Privacy Notice
Version 2026-09-22.1 · 22 September 2026
Who is responsible
RippleXn operates BioVeracity and determines the purposes of account administration, service security and managing publication permissions. For private professional case material we may act as processor for the customer controller under a separate data-processing agreement. Contact us through the Contact page about any privacy request, including if you have no account.
Information and purposes
We process account and contact details, password hashes, terms-acceptance records, billing references, preferences, activity records, enquiries, uploads, venue content and contributor releases. These support the service, security, requests and authorised publication. Contributor contact names and emails are private and are not included in public photo feeds or ordinary venue downloads. A public photographer credit can be a pseudonym.
Lawful bases and choices
Account services and requested processing rely on contract where applicable; security and rights administration may rely on legitimate interests, and applicable legal duties on legal obligation. Optional publication permissions and optional communications are separate choices. Acknowledging this notice is not blanket GDPR consent. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Who receives data
Authorised venue users and professional collaborators receive only content within their permissions. Hosting, storage, authentication, payment, email and scanning providers process data as needed to deliver the service. Guest photo uploads explicitly identify Cloudmersive scanning before submission. Publication makes approved content and its selected credit public, not the private contributor contact record. We do not sell personal information or use it for advertising profiles. Contact us for the applicable processors, locations and transfer safeguards for your service.
Retention and leaving
We keep personal data only for the purpose and period justified by the service, applicable legal duties and the defence of legal claims. Cancellation and erasure are distinct. A request response explains any exceptions, recipient handling and backup deletion arrangements. Shared case evidence and third-party public records require separate assessment. No indefinite personal-data retention follows merely from a 30-year ecological obligation.
Access, portability and other rights
Your data provides a limited instant account download plus requests for full access, erasure, correction, restriction, objection and portability where applicable. Access and portability are different rights. We normally respond without undue delay and within one calendar month; if an extension is legally available we explain it within the initial period. We may need proportionate identity verification and must protect other people’s data. Requests do not require payment, and Contact remains an alternative route.
Complaints
You can complain to the Irish Data Protection Commission or the UK Information Commissioner, as applicable, or your competent supervisory authority. You can contact us first, but that is not a condition of making a complaint.
Your data and privacy controls · Contact · Contributor release