Privacy
Policy

Introduction and Scope

Social Shield, Inc., operating under the registered trade name Vero Origin ("Company," "we," "us," or "our"), is committed to protecting the privacy of users of the Vero Origin platform. This Privacy Policy ("Policy") explains how we collect, use, disclose, retain, and protect personal information in connection with the Vero Origin website located at veroorigin.com and all related applications, guides, tools, and services (collectively, the "Service").

This Policy applies to all individuals who access or use the Service, including adult subscribers, parents or guardians accessing the Service on behalf of a minor, and any individual who submits information to us through the waitlist or other contact channels. It does not apply to the practices of third-party platforms, government agencies, or partner organizations to which we may direct you, each of which operates under its own privacy policy.

This Policy is incorporated into our Terms of Service, which contain additional provisions governing your use of the Service, including important limitations on liability, a binding arbitration agreement, and a class action waiver. Capitalized terms used but not defined in this Policy have the meanings given to them in the Terms of Service.

By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described in this Policy, you must not access or use the Service.

Information We Collect

We collect personal information in three ways: information you provide directly, information we collect automatically when you use the Service, and information we receive from third parties. The following table describes each category.

Information You Provide Directly

Information Collected Automatically

When you access or use the Service, we and our service providers may automatically collect the following categories of information:

• Device and technical information: IP address, device type, operating system, browser type and version, device identifiers
• Usage data: pages viewed, features accessed, time and duration of sessions, clickstream data, search queries within the Service
• Location data: approximate geolocation derived from IP address (city or region level only; we do not collect precise GPS location)
• Log data: server logs recording access times, errors, and Service performance metrics
• Cookie and tracking data: as described in Section 11

Information from Third Parties

We may receive information about you from the following third-party sources:

• Payment processors: transaction confirmation, billing address, and payment status (but never full card numbers)
• Analytics providers: aggregated usage and performance data
• Partner organizations: where you have separately consented to information sharing through a partner program
• Law enforcement agencies: in response to legally mandated information requests

We do not purchase personal information from data brokers or marketing list providers.

Sensitive Personal Information

The following categories of sensitive personal information may be collected in connection with your use of the Service. We collect each category only to the extent necessary to provide the Service and do not use or disclose sensitive personal information for any purpose other than those expressly permitted under applicable law and described in this Policy.

Under CCPA/CPRA, you have the right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the Service. Because we only use sensitive personal information to provide the Service — and do not use it for advertising, profiling, or cross-context behavioral tracking — this right is satisfied by our default practices. If you believe we are using your sensitive personal information beyond permitted purposes, please contact privacy@verotakedown.com.

Image Submissions and the No-Storage Promise

Technical Process

When you submit an image through the scan feature, the following process occurs:

1. Hashing. Your device or a secure processing environment converts the image into a SHA-256 or perceptual hash (a mathematical fingerprint unique to the image). This process is one-way — the original image cannot be reconstructed from the hash.
2. Deletion. The original image file is deleted from processing memory before the hash is transmitted. No copy of the original image is retained on Company servers, databases, backup systems, or cloud storage at any point.
3. Hash storage. Only the Fingerprint (hash) is retained on Company systems, for the duration of active scan operations associated with your account.
4. Scan operations. The Fingerprint is compared against hashes of indexed publicly accessible web content. No original image is accessed or retained during this process.
5. Deletion on request. You may request deletion of your Fingerprint at any time by contacting privacy@verotakedown.com. Upon verified request, your Fingerprint will be deleted from all active systems within thirty (30) days, except where retention is required by law or active legal process.

What This Means for You

The Fingerprint is not an intimate image and cannot be used to reproduce, view, or identify any depicted individual. It is a string of characters with no visual content. The Company retains only this hash, not the image itself. This means that even in the event of a security incident affecting Company systems, no intimate image could be exposed from our servers, because we do not hold any.

