Privacy policy

Last updated. 2026-07-06

This page explains what personal data the Verana Foundation (in formation), represented by 2060 OÜ, collects through verana.io, why we collect it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR). verana.io is an informational site: it has no user accounts, and the only personal data you can submit is through the contact form. We do not sell data and do not run ad targeting or remarketing.

Data controller

The Verana Foundation is in formation. Until incorporation, the data controller is 2060 OÜ, Ahtri tn 12, 10151 Tallinn, Estonia (registry 16853041), acting as the Foundation’s steward; thereafter the incorporated Foundation. For privacy matters, use the contact form and begin the message with “Legal:”.

What we collect and why

Contact form

Submissions on /contact (inquiry type, name, email, message, optional organization/role/links) are stored in our self-hosted Relaticle CRM, operated by 2060 OÜ, so we can respond. IP address and user-agent are used only for rate limiting and abuse detection. Legal basis. Our legitimate interest in answering the inquiries you send us (GDPR Art. 6(1)(f)).

Live network widgets

The Resolve-a-DID widget relays the DID you enter to the public Verana network’s trust resolver, through our server, to answer the query. DIDs are public identifiers; we do not store them beyond ordinary hosting logs. The ecosystem listings display public registry data only.

Hosting and security

Hosting logs (IP address, user-agent) serve security and rate limiting only. Legal basis. Our legitimate interest in keeping the site available and abuse-free (Art. 6(1)(f)).

Cookies and analytics

The site itself sets no cookies; your consent choice is kept in your browser’s localStorage. For analytics we use Google Analytics 4 (Google Ireland Ltd.) to measure aggregate page traffic. It is consent-gated: a banner offers Accept all or Essential only, and the Google Analytics tag loads — and its cookies are set — only after you select “Accept all”; choosing “Essential only” (or making no choice) loads nothing. The lawful basis is your consent (Art. 6(1)(a)), which you can withdraw at any time by clearing the stored choice or via the banner’s preferences. IP addresses are anonymized; no ad networks, no cross-site trackers, no selling of data. See the cookie policy.

Processors and where data goes

• Google (Analytics) — Google Analytics 4, only after you consent to analytics. Aggregate traffic measurement; no profile data is shared.
• Our hosting provider (EU) and our self-hosted CRM, operated by 2060 OÜ.

Cross-border transfers rely on an EC adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses as applicable. No third-party marketing platform receives your data.

How long we keep it

• Contact-form correspondence — up to 24 months from the last interaction.
• Spam/abuse logs — up to 30 days.
• Analytics — minimum provider retention; aggregate reports contain no identifiers.

Your rights

Under the GDPR, you may:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data where we have no lawful basis to keep it;
• restrict or object to processing;
• receive a portable copy of the data you gave us;
• withdraw consent at any time — without affecting prior processing;
• lodge a complaint with a supervisory authority — while stewarded by 2060 OÜ, the Estonian Data Protection Inspectorate.

To exercise any right, use the contact form with the message prefixed “Legal:”. We respond within 30 days.

Changes

We update this page when our practices change. The Last updated date reflects the most recent change; prior submissions remain governed by the version in force when they were sent.