Data protection and providers
A plain-language view of where Verified Identity uses service providers, what information is involved, and how long key records are kept.
Reviewed 8 August 2026 · Pilot register
Customer authority comes first
External AI measurement is off until every collected source has been resolved and an organisation owner or approver enables the named provider. Material publishing waits for approval of the exact version, a proved staging rollback, and a verified live production connector. Google sign-in does not grant access to Gmail, Drive, or Google Business Profile.
Current core providers
- Supabase provides authentication and private database services. It receives customer account, membership, workspace, evidence, decision, and audit information.
- Netlify hosts the application, server functions, scheduled automation, and operational logs.
- OpenAI receives only bounded public business evidence, approved measurement questions, and answer context after that organisation enables measurement. Google profile details and publishing secrets are excluded.
- Google authenticates the customer using basic identity scopes selected during sign-in.
Provider terms and processing locations can change. Current source registers: Supabase DPA, Netlify privacy information, OpenAI DPA, OpenAI sub-processors, and Google Privacy Policy.
Retention summary
- Pilot applications are automatically deleted 90 days after submission, including successful invited applications.
- Raw invitation links are never stored; only one-way token hashes are retained. Completed or expired invitation records and their email-bearing operator history are automatically deleted after 12 months.
- Old automation payloads, worker identifiers, and error detail are automatically removed after 90 days for successful work and 12 months for failed or cancelled work. Minimal status and idempotency proof remains where required to prevent duplicate execution.
- An owner can close a workspace from the dashboard. Measurement, publishing, invitations, approvals, and new work stop immediately, followed by a 90-day export and recovery window.
- After that window, live workspace content is removed automatically. A hashed, credential-free execution archive is retained for 12 months from the closure request, minimum legal evidence for six years, and the associated authentication accounts are queued for deletion.
Current provider periods
The live Supabase Pro project provides seven-day API/database log retention and seven days of daily backups. Netlify function logs are retained for at least 24 hours and up to seven days on eligible plans; no external Netlify Log Drain is configured. Every OpenAI Responses API request sets storage off, while OpenAI may retain abuse-monitoring logs for up to 30 days unless law requires longer.
Current source information: Supabase plan retention, Supabase backups, Netlify function logs, and OpenAI API data controls.
Your controls
An organisation owner can export the complete workspace or request closure from the customer dashboard. Closure requires the exact organisation name, stops service activity immediately, and can be cancelled during the 90-day recovery window without silently re-enabling measurement or publishing. To request access, correction, restriction, or deletion, email info@stripoutlondon.co.uk. We verify authority before disclosing or deleting customer data.
Contract documents
The Verified Identity operator is STRIPOUT LONDON LTD, company number 13654607, registered at 30 Great North Road, Brookmans Park, Hatfield, Hertfordshire, United Kingdom, AL9 6NF. Paid customers will receive processing terms covering the legal parties, controller and processor roles, processing instructions, security, sub-processors, rights assistance, breach notification, deletion, audit, and international-transfer safeguards. Signed terms and UK solicitor review must be completed before paid launch.
Read the full privacy notice · Review security and customer control