Mandatory NCMEC Reporting

Notwithstanding the above, if any image submitted to the Service appears to constitute child sexual abuse material (CSAM), the Company is required by federal law (18 U.S.C. § 2258A) to report to the National Center for Missing and Exploited Children (NCMEC) CyberTipline. This mandatory reporting obligation may require the Company to preserve and transmit such material to NCMEC and, thereafter, to law enforcement. This obligation applies regardless of any privacy preferences or deletion requests and cannot be waived. By submitting any image to the Service, you acknowledge and consent to this mandatory reporting obligation.

Limitations

The no-storage promise applies only to original image files. It does not apply to: the Fingerprint (hash) itself; session communications in which you describe the image; case information you provide about the image; or any image you choose to share directly in a text or chat session as opposed to submitting through the designated scan upload feature. If you paste or send an image directly in a chat session, that image may be retained as part of the session record subject to our general data retention practices described in Section 8.

How We Use Your Information

We use the personal information we collect for the following purposes. We process each category of personal information only for the purposes identified below and do not use personal information in ways incompatible with the purpose for which it was originally collected without your consent or as otherwise permitted by law.

Providing and Operating the Service

• Creating and managing your account
• Providing Guide sessions, triage, and resource navigation
• Facilitating the filing of reports with law enforcement and government agencies
• Processing platform takedown requests on your behalf
• Operating the Vero Origin image fingerprint scan
• Verifying your identity and eligibility to use the Service
• Processing subscription payments through our payment processor

Safety, Compliance, and Legal Obligations

• Fulfilling mandatory reporting obligations to NCMEC and law enforcement
• Responding to valid legal process, subpoenas, court orders, and law enforcement requests
• Preventing fraud, abuse, unauthorized access, and prohibited uses of the Service
• Protecting the safety of users, third parties, and the public
• Enforcing our Terms of Service and other agreements
• Maintaining records as required by applicable law

Service Improvement and Research

• Analyzing aggregated, anonymized usage data to improve the Service
• Training and improving AI Guide systems using de-identified interaction data, subject to Section 3 of our Terms of Service
• Conducting internal research on NCII trends and platform compliance rates (using only anonymized data)
• Testing new features and functionality

Communications

• Sending transactional communications including account confirmations, receipts, and security alerts
• Notifying you of changes to the Service, Terms, or this Policy
• Sending promotional communications where you have opted in (see Section 13)
• Responding to your support and legal inquiries

Legal Basis for Processing

Although the Service is not directed at EU/EEA/UK residents (see Terms of Service Section 37), we articulate lawful bases for processing as a matter of best practice. We rely on the following bases: performance of a contract (to provide the Service under our Terms); compliance with legal obligations (mandatory reporting, breach notification, records retention); legitimate interests (fraud prevention, security, service improvement, aggregated analytics) where those interests are not overridden by your rights; and consent (marketing communications, AI training uses beyond what is necessary to provide the Service, biometric processing under applicable Biometric Laws).

How We Share Your Information

We do not sell, rent, or trade your personal information. We share personal information only in the circumstances described below.

Service Providers and Processors

We share personal information with third-party vendors and service providers that process information on our behalf to support the operation of the Service. These include cloud infrastructure providers, payment processors, AI platform providers, video communication technology providers, analytics providers, and email service providers. Each service provider is contractually prohibited from using your personal information for any purpose other than providing services to us and is required to maintain appropriate security measures. We do not authorize service providers to sell or further disclose your personal information.

Law Enforcement and Government Agencies

Partner Organizations

We may share information with Safe Surfin' Foundation, the National White Collar Crime Center (NW3C), the Small and Rural Law Enforcement Executives Association (SRLEA), and other Partner Organizations to the extent necessary to facilitate the services they provide in connection with the Vero Origin platform. Each partner organization is a separate legal entity subject to its own privacy policy. We share only the minimum information necessary for the relevant referral or service. We do not authorize partner organizations to use your personal information for their own marketing purposes.

Business Transfers

In the event of a merger, acquisition, sale of all or substantially all of the Company's assets, financing, reorganization, dissolution, or similar corporate transaction or proceeding, your personal information may be transferred as part of the transaction. We will notify you via email or prominent notice on the Service prior to any such transfer if it results in a material change to this Policy or your privacy rights, and will provide you with choices regarding your personal information as required by applicable law.

