Privacy notice
This pilot notice explains the information Verified Identity uses to provide secure sign-in, business evidence monitoring, approved improvements, and proof of results.
Effective 9 August 2026 · Version privacy-2026-08-09
Who is responsible
Verified Identity is operated by STRIPOUT LONDON LTD, company number 13654607, whose registered office is 30 Great North Road, Brookmans Park, Hatfield, Hertfordshire, United Kingdom, AL9 6NF. Privacy enquiries and rights requests can be sent to info@stripoutlondon.co.uk.
Information we use
- Pilot applications: contact name, work email, business name, website, stated goal, and contact permission.
- Basic Google sign-in details: account identifier, name, email address, and profile image where supplied.
- Business identity and evidence: website, services, service areas, credentials, case studies, reviews, and their sources.
- Recommendation observations: prompts tested, answer snapshots, accuracy assessments, and whether the business was recommended.
- Customer decisions: proposed wording, approval or rejection, version, time, and attributable account.
- Structured pilot feedback: delivery effort, tested price, stated willingness to pay, perceived value, renewal intent, and whether the customer would recommend the service.
- Operational and security information: session, audit, error, device, and access records needed to protect and run the service.
Why we use it
We use this information to provide the requested service, authenticate customers, protect accounts, measure how AI systems represent a business, prepare evidence-backed corrections, execute only authorised changes, remeasure results, and maintain an audit trail. The intended UK GDPR bases are performance of the customer contract and legitimate interests in operating, securing, and improving the service; any optional use requiring consent will be presented separately.
Sharing and international processing
Information may be processed by contracted hosting, authentication, database, and AI providers, including Google for sign-in, Supabase for authentication and data services, and Netlify for hosting. OpenAI processes only the public business identity, confirmed public website evidence, and measurement questions and answer snapshots after an organisation owner or approver explicitly enables that measurement provider; Google sign-in details are excluded. The current providers, source terms, and customer controls are listed in our data-protection register. International transfers require an applicable adequacy regulation or contractual safeguard and risk assessment. We do not sell personal information.
Retention
Every pilot application is automatically deleted 90 days after submission, including an application that led to an invitation. An owner-requested closure stops service activity immediately and starts a 90-day export and recovery window. The service then removes live workspace content and authentication accounts automatically, retaining only a hashed execution archive for 12 months from the request and minimum legal evidence for six years. Final periods remain subject to legal review before paid launch. Pilot users may request deletion, subject to records that must be retained for a lawful reason.
Your choices and rights
Depending on the circumstances, people may have rights to access, correct, erase, restrict, object to, or receive their personal information, and to complain to the UK Information Commissioner's Office. Contact us first so we can investigate promptly.
Google access
Google is used only to authenticate the customer with basic identity scopes. Signing in does not grant access to Gmail, Drive, or Google Business Profile, and does not grant permission to publish a business change.