1. Who we are
This Privacy Notice describes how Danael Duve-Rowland ("we", "us", "our"), operating the VerifySOP service ("Service"), collects, uses, and shares your personal data. We act as the data controller for personal data processed in connection with the Service.
2. Personal data we collect
- Account information — name, email address, password (hashed), organization, role.
- Profile and team information — job title, access groups, manager assignments.
- Service content — SOPs, training materials, quizzes, sign-offs, and other content you upload or generate.
- Usage and telemetry — pages viewed, actions taken, training progress, quiz attempts, audit log entries.
- Device and connection data — IP address, browser type, operating system, device identifiers, timestamps.
- Support communications — messages you send to us and our responses.
- Email engagement — delivery, opens, bounces, and unsubscribe events for transactional and notification emails.
Payment information (card details, billing address) is collected and processed by Paddle, our Merchant of Record, and is not stored by us.
3. How and why we use your data
Purpose: Legal basis
- Create and manage your account, authenticate you: Performance of contract
- Provide the Service: host SOPs, run training, generate reports: Performance of contract
- Send transactional emails (training assignments, reminders, account events): Performance of contract
- Maintain audit and compliance records: Legal obligation; legitimate interests
- Detect fraud, abuse, and secure the Service: Legitimate interests
- Improve and develop the Service: Legitimate interests
- Respond to support requests: Performance of contract; legitimate interests
- Comply with legal and regulatory obligations: Legal obligation
4. Who we share your data with
- Hosting and infrastructure providers — used to run the Service securely.
- Paddle — our Merchant of Record, processes payments, subscriptions, taxes, invoicing, and related customer service.
- Email delivery provider — used to send transactional and notification emails.
- AI service providers — used to power AI-assisted search and quiz generation, processing only the content needed for the requested operation.
- Professional advisers — legal, accounting, and similar advisers under confidentiality.
- Authorities — where required by law or to protect rights, safety, or property.
- Acquirers — in connection with a merger, acquisition, or sale of assets.
We do not sell your personal data.
5. International transfers
Your data may be processed in countries outside your own. Where data is transferred from the UK or EEA to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. Retention
We retain personal data for as long as your account is active and as needed to provide the Service. After account closure, we retain data for a limited period to comply with legal obligations, resolve disputes, and enforce agreements, after which it is deleted or anonymized. Audit and training records may be retained for longer periods where required by law or by your organization's compliance needs.
7. Your rights
Depending on your jurisdiction, you may have rights to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion of your data;
- restrict or object to certain processing;
- request data portability;
- withdraw consent where processing is based on consent;
- lodge a complaint with a supervisory authority (in the UK or EEA).
We aim to respond to verified requests within one month.
8. Security
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, role-based permissions, and audit logging. No system is perfectly secure; please notify us of any suspected security issues.
9. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary to operate the Service (such as keeping you logged in). Where we use non-essential analytics or preference cookies, we will request your consent where required by law. You can manage cookie preferences in your browser.
10. Children
The Service is not intended for children under 16. We do not knowingly collect personal data from children.
11. Changes to this Notice
We may update this Privacy Notice from time to time. Material changes will be communicated via the Service or by email.
12. Contact
For privacy questions or to exercise your rights, contact us through the in-app support channel. For billing-related privacy questions, you can also contact Paddle via paddle.net.