Privacy
Privacy notice
ClaimVetta is operated by LIALICHEV VLADYSLAV, an individual entrepreneur / sole proprietor registered in Ukraine.
English is the canonical version of this Privacy Notice. Translations are provided for convenience unless applicable law requires otherwise. If a translation conflicts with the English version, the English version applies to the extent permitted by law.
Scope of this notice
This notice explains how ClaimVetta handles personal data when you visit the website, create or access a case, create an account, buy or use a case analysis, receive a service email, contact support, or appear in material that a user submits. It covers both account users and people using a private guest session. It does not replace Paddle's separate privacy notice for its checkout and payment services.
Who is responsible for your data
The controller for ClaimVetta is LIALICHEV VLADYSLAV (ЛЯЛІЧЕВ ВЛАДИСЛАВ), an individual entrepreneur / sole proprietor registered in Ukraine. ClaimVetta determines why and how the website, account and case data described here are processed. Full statutory identity and address details are kept on the Contact & legal notice page. No data protection officer has been appointed.
Contact and legal detailsPersonal data we process
| Category | What it includes |
|---|---|
| Account and access | Email address, email-verification time, language, optional country, account status, consent records, and hashed session or magic-link tokens. ClaimVetta does not store the readable authentication token in its database. |
| Case and evidence | Country, language, issue description, answers and confirmed facts, receipts, warranty documents, product or defect photos, correspondence, filenames and technical file metadata. These materials may contain information about another person. |
| Generated and inferred data | Text and facts extracted from evidence, missing-information prompts, research sources and context, analysis runs, generated reports and correspondence drafts, status, error state, and measured AI usage and cost metadata. |
| Purchase data | Paddle transaction and customer identifiers, purchase email supplied by Paddle, product and case-analysis allocation, currency, subtotal, tax, total, fees, earnings, payment status, refund or dispute state, and event timestamps. We also record when our server receives your checkout request after you select the purchase button, the Terms, Refund Policy and notice versions, the language of the notice and page, and where you started checkout. ClaimVetta does not receive or store your full card number or card security code. |
| Communications | Email address, message content, case or transaction identifier you provide, service-email delivery status, and the provider message identifier needed to deliver or troubleshoot a message. |
| Device and security data | IP address and limited request, browser, session, timestamp, rate-limit, diagnostic and security information needed to deliver the service, resist abuse and investigate failures. Authentication and rate-limit identifiers are hashed where the service design permits. |
| Optional analytics | Only after consent: a pseudonymous visitor or internal account identifier, sanitized page route, country and language, campaign parameters, case or purchase status, pseudonymous case ID, evidence category and count, pack code, and actions such as opening checkout or completing an analysis. We do not send PostHog your email, issue description, document content, filename or generated letter. |
Please minimise sensitive and third-party data
Upload only what is reasonably necessary for the warranty matter. Redact full payment-card or bank details, government identification numbers, passwords, account credentials, unrelated health information, children's information and other sensitive details. Do not upload information about another person unless you have a lawful reason and authority to use it for this purpose. ClaimVetta does not need full card details to provide the service.
Why we process data and our legal bases
| Purpose | Main data | Legal basis where GDPR-style rules apply |
|---|---|---|
| Provide the service | Account, access, case, evidence, generated output and essential service-email data. | Steps requested before a contract and performance of the service contract. |
| Secure and operate ClaimVetta | Sessions, IP and request data, rate-limit records, diagnostics, errors and audit identifiers. | Legitimate interests in availability, fraud prevention, abuse prevention, debugging and protection of users; and legal obligations where applicable. |
| Fulfil and reconcile purchases | Paddle transaction metadata, entitlements, purchase agreement record, tax and accounting records, refunds and disputes. | Contract performance, legal obligations, and legitimate interests in accurate fulfilment, fraud prevention and legal claims. |
| Support and legal requests | Contact details, communications, case or transaction identifiers, and relevant service records. | Contract performance, legal obligations, and legitimate interests in resolving requests and establishing or defending legal claims. |
| Optional product analytics | The limited pseudonymous event data described above. | Consent. Analytics stays off until you allow it and future collection stops when you withdraw consent. |
The exact legal label may differ by country. Where consent is the required basis, we ask for consent. Where law requires processing or information is necessary to provide a feature you requested, declining to provide it may mean that feature cannot be supplied.
AI processing and OpenAI
ClaimVetta uses the OpenAI API to extract information from submitted evidence, identify missing facts, research relevant public sources and generate an informational analysis and draft correspondence. OpenAI processes this data for ClaimVetta as an API service provider. ClaimVetta configures Responses API requests not to store separate response application state.
- Depending on the case, OpenAI receives the issue description, images or PDF evidence, extracted or confirmed facts, relevant country and product context, public research material and instructions needed to produce the requested output.
- OpenAI states that API data is not used to train or improve its models unless the API customer explicitly opts in. ClaimVetta does not authorise case data for model training.