With Your Consent

We may share your personal information for any other purpose with your explicit, informed, and affirmative consent. You may withdraw any such consent at any time by contacting privacy@verotakedown.com, but withdrawal does not affect processing that occurred prior to withdrawal.

Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified data — which cannot reasonably be used to identify you — with any party for any purpose, including research, industry reporting, marketing, and business development. We commit not to attempt to re-identify any individual from aggregated or de-identified data.

What We Will Never Do

The following practices are categorically prohibited. We make these commitments because users of this Service are, by definition, in a vulnerable position and deserve certainty about how their information will not be used.

1. We will never sell your personal information to any third party for any purpose, including data brokers, advertising networks, or marketing platforms.
2. We will never share your personal information with advertisers for targeted advertising, behavioral profiling, or retargeting purposes.
3. We will never retain or store your intimate images. Original image files submitted to the scan feature are deleted before any data leaves your device or secure processing environment. Only the Fingerprint (hash) is retained, as described in Section 4.
4. We will never allow Company employees or contractors to view your intimate images. The image-to-fingerprint process is automated and does not involve human review of submitted images.
5. We will never use your case information or session content to train AI models for commercial sale to third parties or in ways that could identify you or your case.
6. We will never disclose your identity as a victim to perpetrators or enabling parties through the Service, and we will not facilitate communication between you and any perpetrator through our platform.
7. We will never use sensitive personal information — including biometric data, health information, or victim status — for advertising, profiling, or cross-context behavioral tracking.
8. We will never knowingly collect personal information from children under 13 without verifiable parental consent, and we will delete any such information promptly upon discovery.

Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The following table describes our general retention practices by data category.

When personal information is no longer required under the above schedule, we delete it or render it irreversibly anonymized. Deletion from active systems does not guarantee simultaneous deletion from encrypted backup systems; we use commercially reasonable efforts to purge personal information from backup systems within ninety (90) days of the applicable retention period expiry.

We may retain personal information beyond the periods above where required by a legal hold, active litigation, regulatory investigation, or other legal process. In such cases, we will retain the information only for the duration of the legal requirement.

Security

Given the extreme sensitivity of the information we process, we implement and maintain a comprehensive information security program that includes the following measures:

• Encryption in transit: All communications between your device and our servers are encrypted using TLS 1.2 or higher
• Encryption at rest: Personal information stored on Company servers is encrypted at rest using AES-256 or equivalent
• Access controls: Access to personal information is limited to Company personnel and contractors who have a legitimate need to access it, and is subject to role-based access controls and audit logging
• Biometric security: Fingerprint (hash) data is stored with security measures at least as protective as those applied to our most confidential business information, consistent with requirements under applicable Biometric Laws
• Vendor assessment: Third-party service providers are assessed for security practices before engagement and are contractually required to maintain appropriate security standards
• Incident response: We maintain a written incident response plan and will notify affected users and regulatory authorities in the event of a security breach as required by applicable law

Children's Privacy

COPPA — Under 13

The Service is not directed to, and we do not knowingly collect personal information from, children under the age of 13. The Service is not accessible to users under 13. If we discover that we have inadvertently collected personal information from a child under 13, we will delete that information from our systems as promptly as practicable. If you believe a child under 13 has provided personal information to us, please contact privacy@verotakedown.com immediately. We will investigate and take appropriate action within a commercially reasonable time.

