Terms of Service
This is a draft pending review. It may change before it is final. Questions: privacy@verilays.com.
1. Who this agreement is between
These terms are an agreement between the company you accept them for (“you”) and Verilays, operated by Yinon Megidesh and Noam Carter (“Verilays”, “we”). By accepting them you confirm that you are authorised to bind your company. Contact: privacy@verilays.com.
2. The service
Verilays sits between your agent and its LLM provider. It forwards each call unchanged, records what section 8 lists, and proposes ways to make your agent cheaper or better.
3. Your data
- You warrant that you have the right to send us the data your agent sends through Verilays.
- You must not send health data or other specially sensitive data without a written agreement with us first. The service is not certified for it (for example, under HIPAA).
4. As is
The service is provided “as is”, without warranties of any kind.
5. Liability
Our total liability under these terms is capped at the higher of US$100 or the fees you paid us in the 12 months before the claim.
6. Law and courts
These terms are governed by Israeli law. The courts of Tel Aviv have exclusive jurisdiction.
7. Changes
We email account owners at least 30 days before a material change takes effect, saying what changed. You are asked to accept the new version at your next sign-in. A wording-only fix updates the version and date without asking again.
8. Data Processing Agreement
For the data your agent sends through Verilays, you are the controller and Verilays is the holder (processor) acting for you, under Israel's Privacy Protection Law and, where it applies, the GDPR.
8.1 Instructions
We process your data only on your instructions: to run the service as these terms describe.
8.2 What we keep
- The shape of each call: which model, how many tokens, how long it took and how it ended.
- Your agent's system prompt and tool definitions.
- Each conversation's first question, shortened to 2,000 characters, and its final answer, shortened to 4,000 characters.
- The error text a failing tool or provider sends back.
8.3 What we never keep
- Your provider API key. It rides in the request header and is forwarded untouched.
- Your Verilays key itself. We keep only an identifier and a short hint so you can recognise it.
- Tool arguments and tool results.
- The messages between a conversation's first question and its final answer.
8.4 How long we keep it
On connections where payload capture is on, full copies of calls are deleted after 30 days. Everything else is kept until you delete the connection or your account.
8.5 Deletion
Email privacy@verilays.com to delete a connection's data, your whole account, or a conversation you point us to. We do it within 30 days, backups included. We delete by connection, account or conversation; we cannot search your data for a particular person. When this agreement ends, we delete your data the same way.
8.6 Subprocessors
You authorise the subprocessors on our subprocessor list. We email you at least 30 days before adding or replacing one, and you may object in that time. If we cannot resolve your objection, you may end this agreement.
8.7 Security
We protect your data as Israel's Privacy Protection (Data Security) Regulations, 2017 require. It is stored in the EU.
8.8 Incidents
If a security incident affects your data, we tell you without undue delay, and within 48 hours of finding out.
8.9 Requests from your end users
If one of your end users asks us about their data, we forward the request to you. You decide how to answer.
8.10 Transfers outside the EU and Israel
Some subprocessors are in the United States. We transfer data to them only under contractual commitments to obligations at the level Israeli law requires, and under the GDPR's transfer terms.