- OpenAI may retain API customer content in abuse-monitoring logs for up to 30 days by default, or longer where law or protection from harm requires it. Approved special retention controls may differ. Image and file inputs are also subject to OpenAI's safety scanning and exceptional review rules.
- The model creates informational output; it does not make a decision that itself produces a legal or similarly significant effect on you. ClaimVetta does not provide human professional review by default. You decide whether and how to use the output and should verify important facts, sources and deadlines.
Payments and Paddle's separate role
Paddle is the authorised reseller and Merchant of Record for a ClaimVetta purchase. Paddle collects and controls the checkout, payment method, tax, fraud-screening and receipt data under its own buyer terms and privacy notice. Paddle shares limited buyer and transaction data with ClaimVetta so we can fulfil a purchase, provide support, prevent fraud and reconcile refunds or disputes. ClaimVetta does not use Paddle buyer data for unrelated marketing without a separate lawful basis.
Who receives data
We disclose only the data reasonably needed for the relevant function. The principal recipients and processors are:
- Amazon Web Services (AWS) stores uploaded files and encrypted backups in Frankfurt, Germany.
- Cloudflare routes and protects website traffic, including IP addresses, request metadata and data you submit through the site.
- OpenAI for evidence extraction, source research and generation of the requested analysis and drafts.
- Resend (Plus Five Five, Inc.) delivers transactional sign-in, case-status and withdrawal-receipt emails. Email address, message content and delivery metadata are sent to Resend.
- PostHog Cloud EU for optional, consent-based product analytics. Session recording and automatic interaction capture are disabled in ClaimVetta.
- Hetzner Online GmbH hosts the ClaimVetta application and databases in Germany.
- Professional advisers, competent authorities, courts, transaction parties or other recipients where disclosure is required by law, necessary to protect rights or safety, or needed for a genuine business reorganisation subject to appropriate safeguards.
ClaimVetta does not sell personal data, does not use it for behavioural advertising and does not share it for cross-context behavioural advertising. If applicable law gives those words a broader technical meaning, you may send an opt-out request and we will assess it under that law.
International processing and safeguards
ClaimVetta is operated from Ukraine. The application and databases are hosted in Germany, and uploaded files and encrypted backups are stored with AWS in Frankfurt, Germany. Optional PostHog analytics are hosted in Frankfurt. Cloudflare processes website traffic through its global network. OpenAI, Resend and Paddle may process relevant data in the United States and other countries described in their notices. Where data is transferred outside the EEA and transfer rules apply, the applicable safeguards depend on the recipient and may include an adequacy mechanism or Standard Contractual Clauses under the provider's terms. Contact us for information about the safeguards relevant to your data.
Retention and deletion
We retain different records for different periods. The current criteria are:
| Record | Retention rule |
|---|---|
| Case content and files | Cases that have never had an analysis started are scheduled for deletion 90 days after creation. Once an analysis has started, the case and its files remain available without a fixed expiry while the service is offered, unless you delete them or request erasure. We retain them to provide your continuing case workspace. You can delete a case from its page; this removes its content and uploaded files from active storage. Access sessions still expire for security; sign in again to recover account-linked cases. |
| OpenAI API data | ClaimVetta does not request separate Responses API application-state storage. OpenAI's default abuse-monitoring retention may last up to 30 days, subject to the safety and legal exceptions described above. |
| Account and authentication | Kept while the account is active and afterwards only as reasonably needed for deletion processing, security, disputes and legal duties. Guest and per-case access cookies expire after 30 days. User sessions expire after inactivity and no later than the configured absolute limit, normally 90 days; expiry revokes access but does not itself erase the stored account or session record; deletion requests are handled separately. |
| Purchases and Paddle events | Kept for the period needed to fulfil the purchase and for applicable tax, accounting, fraud, refund, chargeback and legal-claim obligations. These records may be retained after case deletion or account closure where law or transaction integrity requires it. |
| Email and support | Case-notification records follow the related case lifecycle where technically linked. Withdrawal requests, receipts and their handling history are stored separately to process requests and document consumer-rights compliance, and retained only as needed for applicable accounting, disputes and legal-claim periods. Resend and mailbox copies follow their service retention and deletion rules. Support correspondence is kept until resolved and afterwards only while reasonably needed for follow-up, security or legal claims. |
| Analytics | Analytics events are retained under the configured PostHog project retention and reviewed against the need to understand product use. The browser consent choice expires after 180 days. Withdrawing consent stops future collection but does not by itself erase earlier events; request erasure if you want existing identifiable analytics considered for deletion. |
| Security and diagnostics | Kept for the shortest operational period reasonably needed to detect abuse, investigate an incident, maintain audit integrity and establish or defend claims; a relevant record may be isolated for longer when an incident, dispute or legal duty requires it. |
Deletion from active systems may not immediately remove a limited copy from a disaster-recovery backup or a provider's security log. Such copies remain protected, are not restored for ordinary use, and expire under the applicable backup, security or legal cycle.
