Vitnis (“we”, “us”, “our”) is operated by Vitnis Ltd, Reg.Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ Reg. in England No. 17201606 and registered with the UK Information Commissioner's Office ZC141563. This Privacy Policy explains how we collect, use, store, and protect personal data when you use the Vitnis cloud service at vitnis.com and our related products.
This policy applies to the cloud service only. Customers using Vitnis under bilateral air-gapped deployment agreements operate within their own infrastructure and are governed by the terms of their specific agreement, not this policy.
We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Vitnis provides classical numerical verification of quantum circuit specifications. We are a UK-based service operated by Vitnis Ltd, with the trading name “Vitnis”.
For data protection enquiries, our published contact details are verifiable via the UK ICO register.
We collect different categories of personal data depending on how you use Vitnis. We deliberately minimise data collection wherever possible.
When you sign up for a free account or paid subscription, we collect:
When you submit verification requests, we generate:
We do notretain the actual content of your quantum circuit specifications. Circuit data is processed in volatile memory and discarded after each verification request. See the “Zero Data Retention” section below.
When you sign up via integrated providers, we receive:
We do not receive payment card details or full billing addresses from Stripe — these remain within Stripe's infrastructure.
We use your personal data for the following purposes, each with a specific legal basis under UK GDPR.
For academic tier applicants, verifying institutional eligibility through email domain checks and, where required, manual review of provided affiliation information.
This deserves a dedicated section because it differs from how most SaaS services handle customer-submitted data.
When you submit a quantum circuit for verification:
The SHA-3 hash is computationally irreversible. From the hash, the original circuit cannot be reconstructed. We cannot produce your circuit content even if compelled by legal process — it does not exist in our infrastructure beyond the duration of your verification request.
This is not a policy commitment that we could later weaken; it is an architectural guarantee built into how the verification engine operates.
We retain personal data only as long as necessary for the purposes described above.
| Data Category | Retention Period |
|---|---|
| Email address (active account) | Until account deletion + 30 days |
| Account preferences | Until account deletion |
| Verification logs (timestamps, hashes, qubit counts) | 12 months for billing reconciliation |
| IP addresses in request logs | 30 days |
| Wallet consumption history | 12 months |
| Stripe subscription references | While subscription active + 7 years for tax records |
| Academic verification documentation | While academic account active + 30 days |
| Support correspondence | 24 months |
| Anonymised aggregate analytics | Indefinitely (no individual identification possible) |
Some data must be retained longer to comply with legal obligations, principally UK tax law (7-year retention for financial records).
We share your personal data only with the third-party providers we use to deliver the service. We do not sell your data, and we do not share it for marketing purposes.
Each provider processes data on our behalf under appropriate contractual terms. Each maintains its own appropriate compliance certifications.
We may disclose personal data when required by law, including in response to:
Where legally permitted, we will notify affected users of such disclosure. We will challenge requests that we believe are unlawful or disproportionate.
Some of our service providers operate internationally. When personal data is transferred outside the UK, we rely on appropriate safeguards under UK GDPR:
Each of our service providers maintains its own transfer infrastructure. You can request copies of relevant transfer mechanisms by contacting dpo@vitnis.com.
Under UK GDPR, you have the following rights regarding your personal data. We will respond to all valid requests within one month.
You can request a copy of the personal data we hold about you. We will provide it in a commonly readable format, typically JSON for machine-readable data and PDF for documents.
You can request correction of inaccurate or incomplete personal data. For most account information, you can update directly in your account settings.
You can request deletion of your personal data. Some data may be retained for legal obligations (tax records, etc.) — we will explain what cannot be deleted and why.
You can request that we limit how we use your data while a dispute is resolved.
You can request your data in a machine-readable format suitable for transfer to another service.
You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds.
We do not make solely automated decisions with legal or similarly significant effects on you. The verification engine is automated, but it does not make decisions about you — it processes circuits you submit.
Email dpo@vitnis.com with your request. We may need to verify your identity before responding to protect your data from unauthorised disclosure.
You can also lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk/ if you believe we have not handled your data properly. We would always prefer the opportunity to address concerns directly first, but your right to complain to the ICO is independent of any direct discussion with us.
We implement appropriate technical and organisational measures to protect personal data, including:
For details of our security architecture, see our Security & Sovereignty page.
In the event of a personal data breach affecting your data, we will:
The Vitnis website uses minimal cookies. We do not use third-party advertising or tracking cookies.
These cookies are essential for the service to function. They cannot be disabled without breaking the service.
We do not use Google Analytics, Facebook Pixel, or similar tracking tools.
If we add aggregate analytics in the future (for service improvement, never for advertising), we will update this policy and seek consent where required.
Vitnis is not directed at children under 13, and we do not knowingly collect personal data from children. The service is intended for researchers, developers, and commercial users — typically over 18.
If you believe a child has provided us with personal data, please contact dpo@vitnis.com and we will delete the information.
We may update this Privacy Policy from time to time to reflect:
When we make material changes, we will:
For material changes, you will be given the opportunity to review the changes before they apply to you. Continued use of the service after the effective date constitutes acceptance of the updated policy.
For any questions about this Privacy Policy or our data practices:
For complaints about how we handle your personal data:
| Version | Date | Notes |
|---|---|---|
| 1.0 | 2026-05-28 | Initial policy. Effective from launch of cloud service. |
This privacy policy is governed by the laws of England and Wales.