Privacy Policy

1. Who we are — data controller identity

The data controller for the purposes of the UK GDPR and the Data Protection Act 2018 is Jake Bone, trading as Valify (“Valify”, “we”, “us”), a sole trader established and operating in England and Wales, United Kingdom.

Registered trading address: [REGISTERED ADDRESS TO BE INSERTED BEFORE LAUNCH], United Kingdom.

General contact: hello@valify.co.uk. For data protection requests specifically, see Section 10.

2. What we collect

We collect and process the following categories of data:

• Company name, company size, role and contact details you provide when setting up your account
• Your email address and account credentials
• Documents you upload for review, and the reports generated from them
• Usage data such as scans performed, features used and login activity
• Payment details — payment is handled entirely by Stripe; Valify does not store your card details

3. How your documents are processed

Documents you upload are stored in Supabase Storage, then their content is routed through OpenRouter to a large language model (currently Anthropic's Claude Sonnet) in order to generate your review report.

The model provider does not retain uploaded document content after the analysis has been returned to Valify, and does not use it to train its models. Document content is transmitted solely for the purpose of producing your report, and is not retained once that analysis is complete.

Within Valify's own systems, documents are stored in a private Supabase Storage bucket with encryption at rest, accessible only via short-lived signed URLs, subject to the retention period set out in Section 4.

4. Data retention

Uploaded documents and their reports are retained for 90 days from the date of upload and then permanently deleted. Account records (company name, email, billing history) are retained for as long as your account is active, and for a reasonable period afterward as required for legal, tax and accounting purposes.

5. Lawful basis for processing

We process your account and document data on the basis of performance of a contract — it is necessary in order to provide the review service you have signed up for. We process limited usage data on the basis of our legitimate interests in operating, securing and improving the service. Billing records are retained on the basis of our legal obligations under UK tax and accounting law.

6. Your rights

Under the UK GDPR you have the right to access the personal data we hold about you, request correction of inaccurate data, request erasure of your data (“right to erasure”), object to or restrict certain processing, and request a copy of your data in a portable format. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Third-party processors and international transfers

We use the following third-party processors (sub-processors), each bound by its own data processing terms:

• Supabase — authentication, database and document storage
• OpenRouter — routes document content to the AI model used for analysis (currently Anthropic Claude); OpenRouter does not train models on your data and does not retain document content after the analysis is returned
• Stripe — payment processing; Valify does not store your card details
• Resend — transactional email delivery
• Vercel — website hosting and content delivery

International transfers. Several of the processors above are established in the United States. Where document or account data is transferred outside the UK, that transfer is made under a Data Processing Addendum incorporating the European Commission Standard Contractual Clauses as supplemented by the UK International Data Transfer Addendum (the UK Addendum to the EU SCCs), issued by the Information Commissioner under section 119A of the Data Protection Act 2018, or under applicable UK adequacy regulations. This is the safeguard relied upon under Article 46 UK GDPR for those transfers.

8. Cookies and similar technologies

Valify uses only the technologies necessary to run your account and keep it secure. We do not use third-party advertising or tracking cookies.

• Session/auth cookies and local storage (set by Supabase Auth) — keep you signed in between visits and remember which account is active. Without these you would need to log in on every page.
• Rate-limit local storage — the login and signup pages record recent attempt counts in your browser's local storage only, to apply the temporary lockouts described in our sign-up and login flows. This data never leaves your browser and is not linked to your account server-side.
• Payment cookies (set by Stripe during checkout) — required for Stripe to process your payment securely and prevent fraud.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active account holders by email.

10. Contact for data requests

To exercise any of the rights set out in Section 6 — including access, correction, erasure, restriction, objection or data portability — or to ask any question relating to how Valify handles personal data, contact:

This address is monitored specifically for data protection matters. General enquiries, support questions and billing queries should continue to go to hello@valify.co.uk.