Cookies and browser storage
Essential technologies provide access, checkout continuity and language choice. Optional PostHog analytics is loaded only after consent. Blocking essential storage can prevent a case, account or checkout from working.
| Technology | Function and duration |
|---|---|
| claimvetta_guest_session | Essential HttpOnly cookie that links this browser to a private guest session; up to 30 days. |
| claimvetta_session | Essential HttpOnly sign-in session cookie; expires at the server-issued session expiry, normally after 30 days of inactivity and no later than 90 days. |
| case_[case ID] | Essential HttpOnly access token for a particular guest case; up to 30 days. The readable token is not stored in ClaimVetta's database. |
| claimvetta_locale_preference | Functional language preference; up to one year. |
| claimvetta:analytics-consent | Local-storage record of whether optional analytics was allowed or declined; up to 180 days. |
| PostHog storage | PostHog local storage and cookies, plus a pseudonymous identity marker, are created only after analytics consent and support attribution and event measurement. Duration follows the applicable PostHog storage item and project configuration. |
| Session storage | Temporary campaign attribution, one-time event markers, checkout idempotency and payment-reconciliation state; cleared when the browser session ends. |
| Paddle Checkout | When you open the Paddle overlay, Paddle may use its own necessary checkout, fraud-prevention and preference technologies under Paddle's privacy and cookie information. |
Your analytics choice
Analytics is optional and off until you select Allow analytics. ClaimVetta respects browser Do Not Track, disables PostHog Session Replay and autocapture, strips query strings and case access tokens from tracked routes, and limits event properties. Use Analytics settings in the footer at any time to allow or stop future analytics. You can use the service after declining.
Your privacy rights
Depending on where you live and subject to lawful exceptions, you may have the following rights:
- Ask whether we process your data and request access to it and relevant processing information.
- Ask us to correct inaccurate data, complete incomplete data, or delete data. You can also delete an individual case directly from its page.
- Ask us to restrict processing or provide data you supplied in a portable form where the applicable law provides those rights.
- Object to processing based on legitimate interests and, where applicable, opt out of sale, sharing, targeted advertising or qualifying profiling. ClaimVetta does not presently conduct those activities.
- Withdraw consent at any time without affecting processing that was lawful before withdrawal.
- Complain to the competent privacy or data-protection authority, including an authority in your habitual residence, workplace or place of the alleged infringement where applicable.
Send a request to the privacy email below. Describe the right and the account, case or transaction involved, but do not send passwords or full card data. We may request proportionate information to verify identity and authority. We will respond within the period required by applicable law, explain any lawful refusal or extension, and provide any required appeal route. Requests are normally free, although manifestly unfounded or excessive requests may be handled as the law permits.
Regional disclosures
The rights above are intended as a global baseline. EEA and UK users receive GDPR-style rights and safeguards; residents of US states, Canada, Australia, New Zealand and other jurisdictions receive additional or different rights where their law applies. ClaimVetta does not discriminate against a user for exercising a privacy right. A statutory right or remedy that cannot lawfully be limited remains unaffected by this notice.
Information about other people
Documents may identify a seller, family member, employee or another person. Submit only the data reasonably needed for the case and share this notice with them where appropriate. For third-party information, we assess the relevant lawful basis separately from our contract with you, including legitimate interests in helping users organise a genuine consumer matter, balanced against that person’s rights. We assess additional safeguards, notice duties and any applicable exceptions; your upload does not remove our responsibilities. Do not submit unnecessary sensitive data. Contact us to request information or raise an objection about data relating to you.
Children
ClaimVetta is intended for adults aged 18 or older and is not directed to children. A parent or legal guardian may use their own access to handle a legitimate warranty matter concerning a minor. Do not create access for a child or submit unnecessary information about a child. Contact us if you believe a child provided personal data directly so we can assess and delete it where appropriate.
How we protect data
ClaimVetta uses measures designed for the nature and risk of the data, including private access tokens stored as hashes, HttpOnly access cookies, encrypted network transport in production, restricted object storage, access controls, request validation, rate limits, signed Paddle webhook verification and separation of optional analytics from case content. No internet service can guarantee absolute security. You are responsible for protecting your mailbox, device and access links and for promptly reporting suspected unauthorised access.
Security incidents
We investigate suspected personal-data incidents, take reasonable containment and remediation steps, and notify affected people and competent authorities when and within the time required by applicable law. Report a suspected exposure through the privacy contact below without including additional sensitive material.
Changes to this notice
We may update this notice when the service, providers, legal requirements or data practices change. The effective date appears at the top. Material changes will be communicated through the service, account or email where appropriate, and fresh consent will be requested when required. An update does not retroactively create a new purpose or legal basis for earlier processing.