VeriDash
Sign inSign up
← VeriDash

VeriDash Privacy Policy

v6 · 10/13/2026 ·

VeriDash Privacy Policy

MIKS&T, INC. ("we", "us", or "Company") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the VeriDash service (the "Service"), in compliance with the Korean Personal Information Protection Act, EU GDPR, California CCPA, and other applicable laws.

1. Categories of Personal Data We Collect

1.1 Account information (required)

  • Email address
  • Password (stored as a one-way hash; never as plaintext)

1.2 Profile and billing (optional)

  • Name, phone, address (for tax and shipping purposes when subscription is active)
  • Card last four digits and expiration date (stored by Stripe, not by us)

1.3 Automatically collected

  • IP address, device information (OS, browser, app version)
  • Service usage logs (login, upload, playback, share)
  • GPS coordinates: collected only with your explicit consent during video recording, used for in-app map display and integrity metadata
  • Payment attempt logs (success/failure history)

1.4 Video content

  • Recorded videos (mp4) you upload — may incidentally include third parties' faces or license plates
  • Video metadata (timestamps, duration, impact data, GPS track)
  • Integrity hashes (SHA-256, prev_hash chain)

2. Purposes of Processing

  • Operating the Service: video storage, playback, integrity verification, face mosaic post-processing
  • Account identification and authentication
  • Payment processing and refunds
  • Customer support and incident response
  • Legal compliance: tax reporting, court/police requests
  • Security: detecting abnormal logins and abusive bot traffic
  • Service improvement: anonymized usage analytics (de-identified)

3. Retention Periods

  • Account data: until account deletion. Records required to be retained by law are kept for the legally required period:
  • Korean E-Commerce Act – contracts and refunds: 5 years
  • Korean E-Commerce Act – payment records: 5 years
  • Korean Communications Secrets Act – login logs: 3 months
  • Korean Tax Code – tax-related records: 5 years
  • Video content: per your subscription plan
  • Free: 7 days
  • Standard: 30 days
  • Pro: 90 days
  • Family: 180 days
  • Impact-locked videos: kept until you explicitly delete them (deleted with account closure)

4. Disclosure to Third Parties

We do not sell or rent your personal data. We only share it in the following limited cases:

  • With your explicit consent
  • In response to a valid court order, warrant, or lawful government request
  • As aggregated, de-identified statistics

When legally permitted, we will notify you before or promptly after such disclosure.

5. Processors (Sub-Processors)

We use the following service providers to operate the Service. They process your data only for the contracted purpose:

| Processor | Purpose | Data Processed | |---|---|---| | Cloudflare, Inc. (US) | Cloud video/metadata storage and CDN | Video files, IPs, metadata | | Supabase, Inc. (US) | Authentication, user database, subscription metadata | Email, password hash, subscription info | | Stripe, Inc. (US) | Payment processing | Card data, payment history | | Google LLC (US) | Maps SDK, ML Kit face detection (on-device) | GPS coordinates; ML Kit runs on your device and does not transmit frames to our servers |

6. International Data Transfers

Our infrastructure is primarily based in the United States (Cloudflare, Supabase, Stripe). Your data may be transferred to and processed in the U.S. We rely on:

  • Standard Contractual Clauses (SCCs) where applicable for EU data subjects
  • TLS 1.3 or stronger encryption in transit
  • AES-256 encryption at rest within R2/Supabase

If you do not consent to this transfer, you cannot use the Service.

7. Your Rights

Subject to applicable law, you have the right to:

  • Access your personal data (GDPR Art. 15)
  • Rectify inaccurate data (GDPR Art. 16)
  • Erase your data ("right to be forgotten", GDPR Art. 17)
  • Restrict processing (GDPR Art. 18)
  • Data portability — receive your data in a machine-readable format (GDPR Art. 20)
  • Object to processing (GDPR Art. 21)
  • Withdraw consent at any time
  • CCPA (California residents): opt out of data sale (we do not sell personal data), request information about data collected

To exercise these rights, contact johnnie@miksnt.com or use the Settings → Personal Data menu. We will respond within 30 days.

8. Data Deletion

When you close your account or your data's retention period expires, we permanently delete your data using non-recoverable methods (cascading DELETE, R2 object deletion). Legally required records are retained only for the legally mandated period.

9. Cookies

We use the following cookie categories. See our [Cookie Policy](/legal/cookie) for details:

  • Strictly necessary: login session, security tokens
  • Functional: language preference, theme preference
  • Analytics (planned, opt-in): currently not in use

10. Children

We do not knowingly collect personal data from children under 14. If you are a parent or guardian and become aware that your child has provided us with personal data without your consent, please contact us immediately.

11. Security Measures

  • TLS 1.3 in transit
  • One-way password hashing (bcrypt or similar)
  • SHA-256 integrity hash chain for video content
  • Role-Based Access Control (RBAC)
  • Regular security reviews and patching
  • R2 object storage durability guarantees

No system is perfectly secure; we will notify affected users and regulators of any data breach in accordance with applicable law.

12. Data Protection Officer / Contact

| Item | Information | |---|---| | Company | MIKS&T, INC. (Delaware C-Corporation, USA) | | Data Protection Officer | Johnnie Lee (CEO) | | Email | johnnie@miksnt.com |

13. Regulator Complaints

  • Korea: PIPC (Personal Information Protection Commission) — 1833-6972, https://www.kopico.go.kr
  • EU: file a complaint with your local data protection authority (DPA)
  • California: California Attorney General — https://oag.ca.gov/privacy

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced at least 30 days in advance via in-Service notice and email.

---

Effective Date: This v2 of the Privacy Policy is effective from June 12, 2026.

---

Privacy — Connect (Family) and Location Features

1. Additional data processed

  • Real-time location (latitude, longitude, speed, heading) and location history
  • Linked-account (Circle) data — membership, role, sharing settings (consent state)
  • Driving history (trip information derived from video/location)
  • Live video stream (transmitted in real time; generally not stored persistently on the server, or kept briefly and deleted)

2. Purpose — Location sharing among family/group members, driving history, (paid) live video viewing, preservation and notifications.

3. Disclosure / Processors

  • Your real-time location and live video are shared only with Circle members to whom you have consented (default: not shared).
  • We use Supabase (auth/DB) and Cloudflare (compute/storage); data may be stored and processed outside your country, including in the United States.

4. Retention, deletion, and your rights

  • Location history is deleted after the configured retention period; you may stop sharing or request deletion at any time.
  • Live video ends when viewing stops and is not retained persistently.
  • Location is potentially sensitive and is collected/shared only with your explicit opt-in consent.

Revision: Supplemented October 12, 2026 for the new features (Connect, location, live). (Pending legal review.)