I can’t recall what this service was for as I don’t find any login saved for it, but I was reading the updated privacy policy they sent me in an e-mail (looks like it may have been a service a tried a long time ago). It’s very long and starts out quite well, but it was when I got to these paragraphs below that it really starts to worry me as they are basically claiming all sorts of metadata will be passed on online advertising networks, social media companies and other 3rd party services, including GPS locations and click stream information. This includes for children 13 years and older. It’s similar to what WhatsApp passes up to Meta, which made me drop WhatsApp like a hot potato, because of who that data gets passed to.
An extract: “Specifically, we permit third party online advertising networks, social media companies and other third-party services, to collect information about your use of the VERO Website over time so that they may play or display ads for our products and services on other websites or services you may use, and on other devices you may use. Typically, though not always, the information used for interest-based advertising is collected through tracking technologies, such as cookies, web beacons, embedded scripts, location-identifying technologies, and similar technology, which recognize the device you are using and collect information, including click stream information, browser type, time and date you visited the VERO Websites, AdID, and other similar information. If permitted by your device settings, they may also collect location data through GPS, Wi-Fi or other methods. We and our third-party partners use this information to make the advertisements you see online more relevant to your interests, as well as to provide advertising-related services such as reporting, attribution, analytics and market research. We may also use services provided by third parties (such as social media platforms) to serve targeted ads to you and others on such platforms.”
This extract could imply your data gets made available to data brokers even: “Please be aware that your Personal Information and communications may be transferred to and maintained on servers or databases located outside your state, province, or country. We store and process the information that we collect in the United States in accordance with this Privacy Policy though our Service Providers may store and process data outside the United States. The laws in the United States may not be as protective of your privacy as those in your location.”
Well, this re-assuring that they don’t “sell” the information: “We do not “sell” personal information as most people would typically understand that term. However, on certain portions of the VERO Website, we do allow certain third-party partners and providers to collect information about consumers directly through our services for purposes of analyzing and optimizing our services, displaying ads on third party sites, providing content and ads that are more relevant, measuring statistics and the success of ad campaigns, and detecting and reporting fraud. This practice may be interpreted to constitute a “sale” under the U.S. state privacy laws, or may constitute the “sharing” or processing of your personal information for cross-context behavioral advertising purposes.”
They at least do expand here on selling: “We have “sold” or “shared” the following categories of personal information for the purposes described in our Privacy Policy, subject to your settings and preferences and your Right to Opt-Out: Identifiers, Commercial Information, and Internet/Network Information.”
This is what is stated about 3rdparty identity services: “VERO does not receive the biometric identifier generated from the images, however, for identity verification and security purposes, VERO will receive the results of the identity verification process, including the images of your ID and the results of the liveness check, as well as text extracted from the ID scan. We may use some or all of this information and associated information to verify your account.”
And this: “We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of targeted advertising.” Except that this contradicts what was said earlier about targeted advertising! Because I understand “to make the advertisements you see online more relevant to your interests” to mean targeted advertising. Maybe relevant and targeted mean two different things?
We don’t always have time to read updated privacy policies, but many do contain these hidden gems, that quite frankly can put you off using such services. The sites of course are usually “free” to use, so are funded by advertisers who require these conditions to be in place.
One can see why so many then flock to the Fediverse and other decentralised platforms which are funded by volunteers. It worth considering giving some small donations to these volunteer projects when they’re keeping you free from invasive advertising and data collection policies.
From https://vero.co/privacy-policy