Privacy notice

This notice explains the information Verify Presence uses to provide secure sign-in, private business profiles, assisted measurement, human-reviewed corrections and dated evidence snapshots.

Effective 13 September 2026 · Version privacy-2026-09-13

Who is responsible

Verify Presence is operated by STRIPOUT LONDON LTD, company number 13654607, whose registered office is 30 Great North Road, Brookmans Park, Hatfield, Hertfordshire, United Kingdom, AL9 6NF. Privacy enquiries and rights requests can be sent to hello@verifypresence.com.

Information we use

• Service and programme applications: contact name, work email, business name, website, stated goal, and contact permission.
• Basic Google sign-in details: account identifier, name, email address, and profile image where supplied.
• Business identity and evidence: website, services, service areas, credentials, case studies, reviews, and their sources.
• Recommendation observations: prompts tested, answer snapshots, accuracy assessments, and whether the business was recommended.
• Customer decisions: proposed wording, approval or rejection, version, time, and attributable account.
• Business billing records where Checkout is enabled: the accepted terms version, organisation-to-Stripe identifiers, subscription status, invoice and cancellation events, and timestamps. Card details are entered into Stripe and are not stored by Verify Presence.
• Structured service feedback: delivery effort, tested price, stated willingness to pay, perceived value, renewal intent, and whether the customer would recommend the service.
• Operational and security information: session, audit, error, device, and access records needed to protect and run the service.

Why we use it

We use this information to provide the requested service, authenticate customers, protect accounts, measure how AI systems represent a business, prepare evidence-backed corrections, execute only authorised changes, remeasure results, and maintain an audit trail. The intended UK GDPR bases are performance of the customer contract and legitimate interests in operating, securing, and improving the service; any optional use requiring consent will be presented separately.

Sharing and international processing

Information may be processed by contracted hosting, authentication, database, payment, and AI providers, including Google for sign-in, Supabase for authentication and data services, Netlify for hosting, and Stripe for Business Checkout, invoices, payment-method management and cancellation. OpenAI processes only the public business identity, confirmed public website evidence, and measurement questions and answer snapshots after an organisation owner or approver explicitly enables that measurement provider; Google sign-in details are excluded. The current providers, source terms, and customer controls are listed in our data-protection register. International transfers require an applicable adequacy regulation or contractual safeguard and risk assessment. We do not sell personal information.

Retention

Every pilot application is automatically deleted 90 days after submission, including an application that led to an invitation. A reviewed decision receipt remains complete for 12 months from its final committed or held outcome. It may then be minimised where the live request payload is no longer required, while the outcome, request identity, digest, timestamps, tenant and subject linkage, duplicate-prevention evidence and any linked historical record needed to explain the decision remain protected.

While any applicable legal, regulatory, contractual, dispute, safeguarding, fraud, security or owner-approved hold remains active, the necessary historical records are retained and no disposal clock runs. If a held review later has a final committed outcome, its six-year period starts from the latest of the final committed outcome date, release of the final applicable hold, and the latest linked receipt, snapshot or tombstone event that the approved lifecycle contract requires to be retained.

If a hold ends without a committed outcome, the required journal, receipt, snapshot and tombstone records are retained for six years from the later of the recorded release of the final applicable hold and the formal closure, abandonment or supersession of the uncommitted review. A later qualifying hold, review event or required linked historical event may extend retention but must never shorten an existing period.

After closure, live operational material may be minimised when it is no longer required, while the evidence needed to explain the review, hold, closure and disposal decision remains protected. If a required date, linkage, export dependency, closure, approval or prior-disposal state is missing or uncertain, eligibility remains unknown and disposal is prohibited. No date calculation automatically authorises deletion.

An owner-requested closure stops service activity immediately and starts a 90-day export and recovery window. The authenticated organisation owner receives an export opportunity before ordinary closure. Membership loss or closure removes ordinary interactive receipt recovery but does not erase evidence still covered by retention, unresolved processing, duplicate-prevention or a hold. These initial product periods remain subject to professional legal and privacy review before a paid offer materially relies on them.

Your choices and rights

Depending on the circumstances, people may have rights to be informed, access, correct, erase, restrict, receive or object to the use of their personal information, and safeguards concerning automated decision-making. Verify Presence does not make a solely automated legal or similarly significant decision about an individual. People may complain to the UK Information Commissioner's Office. Contact us first so we can investigate promptly.

Cookies and browser storage

We use secure authentication session cookies that are necessary to provide and protect the signed-in service. The workspace also uses same-tab browser session storage for short-lived request-recovery records, so an uncertain operation is held for reconciliation rather than repeated. A separate same-tab random identifier counts a small allowlisted set of first-party launch events, such as a homepage visit or Start Free click. The server stores only its one-way hash, event name, route and date; it does not store an IP address or user agent for this purpose. These records remain within Verify Presence operations and are not used for advertising or cross-site behavioural profiling. There is no advertising or behavioural-analytics integration.

Google access

Google is used only to authenticate the customer with basic identity scopes. Signing in does not grant access to Gmail, Drive, or Google Business Profile, and does not grant permission to publish a business change.