Draft — pending legal review
This text is a working draft. A lawyer has not reviewed it yet and it may change before the pilots start.
Privacy policy
Last updated: 6 October 2026
This policy explains which personal data Veta IQ processes, why, on what legal basis, who receives it, how long we keep it and how you can exercise your rights.
Privacy contact: the Your rights form.
1. Controller
The controller is Veta IQ (vetaiq.cl). The controller's legal name, tax ID (RUT) and address will be published on this page before the pilots start.
For any privacy question use the form on the Your rights page or write to derechos@vetaiq.cl.
2. What data we process
We process only the data each purpose needs:
- Platform users: email address, organisation, role within the organisation, alert preferences and usage records (for example, exports made and their date). The hosting's technical logs include IP addresses.
- People who appear in public sources because of their professional activity (executives, directors and mining project leads): only name, role, employer, dates in the role and the source of the data. We never store their national ID (RUT), email, phone, home address or photo. This feature is in preparation and is only turned on after a legitimate-interest and impact assessment.
- People who exercise their rights or request a takedown: name, email and the content of the request.
- People who request a demo from the public site: name, company, job title, work email and the optional message they write.
- People who list their company in the supplier directory: name, role and email of whoever sends the application. The company details (name, RUT of a legal person, website, categories, regions and description) are not personal data and are published in the directory once the application is approved.
- To limit abuse of the sign-in form and the public forms we briefly keep a keyed digest (HMAC) of the email and the IP address, never the original text.
3. Purposes
- Providing the service to customer and pilot organisations: access, seats, alerts, exports and support.
- Building and maintaining an auditable database of Chilean mining information in which every figure links to its primary source.
- Showing who holds relevant roles in mining companies and projects, as professional context for that information (once the feature is turned on).
- Answering demo requests and arranging the meeting.
- Reviewing applications to the supplier directory and writing to whoever sent them if something is missing.
- Answering rights and takedown requests and keeping a record of them.
- Security, abuse prevention and compliance with legal obligations.
4. Legal bases
- Performance of the contract or pilot agreement, for user data.
- Steps taken at your request before entering into a contract, for demo requests.
- Steps taken at your request before entering into a contract, and legitimate interest in checking that an application comes from the company, for applications to the supplier directory.
- Legitimate interest, for professional data about people taken from publicly accessible sources (name, role, employer, dates and source). We document in writing the balance between that interest and your rights, process the minimum data and you can object at any time.
- Compliance with legal obligations, to handle and keep rights requests.
- Legitimate interest in the security of the service, for technical logs and abuse control.
5. Sources of the data
You give us user and requester data. We do not collect other people's professional data from them but from publicly accessible sources: material facts and annual reports published with the CMF (Chile's Financial Market Commission), Environmental Impact Assessment System records, the companies' own reports and filings with the US SEC (EDGAR). Every datum keeps its link to the source document.
6. Recipients and international transfers
We do not sell or share personal data. We use the following providers, who process data on our behalf. Several are outside Chile:
| Recipient | Country | What it processes | Safeguard |
|---|---|---|---|
| Supabase (AWS, sa-east-1 region) | Brazil | Database, authentication (user emails) and storage of evidence excerpts | Provider's data processing agreement (DPA) |
| Vercel | USA | Hosting of the site and the API; technical logs with IP addresses | Provider's DPA |
| GitHub | USA | Code, curated data without personal data, automation logs and encrypted database backups | Provider's DPA |
| Amazon Web Services (SES, us-east-1 region) | USA | Delivery of transactional email: sign-in links, alerts, acknowledgements and the internal notice of each demo request or supplier application (recipient address and message content) | Provider's DPA |
| Listmonk (email system self-hosted by the Veta IQ team) | Server location being confirmed; we will publish it here | Builds and logs outgoing email before handing it to Amazon SES | Restricted access; send-only permission |
| OpenFreeMap (public map server, tiles.openfreemap.org; delivered through the Cloudflare CDN) | Hungary (EU); the Cloudflare CDN also operates in the USA | When you open a map (the mini-map of an asset page, the platform's map or the public projects map; on the home page, only if you ask to load it), your browser downloads the style and tiles: the provider receives your IP address and the map area requested | Provider's privacy policy (anonymised logs; IP only during security incidents and for up to 30 days) |
| Anthropic (Claude Code) | USA | Processes source documents while data is extracted and reviewed; some contain names of executives or directors | Provider's commercial terms |
7. Retention
- User accounts: while the account exists and up to 12 months after it is closed.
- Professional data about people: while the role is current and up to 24 months after, or until you object or ask for deletion.
- Rights and takedown requests: up to 2 years after they are closed.
- Demo requests: deleted 12 months after they are received.
- Applications to the supplier directory: the name, role and email of whoever sent it are deleted 12 months after the decision; a rejected or withdrawn application is deleted whole within that period. The company page is kept while it is published.
- Source documents that contain personal data: the raw copy is replaced by a version without that data within 30 days.
- HMAC digests used for abuse control: deleted after 2 days at most.
8. Your rights and how to exercise them
You can ask for access, rectification, deletion, objection, portability and temporary blocking of your data. Use the form on the Your rights page, which is the channel we answer today. It is free of charge.
Our internal deadline to answer is 15 calendar days; the legal limit is 30. We may ask you to prove your identity before we disclose or change any data.
When we uphold a deletion or objection, the person is added to a suppression list that stops any later data load from bringing them back.
If you are not satisfied with our answer, you can complain to the competent supervisory authority (the Personal Data Protection Agency, once it is in operation).
9. Security
We apply access controls inside the database itself, encryption in transit, least-privilege roles and an audit log of administrative actions. No system is infallible: if an incident affects personal data, we will follow our response procedure and notify where required.
10. Automated decisions
We do not make automated decisions that produce legal effects on people. We use AI tools to extract data from documents, always with independent verification against the source text.
12. Changes to this policy
We will publish any change here, with its date. If a change matters to users, we will also tell them by email.