Verno AI Privacy Notice
Last updated: October 13, 2026
Verno AI, Inc. ("Verno", "we") builds software that helps engineering teams draft, check and coordinate piping and instrumentation diagrams (P&IDs) and related engineering documents. This notice explains what personal information we collect, why, who we share it with, and the choices and rights you have.
Who is responsible
The person responsible for the protection of personal information at Verno is Ujjawal Madan, CTO. Contact: security@verno-ai.com.
This website
When you submit a demo or contact request on this website, we collect your name, company, work email, and any message you choose to include. We use Cloudflare Turnstile to verify that submissions come from humans. With the request we also record the website that referred you and the first page you visited, so we know how people find us. That is held in your browser tab for that visit only, and no cookies are used. We use this information only to respond to your request and follow up about Verno. If you use the privacy request form below, we collect your name, email, optionally your company, the type of request and the details you give, and use them only to verify and answer your request.
What we collect
- Account information: name, work email address, company and role for people our customers give access to Verno.
- Usage and audit records: what you do in the product (for example, which documents you opened, markups you made, changes you approved), with timestamps. We keep these because our customers need a traceable record of changes to their drawings.
- Customer documents: engineering drawings and files our customers upload. These are our customers' data. They can incidentally contain personal information such as engineers' names or initials in title blocks.
- Business communications: emails, messages and, with your agreement, notes or recordings of meetings with us.
- Technical information: IP address, device and app version, and error logs, used to keep the service secure and working.
We do not collect payment card data, government ID numbers or health information, and we do not sell personal information.
Why we use it
- To provide, secure and support the service our customers contract for.
- To keep an audit record of changes, as our customers require.
- To communicate with customers and prospective customers.
- To meet legal, security and compliance obligations.
We do not use customer documents or personal information to train AI models.
Who we share it with
We use a small number of service providers, under contract, to run Verno:
| Provider | Purpose | Where |
|---|---|---|
| Amazon Web Services | Hosting and storage | The region agreed with each customer (for example, Canada) |
| Amazon Bedrock (Anthropic Claude models) | AI processing of requests | United States |
| Google Workspace | Email and documents | United States / global |
| Slack | Internal communication (no customer drawings) | United States |
| Granola, Wispr Flow | Meeting and dictation notes (model training turned off) | United States |
| GitHub | Source code (no customer data) | United States |
| Notion | Internal documentation and staff records | United States |
| 1Password | Credential storage | United States |
| Lovable | Our public website and its contact and privacy request forms | United States |
| Comp AI | Security compliance management | United States |
We may also disclose information if required by law.
Where information is stored and processed
Each customer's documents and account data are stored in a dedicated cloud environment, in the region agreed with that customer (for example, Canada for our Canadian customers). When you use Verno's AI features, the relevant part of a request (for example, a drawing excerpt and your instruction) is processed in the United States by Amazon Bedrock. Bedrock does not store these requests or use them to train models. Information processed outside Quebec or Canada may be subject to the laws of that jurisdiction. We assess these transfers before making them and protect them by contract and encryption. Each customer approves where its data is stored and processed before we begin.
How long we keep it
- Customer documents and account data: for the term of the customer's contract, then deleted within 30 days of it ending, unless the contract says otherwise.
- Audit records: for the life of the document they describe, then deleted with it.
- Application logs: 1 year. Security audit logs (AWS CloudTrail) are kept indefinitely: archived to colder storage after 90 days and not deleted.
How we protect it
Encryption in transit and at rest, multi-factor authentication for everyone with access, access limited to the people who need it and reviewed quarterly, separate environments for each customer, and continuous security monitoring. We are working toward SOC 2 Type II and ISO 27001.
Your rights
Depending on where you live (including under Canada's PIPEDA and Quebec's Law 25), you can ask to access, correct or delete your personal information, ask how it is used, withdraw consent, and receive your information in a portable format. Use the request form below or email security@verno-ai.com; we reply within 30 days. If your information is in a document a customer uploaded, we will work with that customer to respond.
You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
Incidents
If a security incident involving your personal information creates a risk of serious harm, we will notify you, our customer, and the relevant regulators as the law requires.
Changes
We will post any changes to this notice here and update the date above.
Make a privacy request
Use this form to ask to access, correct, delete or port your information, or to withdraw consent. It goes to security@verno-ai.com.