Privacy policy
Last updated 21 October 2026
This policy explains what personal data Verrin collects, why, and what rights you have. It covers our website, the Verrin app and the client portal.
Who we are
Verrin is run by [Company name] Ltd, a company registered in England and Wales (company number [company number]) with its registered office at [registered office address]. We are registered with the Information Commissioner's Office under number [ICO registration number].
For anything about your data, email privacy@verrin.co.uk.
Our two roles
Controller. We decide how to use the data we hold about our own customers and website visitors: the accountants and their staff who sign up, and anyone who contacts us.
Processor. Accounting practices use Verrin to hold data about their own clients, such as names, contact details, company records, ID documents and fees. The practice is the controller of that data and we process it only on their instructions, under our terms. If you are a practice's client, contact the practice first about your data; we'll help them respond.
What we collect
- Account details: name, email address, practice name and role, and sign-in records.
- Billing details: plan, invoices and payment status. Card and bank details are held by our payment providers, not by us.
- What you put into the app: client records, proposals, engagement letters, documents, jobs, time entries, emails from mailboxes you connect, and messages to the Verrin Assistant.
- Technical data: IP address, browser and device type, and logs of requests and errors, used to keep the service secure and working.
- Correspondence: anything you send us by email.
Why we use it
- To provide the service you signed up for (performance of a contract).
- To keep Verrin secure, prevent abuse and fix problems (our legitimate interests).
- To send service emails such as sign-in codes, notifications and billing notices (performance of a contract).
- To meet our legal obligations, such as keeping financial records.
We don't sell personal data, and we don't use the data practices store in Verrin to train AI models.
Who we share it with
We use these service providers to run Verrin. Each is bound by a contract that limits what they can do with the data.
| Provider | Used for | Location |
|---|---|---|
| Railway | Application hosting | EU (Netherlands) |
| Supabase | Database | UK (London) |
| Cloudflare | File storage, network security and DNS | EU for stored files; global network |
| Clerk | Sign-in and account management | United States |
| Resend | Sending email | United States |
| OpenRouter | The Verrin Assistant (AI help inside the app) | United States |
| ComplyCube | Identity and anti-money laundering checks | UK and EU |
| GoCardless | Direct Debit payments | UK |
When a practice connects another service, such as Xero, Google Workspace or Microsoft 365, data passes to that service on the practice's instructions and under that service's own terms. Company details are looked up from Companies House, which is public.
International transfers
Our database is in the UK and stored files are in the EU. Some providers above are based in the United States. Where data leaves the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) to protect it.
How long we keep it
We keep account data while your practice has an account, and delete it within 90 days of the account closing, apart from records we must keep by law (for example, financial records for six years).
Practices decide how long to keep their clients' data and can permanently delete a client or person at any time. Practices may be required to keep some records, such as anti-money laundering records for five years under the Money Laundering Regulations 2017.
Cookies
We only use cookies that are needed for Verrin to work: to keep you signed in, protect against fraud and remember settings such as the sidebar layout. We don't use advertising or analytics cookies, so we don't ask for cookie consent.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it
- receive your data in a portable format
Email privacy@verrin.co.uk and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.
Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it, and every practice's data is kept separate from every other practice's.
Changes to this policy
If we make significant changes, we'll tell account owners by email before they take effect. The date at the top shows when this policy was last updated.