this notice.

Required fields are needed to prepare the audit. You are not legally obliged to provide them, but the form cannot be sent without them; you can write to us by email instead.

The form contains one hidden field that a person never sees and never fills in. It exists to catch automated submissions: a submission with it filled in is discarded without being sent to anyone.

We do not ask for credentials, production access, end-user data, or any information about your customers. Do not send us any.

When you visit the site

To deliver a page or a form submission, the servers that answer the request necessarily process your IP address and the request your browser sends. We have not switched on access logs for either, so we keep no record of visits. This site sets no cookies, runs no analytics and loads no third-party scripts. If we later add privacy-preserving, cookieless analytics, this notice will say so before it is switched on.

Why we use it and on what basis

We use what you send us to respond to your audit request, to prepare and discuss the audit, and to discuss a possible engagement with your company. We use request data only to deliver the site and the form, and to limit abuse of the form. We do not sell your data, share it for marketing, or add you to a mailing list you did not ask for.

The legal basis is our legitimate interest (Article 6(1)(f) GDPR): responding to the audit request you sent and discussing a possible engagement with your company, and, for request data, delivering the site you asked to load and limiting abuse of the form. The checkbox on the form confirms that you have read this notice; we do not rely on consent.

Who handles it

Cris Naranjo, our founder, reads it. Amazon Web Services processes it on our behalf: AWS Lambda runs the form endpoint in the EU (Ireland, eu-west-1), Amazon SES sends form submissions and receives email to hello@verea.dev in the same region, and Amazon CloudFront delivers pages through AWS edge locations. Form submissions are emailed straight to our mailbox. Email to hello@verea.dev is stored in Amazon S3 and, unless it fails spam or virus checks, forwarded to the same mailbox. The mailbox is on our Google Workspace account, provided by Google.

Transfers outside the EEA

AWS handles the form and email in the EU (Ireland). Pages are delivered through CloudFront edge locations, some of them outside the EEA, so your IP address and request may be processed there. AWS is part of a US group; where AWS transfers personal data outside the EEA, it relies on the EU-US Data Privacy Framework (Commission adequacy decision (EU) 2023/1795), under which Amazon.com, Inc. is certified, and on the Standard Contractual Clauses in its data processing addendum.

Google may process our mailbox outside the EEA, including in the United States. Google LLC is certified under the EU-US Data Privacy Framework.

How long we keep it

  • Form submissions and correspondence in our mailbox are kept for 12 months after our last exchange, then deleted.
  • Email to hello@verea.dev is deleted from Amazon S3 automatically after 90 days.
  • To limit abuse of the form, we keep a keyed hash of your IP address, not the address itself, in Amazon DynamoDB in Ireland when you send it. The hash expires within an hour and is then deleted automatically, typically within a few days.
  • Server logs record errors, not the contents of the form, and are kept for 30 days.

You can ask us to delete it sooner and we will.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or ask us to restrict what we do with it. We make no automated decisions about you. Write to hello@verea.dev and we will answer.

Your right to object

Because we rely on legitimate interest, you can object at any time, on grounds relating to your particular situation, to our use of your data. Write to hello@verea.dev and we will stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.

Complaints

You can complain to the Office of the Commissioner for Personal Data Protection in Cyprus: Kypranoros 15, 1061 Nicosia; postal address P.O. Box 23378, 1682 Nicosia;commissioner@dataprotection.gov.cy;www.gov.cy/dataprotection/en/contact. You can also complain to the data protection authority in the EU or EEA country where you live or work, or, in the United Kingdom, to the Information Commissioner’s Office.

Changes

When this notice changes, the date at the top changes with it.