Under-18 Portal — Ages 13–17

The Vero Origin under-18 portal is available to users between 13 and 17 years of age with the affirmative consent of a parent or legal guardian. The following additional privacy practices apply to users in this age group:

1. Parental consent. A parent or legal guardian must affirmatively consent to the collection and processing of a minor's personal information before the minor may access the Service. By providing consent, the parent or guardian acknowledges receipt of this Policy and agrees to it on the minor's behalf.
2. Heightened sensitivity. Information collected from minors, including session content, case information, and any biometric data, is treated with a higher level of access restriction than general user data. Access is limited to personnel specifically authorized to handle minor user data.
3. Mandatory reporting. We are required by law to report to NCMEC any indication of child sexual exploitation or CSAM encountered in connection with a minor user session. Parental consent to this Policy constitutes acknowledgment of this mandatory reporting obligation. It cannot be waived.
4. No advertising targeting. We do not use personal information of users under 18 for advertising, behavioral profiling, or targeted marketing of any kind.
5. Parental access. A parent or legal guardian who has consented to a minor's use of the Service may request access to, correction of, or deletion of the minor's personal information by contacting privacy@verotakedown.com with proof of identity and guardianship.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate the Service, understand how users interact with it, and improve its functionality. The following categories of cookies and tracking technologies may be used:

We do not use advertising cookies, third-party behavioral tracking cookies, or cross-site tracking technologies of any kind. We do not participate in advertising networks or permit ad networks to place cookies through the Service.

You may control cookie settings through your browser preferences. Most browsers allow you to refuse, accept, or delete cookies. Refusing strictly necessary cookies will impair your ability to use the Service. Refusing analytics and performance cookies will not affect your ability to use core Service features.

We may use third-party analytics services, including but not limited to Google Analytics with IP anonymization enabled. These services operate under their own privacy policies, which we encourage you to review. We have configured any analytics providers we use to anonymize IP addresses and to be prohibited from using data collected through the Service for advertising purposes.

Do Not Track

Some browsers transmit Do Not Track (DNT) signals to websites. The Service does not currently respond to DNT signals in a standardized way, as no uniform standard for DNT compliance exists. We do not engage in cross-site behavioral tracking regardless of DNT status.

Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information. We describe the rights available to users in each applicable jurisdiction below. To exercise any of these rights, see Section 16.

Rights Available to All Users

California Residents — CCPA/CPRA

California residents have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, effective January 1, 2023:

• Right to Know (Categories): The right to know the categories of personal information we have collected about you, the sources, the business purpose, and the categories of third parties with whom it is shared.
• Right to Know (Specific Pieces): The right to request the specific pieces of personal information we have collected about you in the preceding 12 months.
• Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: The right to request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing: The right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising. No opt-out action is required.
• Right to Limit SPI: The right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the Service. Our default practices already comply with this right.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

To submit a CCPA/CPRA rights request, contact privacy@verotakedown.com. We will respond to verified requests within 45 days, with one 45-day extension if needed. We must be able to verify your identity before processing any request. We do not charge a fee for exercising your rights unless your requests are excessive or repetitive.

Authorized agents. You may designate an authorized agent to submit a rights request on your behalf. We require written authorization signed by you and may verify your identity directly with you.

Virginia, Colorado, Connecticut, Texas, Oregon, Montana — State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), and Montana (MCDPA) have the following rights, each subject to exceptions under applicable law:

• Right to access personal data we process about you
• Right to correct inaccuracies in your personal data
• Right to delete personal data you provided to us or that we collected about you
• Right to obtain a portable copy of personal data in a machine-readable format
• Right to opt out of the processing of personal data for targeted advertising (we do not conduct targeted advertising)
• Right to opt out of the sale of personal data (we do not sell personal data)
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not conduct such profiling)

To submit a request under any of these state laws, contact privacy@verotakedown.com. We will respond within 45 days with one 45-day extension if needed. If we decline your request, you have the right to appeal by contacting privacy@verotakedown.com with the subject line "Privacy Rights Appeal." We will respond to appeals within 60 days.

Nevada Residents

Nevada residents may opt out of the sale of covered information under Nevada Revised Statutes Chapter 603A. We do not sell covered information as defined under Nevada law. You may submit an opt-out request to privacy@verotakedown.com regardless, and we will acknowledge it and confirm our non-sale status.

