Data processed by OpenWAF Verify (external link) describes, per surface, what the challenge page, the widget and siteverify process: the IP address and its /24 or /64, the risk signals by name, the browser checks as yes/no bits, the proof-of-work timing, the TLS ClientHello traits and JA4 fingerprint (evaluated in memory, not kept by Verify), Private Access Tokens (not enabled today), and the __waf_pass cookie with its attributes. It also lists what Verify never collects, how long each item is kept (about 10 minutes in node memory; counts without IP addresses for 30 days), where it is processed, the roles under the DPA, a draft legal basis and a paragraph you can adapt for your privacy policy.
A draft DPA annex for Verify (external link) puts the same facts in contract form. Both texts are drafts pending legal review; until the annex is incorporated, the published DPA (external link) applies.
The browser challenge page now states that the __waf_pass cookie holds the visitor's network prefix itself, signed, and the challenge only a hash of it. Siteverify has a new «Data processed» section.