Privacy Policy

This Privacy Policy explains how Verrim LLC (“Verrim”, “we”, “us”) collects, uses, and protects information when you use verrim.com and the Verrim platform (the “Service”). The Service is operated by Verrim LLC, an Arizona limited liability company. The Service is intended for businesses in the United States.

Account information you give us: your name, email address, company name, and login credentials.

Certificate data you upload: resale and exemption certificates and the information in them, which can include third parties’ names, addresses, tax and exemption identification numbers, and signatures, provided on behalf of your business.

Store and order data from integrations you connect, such as Shopify: order numbers, buyer names and contact details, ship-to state, and tax-exempt status, received so the Service can match orders with certificates.

Usage and device information, such as IP address and browser type, collected to keep the Service working and secure.

Communications you send us, such as support requests.

We use it to provide and operate the Service, read and organize the certificates you upload, support you, keep the Service secure, improve it, and meet legal obligations. We do not sell your personal information.

Verrim uses automated and AI-assisted processing to read the certificates you upload, label the fields it finds, and suggest which customer each certificate belongs to, with a confidence level for the suggested match. This may use trusted third-party AI providers acting as our subprocessors. We do not allow our AI providers to use your uploaded certificates or the customer data in them to train their models. Extraction output can contain errors, is reviewed by you before it is relied on, and is not tax or legal advice. See our AI Disclaimer.

We share information with service providers and subprocessors who help us run the Service (for example, hosting, AI processing, email delivery, and product analytics), under agreements that limit their use of it. When you use permit verification, we send the permit number to the relevant state’s public verification source to check it. We may share information if required by law or to protect rights and safety. If Verrim is involved in a merger or acquisition, information may transfer as part of that transaction. Our current subprocessors are listed at verrim.com/legal/subprocessors, and our Data Processing Addendum is published at verrim.com/legal/dpa.

We use a product-analytics provider, acting as our subprocessor, to understand how the Service is used so we can improve it. We send usage events keyed to account and user identifiers — not the contents of your certificates, and not customer names or tax identification numbers. This information is used solely to operate and improve the Service.

Some browsers send a “Do Not Track” signal. There is no agreed industry standard for responding to it, so we do not currently respond to these signals. We will update this policy if that changes.

Verrim’s customers upload certificates and connect stores that can contain information about their own customers and contacts. We process that information on the customer’s behalf, as described in our Data Processing Addendum. If your information appears in a customer’s records, that business is responsible for it; please contact them directly. If you contact us instead, we will forward your request to them.

You can ask us to access, correct, delete, or export your information. Email hello@verrim.com and we will verify the request — usually by confirming it comes from the email address on the account — and respond within 45 days. An authorized agent may submit a request on your behalf with proof of authorization. We will never treat you differently for exercising these rights. We do not sell personal information or share it for advertising, so there is nothing to opt out of on that front; if that ever changes, we will update this policy and honor opt-out preference signals such as Global Privacy Control. Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or other US state privacy laws, and we will honor them as they apply.

We keep information while your account is active or as needed to provide the Service, then delete or de-identify it unless we must keep it for legal reasons.

When you delete customers, certificates, or upload links inside the Service, they move to Trash, stay recoverable for 30 days, and are then permanently removed, including the underlying files in storage. Order data from connected stores is kept while your account is open, so the Service can match orders with certificates and keep your compliance history intact. If you uninstall the Verrim app from your store, we delete that store’s order data as part of the platform’s uninstall process; you can also ask us to remove it at any time at hello@verrim.com. Activity records are kept for the life of the account to provide your audit trail.

If you close your account, contact us at hello@verrim.com and we will delete or de-identify your data, unless the law requires us to keep it longer.

We protect your information with technical and organizational measures designed for multi-tenant financial data: encryption in transit and at rest, per-tenant row-level security enforced in the database, role-based workspace access, optional two-step verification with trusted-device checks, encrypted integration credentials, hashed API keys, signed webhooks, and audit logging of workspace activity. Details are on our Security page at verrim.com/security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your information, we will notify you and any regulators as required by law.

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children.

We may update this policy and will post the new version here with the date.

Questions or requests: hello@verrim.com.