Privacy Policy

Verixad ("we", "us") provides a property operations platform for UK letting agents and landlords. This policy explains what personal data we collect through verixad.com and the Verixad application, why we collect it, and the rights you have over it. We are the data controller for the account and billing information described in Section 2, and a data processor for the property, tenant, and document data our customers store in the Service on their own behalf (see Section 5).

You can reach us about anything in this policy at support@verixad.com.

We collect the following categories of information:

• Account information: name, email address, and password (stored only as a salted one-way hash, never in plain text) when you register.
• Organisation information: your agency or business name, and any contact details you add to your organisation profile.
• Billing information: your subscription plan and billing history. Card details are collected and stored directly by our payment processor, Stripe. We never receive or store your full card number.
• Content you upload: properties, tenancies, contacts, documents, and other records you or your team add to the Service. See Section 5 for how this category is handled differently.
• Usage and technical information: basic technical logs (such as IP address and browser type) generated automatically by our hosting infrastructure for security and reliability purposes.
• Contact form and enquiry submissions: anything you send us through the contact form, plan enquiry form, or by email.

We use the information above to:

• Provide, operate, and maintain the Service, including your account and your organisation's workspace;
• Process subscription payments and manage billing, via Stripe;
• Send account-related emails: sign-up verification, password resets, and service notifications;
• Respond to enquiries sent through our contact or plan enquiry forms;
• Maintain the security, integrity, and proper functioning of the Service;
• Meet our own legal and accounting obligations.

We do not use your data to serve you advertising, and we do not sell your data to third parties. On the public website we use Google Analytics 4 only with your consent, to see which pages and guides bring people to Verixad (section 7). It never runs inside your account or the tenant and contractor portals.

We rely on the following lawful bases under UK GDPR:

• Contract: processing your account and organisation data is necessary to provide the Service you've subscribed to;
• Legitimate interests: for technical logs and security monitoring, balanced against your right to privacy;
• Consent: where you explicitly opt in, such as submitting a contact form;
• Legal obligation: for billing and tax records we're required to keep.

When you or your team use Verixad to manage properties, tenancies, contacts, and documents, you are the data controller for that information, and Verixad acts as a data processor on your instructions. This is standard for B2B software: your organisation decides what data to enter, who on your team can see it, and how long to keep it. We process it only to provide the Service to you, and we do not access it except where necessary to provide support you've requested, investigate a security issue, or comply with the law.

Each organisation's data is isolated from every other organisation's data at the database level: one customer can never see another customer's properties, documents, or contacts.

If you are a tenant, applicant or contractor and your details are in Verixad, they were put there by the letting agent or landlord you deal with. They decide what is held and for how long, so they are the right people to ask about your data, and they are the ones who must give you their own privacy notice. If you contact us instead we will tell you who holds your records and pass your request on, but we cannot act on it ourselves without their instruction.

We use a small number of trusted subprocessors to run the Service. We don't sell or rent your data to anyone, and we only share it with the providers below to the extent necessary to operate Verixad:

• Supabase: our database, authentication, and file storage provider. Your account data and everything you upload is hosted on Supabase's infrastructure within the EU.
• Vercel: our hosting provider. Verixad is served from Vercel's infrastructure, so requests to the Service pass through it and it processes connection data such as IP addresses and request metadata in the course of delivering the site.
• Stripe: our payment processor, for subscription billing. Stripe is PCI-DSS compliant and handles your payment details directly.
• Resend: our transactional email provider, used to send account verification, password reset, and service-related emails.
• GoCardless: not in use today. Verixad records rent as a ledger you keep yourself; it does not collect money and holds no bank details. Direct Debit collection through GoCardless may be offered in future, and if it is, it would work by an organisation connecting its own GoCardless account, with payer bank details collected and held by GoCardless rather than by us. We will update this policy before any such feature is switched on.
• Anthropic: our AI provider, used for two features. The first is optional document extraction: when you, or your automatic-extraction preference, run extraction on a document, that document's content is sent to Anthropic's API to identify its type and key dates. The second is the in-app assistant: when you ask it a question, your question and the records needed to answer it are sent to the same API. In both cases Anthropic processes the data on our instructions as a sub-processor, may process it in the United States, and its commercial API terms do not permit training on it. We send only what the feature needs rather than your whole workspace, and nothing is sent unless you use one of these features. Extraction can be turned off in Settings → Preferences. Everything either feature produces is a suggestion for you to check. We do not treat AI output as authoritative, it never changes a record on its own, and no decision about a person is made by it.

