Your brief.
Your information.

Who is responsible

StackShortlist is a Veristria product, founded by Lars O. Horpestad. Veristria’s published company information describes a Norwegian AS under incorporation, filed 24 August 2026; no registration number is claimed here.

Privacy, deletion and data-processing questions: legal@teamveristria.com. General support: support@teamveristria.com or +47 988 36 369. The Veristria imprint carries the public company details.

What happens before you submit

The builder holds selections, pasted text and company rows in the current page’s memory. It does not automatically send your list to the order system as you type. Closing or refreshing the page can lose an unsent draft. A copy or download you choose is saved by your browser to your own device.

A CSV/TXT company list is read in your browser for validation. An offer document is different: choosing a PDF, DOCX or TXT for text extraction sends that file to our extraction endpoint. The endpoint reads it in memory and returns the extracted text for your review; it does not retain the original file as an uploaded document or run model inference on it. Submitting the order later sends the reviewed text with the brief.

Do not upload credentials, private financial records, health information or other sensitive personal data. Remove unnecessary personal notes from company lists.

Order information

When you submit, we receive your name, business email, company name, selected requirements, filters, quantity, tier, exclusions, buyer/offer links, reviewed brief and any supplied company rows. We retain the accepted specification, estimate, request identifier, timestamps and order status so that we can review, price and fulfill the request and handle support.

Supplied source columns are included when you submit the list. Only include information that is appropriate and necessary for the research. Order collection uses our configured Supabase database when available. If storage is unavailable, the site reports that it could not confirm a saved request.

Delivery uses the email address supplied with your order. Your CSV and supporting evidence or dossiers are sent as attachments, or through a private download link in the email for larger packages. Email and file-hosting providers process the delivery within their role; protect the message and any private download link from onward sharing.

Your order content is not added to the public guide or public examples. A saved request does not automatically enroll you in marketing.

The automated guide and audience suggestions

The guide is automated. When you press Send or request audience suggestions, the website sends your text to its server. The chat request can include up to six recent displayed messages; server-side AI selection uses at most four previous user questions and ignores prior assistant messages as instructions.

When AI selection is available, Milliner, our model gateway, sends the question, limited user history and relevant public guidance/catalogue entries to its selected model provider. That provider can vary by request. The model chooses supported passages or catalogue IDs; the website presents reviewed guidance. A response labelled “From the lead guide” can be a deterministic server response without a provider call.

The visible conversation stays in page memory. This website does not write a separate chat transcript to the order database. Gateway, model-provider and hosting systems can process operational records according to their applicable settings and terms; we do not make a blanket zero-retention or no-training claim for every provider. Contact our legal desk if you need provider or transfer details before sharing personal data.

The invitation bubble does not transmit unsent typing. Chat does not access private order records, charge a card, send an email or create a human support ticket. Use the email links when you want a person to respond.

Cookies and browser storage

This build loads no advertising or optional analytics trackers. Its notice is informational; “Got it” remembers dismissal rather than switching tracking on.

Use the footer’s Cookie settings control to reopen the notice. Browser settings can clear local and session storage. Blocking storage does not prevent you from reading the site, but a dismissed notice may appear again.

Operational data and service providers

Hosting infrastructure receives ordinary request information, including IP address, request time and requested path. To limit abuse, the website derives an IP-based rate-limit key and uses short-lived counters, normally ten minutes, in its configured rate-limit service. These counters are separate from chat text and order records.

The service architecture uses Supabase for saved orders, Upstash for production rate-limit counters, and Milliner plus the selected model provider for optional AI source selection. Hosting and email providers handle requests and support messages within their role. Provider locations and transfer arrangements depend on the active deployment; request the applicable processor and transfer details from legal@teamveristria.com.

Where an enabled payment step sends you to Stripe, payment details are entered on Stripe’s checkout page. This website does not ask you to paste card information. We receive order/payment references and confirmed status needed for fulfillment, rather than a full card number. Stripe’s privacy policy explains its processing.

Research and business contact records

Company research may include public company descriptions, website and technology evidence, professional names, roles, sourced work contact details, observation dates and relevant business context. A name or work email can be personal data even when published on a business website.

Records are used to prepare the agreed business research and shared with the customer who orders that research. We distinguish evidence, claims, inference and unknowns. We do not treat public availability as blanket permission for any use, infer sensitive personal characteristics, or offer eligibility decisions about individuals.

If your information appears in a record, contact our legal desk to ask what we hold, request a correction or removal, or object to its use. Include enough information to identify the record without sending more sensitive information than necessary. We may need to verify your connection to the record before disclosing it.

Purpose, retention and your choices

We process buyer contact details and submitted specifications to take requested steps toward an order and perform the agreed service. Security and abuse controls support the legitimate operation of the service. Accounting records are kept where a legal obligation requires them. Any separate marketing consent can be withdrawn; purchasing is not a blanket marketing consent.

Saved order and support records are kept while needed for review, delivery, corrections, disputes and applicable accounting obligations. The current order system does not promise automatic deletion after a fixed number of days. You can request deletion or a retention explanation from our legal desk; records required by law or a live dispute may need to be retained. Original offer files are not retained by the extraction endpoint.

Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing, and withdraw consent where processing relies on it. The European Commission explains these rights. You can raise a complaint with Datatilsynet or the relevant supervisory authority.

We update this page when the information flow changes. Material changes to an active customer’s processing will be communicated where required. Read the service terms or contact the legal desk.