Limitations on Rights

Deletion, correction, and access rights are subject to the following limitations: (a) we cannot delete information that is subject to a legal hold, ongoing legal proceeding, or mandatory retention obligation; (b) we cannot delete information that is necessary to complete a transaction you have requested or to fulfill a contract with you; (c) we cannot delete mandatory NCMEC report records or CSAM-related materials required to be retained under federal law; (d) we may deny requests that are manifestly unfounded or excessive. We will notify you of the specific basis for any denial and describe the appeal process available to you.

Communications and Marketing

Transactional Communications

We send transactional communications as necessary to operate the Service and fulfill our obligations to you. These include account creation confirmations, subscription receipts, renewal notices, security alerts, breach notifications, changes to Terms or this Policy, and mandatory notices required by law. Transactional communications cannot be opted out of while you maintain an active account, as they are necessary for the operation of the Service and compliance with applicable law.

Promotional Communications

With your consent, we may send promotional communications about Vero Origin features, updates, and related services. Your consent to receive promotional communications is separate from your consent to use the Service. You may opt out of promotional communications at any time by:

• Clicking the "Unsubscribe" link in any promotional email
• Updating your communication preferences in your account settings
• Contacting privacy@verotakedown.com with the subject line "Marketing Opt-Out"

Unsubscribing from promotional communications will not affect your receipt of transactional communications. Opt-out requests are processed within ten (10) business days.

CAN-SPAM and TCPA

All email communications comply with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.). We will include a physical mailing address, a clear identification as commercial email where required, and a functional opt-out mechanism in every promotional email. Where we communicate by text message, we comply with the Telephone Consumer Protection Act (47 U.S.C. § 227) and do not send promotional text messages without prior express written consent.

Third-Party Links and Resources

The Service may contain links to, or facilitate access to, third-party websites, government portals, platform reporting tools, and other external resources, including but not limited to the FBI Internet Crime Complaint Center (ic3.gov), the NCMEC CyberTipline (cybertipline.org), StopNCII (stopncii.org), and content platform reporting pages operated by Meta, X Corp., TikTok, Snap, and others.

Each of these external resources is operated by a separate entity under its own privacy policy and terms of service. We have no control over, and are not responsible for, the privacy practices, data collection activities, or content of any third-party resource. We do not represent that any third-party privacy policy meets any particular standard of protection.

Before submitting any personal information to a third-party resource, we encourage you to review that resource's privacy policy. Your use of any third-party resource is entirely at your own risk and is governed solely by that resource's terms, not by this Policy.

Any information you submit directly to a government agency, law enforcement reporting portal, or content platform is subject to that entity's own data handling practices and applicable law, including FOIA or equivalent disclosure laws that may apply to government-held information.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the features of the Service. We will indicate the effective date of the current version at the top of this Policy.

Where changes are material — meaning they affect the way we collect, use, or share your personal information in a manner that reduces your privacy protections — we will provide advance notice by posting the revised Policy to the Service and, where practicable, by sending an email notice to the address associated with your account at least thirty (30) days before the changes take effect. Changes required by law may take effect immediately without advance notice.

Your continued use of the Service after the effective date of a revised Policy constitutes your acceptance of the revised Policy. If you do not agree to the revised Policy, you must discontinue use of the Service prior to the effective date. Material changes will not apply retroactively to personal information collected before the effective date, except where required by law.

We archive prior versions of this Policy. If you would like to review a prior version, please contact privacy@verotakedown.com.

Contact and Privacy Requests

All privacy rights requests, questions about this Policy, requests to opt out of specific data uses, and concerns about our data practices should be directed to:

We will acknowledge receipt of privacy requests within five (5) business days and respond to verified requests within the time period required by applicable law (generally 45 days, with one extension of equal length if needed). To protect your privacy, we must verify your identity before processing access, correction, or deletion requests. Verification may require you to confirm information associated with your account.

If you are a California resident and are not satisfied with our response to a CCPA/CPRA request, you may file a complaint with the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General's office. If you are a resident of another state with a state privacy law, you may contact your state's attorney general. Disputes regarding this Policy are subject to the arbitration agreement and governing law provisions of our Terms of Service.