International transfers. Your account data and everything you store in the Service is hosted in the European Union (Supabase). Some of the providers above process limited data outside the UK: Vercel serves the site from its infrastructure in the United States and handles connection data there; Stripe and Resend process billing and email data in the United States; Anthropic processes document content and assistant questions in the United States, and only when one of those features is used. Each of these providers processes data under a data processing agreement that incorporates the UK Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard recognised under UK GDPR, and we do not transfer your data to any country without such a safeguard in place.

We may also disclose information where required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of assets, in which case we'd notify you before your data becomes subject to a different privacy policy.

The Service itself uses only the technologies strictly necessary to run it: a session cookie / local storage token from Supabase Auth to keep you signed in, a local storage entry to remember your light/dark theme preference, and a local storage entry that remembers your analytics choice. None of these is used for tracking or advertising, and none requires consent under UK PECR because each is strictly necessary for the Service or for honouring your choice.

Analytics on the public website (with your consent). On verixad.com's public pages we ask before using Google Analytics 4. If you choose "Allow analytics", Google sets its analytics cookies (for example _ga) and we receive page views and a handful of events such as a sign-up or a contact form being sent, together with the campaign parameters in the link you arrived by. We do not send names, email addresses, phone numbers, property addresses, document names, repair descriptions or anything you type. Google Analytics is not loaded on any signed-in page, on the tenant or contractor portals, or on pages that carry a personal link. If you decline, or your browser sends a Global Privacy Control signal, nothing is loaded. You can change your choice at any time using "Cookie settings" in the footer, and we ask again after twelve months. Google's processing is described in its privacy policy; we use the consent settings Google provides so that advertising features stay switched off.

We keep account and billing information for as long as your account is active, and for a limited period afterwards to meet our legal and accounting obligations (typically up to six years for financial records, in line with UK requirements). If you close your account, we delete or anonymise your organisation's data within a reasonable period, except where we're required to retain it for legal reasons.

In practice: when an owner deletes an organisation, every record and file in it is erased once the 7-day cooling-off period ends. We keep a record that the deletion happened, payment records for six years, and support conversations for 24 months from your last contact. Records of the emails we sent are kept for 12 months. Copies in our backups expire on their own: database backups after 7 days and file backups after 35 days. Personal sign-in accounts are not removed with an organisation, because a person can belong to more than one; you can ask us to delete yours.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data, subject to our legal retention obligations;
• Request a portable copy of your data;
• Restrict or object to certain processing;
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at support@verixad.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we haven't handled your data properly.

We use industry-standard security practices to protect your data, including encryption in transit and at rest, private per-organisation storage for uploaded documents, and strict access controls that isolate every customer's data from every other customer's. No system can be guaranteed 100% secure, but we take reasonable technical and organisational steps to protect your information against unauthorised access, loss, or misuse.

Verixad is a record-keeping tool. Nothing in the Service, including anything produced by its AI features, is legal, regulatory, tax or professional advice, and none of it should be relied on in place of current official guidance or a qualified adviser.

The compliance status the Service shows you is worked out from the dates and documents you entered. It reports what your own records say; it does not verify a certificate, check anyone's status, or confirm that an obligation has been met. You remain responsible for meeting your duties under housing, safety and data protection law, and for checking any suggestion the Service makes before you act on it.

Verixad is a business tool intended for use by adults working in the property and letting industry. We do not knowingly collect personal data from anyone under 18.

We may update this Privacy Policy from time to time. If we make material changes, we'll notify active subscribers by email or through the Service before the changes take effect.

Anything about this policy, a request to use one of the rights in Section 9, or a complaint about how we have handled personal data goes to the same place: support@verixad.com. A person reads that inbox.

What to expect. We aim to acknowledge within 5 working days and to answer in full within one calendar month of receiving your request, which is the time UK GDPR allows for a rights request. If a request is complex, the law allows up to two further months; if we need them we will tell you within that first month, say why, and give you a date. If we cannot do what you have asked, we will say so plainly and explain the reason rather than leaving it unanswered.

If you are a tenant, applicant or contractor, the letting agent or landlord who holds your records is the right first point of contact, for the reasons in Section 5. Write to us anyway if you do not know who that is, and we will point you to them.

Taking it further. You do not have to complain to us first, but it is usually quicker. You can complain at any time to the UK Information Commissioner's Office, the regulator for data protection, at ico.org.uk, or on their helpline. Complaining to us does not affect that right.