Data protection and providers

A plain-language view of where Verify Presence uses service providers, what information is involved, and how long key records are kept.

Reviewed 23 September 2026 · Free launch and controlled Business candidate register

Customer authority comes first

External AI measurement is off until every collected source has been resolved and an organisation owner or approver enables the named provider. Material publishing waits for approval of the exact version, a proved staging rollback, and a verified live production connector. Google sign-in does not grant access to Gmail, Drive, or Google Business Profile.

Current core providers

• Supabase provides authentication and private database services. It receives customer account, membership, workspace, evidence, decision, and audit information.
• Netlify hosts the application, server functions, scheduled automation, and operational logs.
• OpenAI receives only bounded public business evidence, approved measurement questions, and answer context after that organisation enables measurement. Google profile details and publishing secrets are excluded.
• Google authenticates the customer using basic identity scopes selected during sign-in.
• Stripe hosts Business Checkout and the Customer Portal. It processes billing contact, organisation, address, tax, payment, invoice, subscription and cancellation information. Card details are entered directly into Stripe and are not stored by Verify Presence.

Provider terms and processing locations can change. Current source registers: Supabase GDPR and DPA information, Netlify DPA, OpenAI DPA, OpenAI sub-processors, Google Privacy Policy, Google API Services User Data Policy, Stripe Services Agreement, and Stripe privacy information.

Retention summary

• Pilot applications are automatically deleted 90 days after submission, including successful invited applications.
• Raw invitation links are never stored; only one-way token hashes are retained. Completed or expired invitation records and their email-bearing operator history are automatically deleted after 12 months.
• Old automation payloads, worker identifiers, and error detail are automatically removed after 90 days for successful work and 12 months for failed or cancelled work. Minimal status and idempotency proof remains where required to prevent duplicate execution.
• An owner can close a workspace from the dashboard. Measurement, publishing, invitations, approvals, and new work stop immediately, followed by a 90-day export and recovery window.
• After that window, live workspace content is removed automatically. A hashed, credential-free execution archive is retained for 12 months from the closure request, minimum legal evidence for six years, and the associated authentication accounts are queued for deletion.
• No disposal clock runs while an applicable hold is active. A held review with a final committed outcome starts its six-year period from the latest required committed-outcome, hold-release or linked historical event. A held review without a committed outcome starts from the later of final hold release and formal closure, abandonment or supersession. Later qualifying events may extend and never shorten retention.
• Missing or uncertain dates, links, exports, closure, approval or prior-disposal state keep eligibility unknown and prohibit disposal. The lifecycle planner does not execute deletion.

Current provider periods

The live Supabase Pro project provides seven-day API/database log retention and seven days of daily backups. Netlify function logs are retained for at least 24 hours and up to seven days on eligible plans; no external Netlify Log Drain is configured. Every OpenAI Responses API request sets storage off, while OpenAI may retain abuse-monitoring logs for up to 30 days unless law requires longer.

Current source information: Supabase plan retention, Supabase backups, Netlify function logs, and OpenAI API data controls.

Your controls

An organisation owner can export the complete workspace or request closure from the customer dashboard. Closure requires the exact organisation name, stops service activity immediately, and can be cancelled during the 90-day recovery window without silently re-enabling measurement or publishing. To request access, correction, restriction, or deletion, email hello@verifypresence.com. We verify authority before disclosing or deleting customer data.

Contract documents

The Verify Presence operator is Stripout London Ltd, company number 13654607, registered at 30 Great North Road, Brookmans Park, Hatfield, Hertfordshire, United Kingdom, AL9 6NF. Paid customers will receive processing terms covering the legal parties, controller and processor roles, processing instructions, security, sub-processors, rights assistance, breach notification, deletion, audit, and international-transfer safeguards. Signed terms and UK solicitor review must be completed before paid launch.

Read the full privacy notice · Review security and customer control