verapli, a product of VOCABOTICS LTD
Privacy notice
Last updated 24 October 2026
Who we are
verapli is a product of VOCABOTICS LTD (“Vocabotics”, “we”, “us”), a company registered in England and Wales with company number 17412438, whose registered office is at 128 City Road, London, EC1V 2NX, United Kingdom.
We are the controller of the personal data described here. We are registered with the UK Information Commissioner’s Office (registration ZC241179). Contact us about privacy at privacy@verapli.com.
The short version
- verapli is built so that your provider API keys, identity profile and documents never reach our servers.
- We hold your email address, your plan and billing status, and a hash of your licence key.
- No advertising, no analytics trackers, no selling or sharing of your data for marketing.
- Hosted in London (Google Cloud, europe-west2).
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Waiting-list sign-ups: email, where you signed up, and anything you choose to tell us about what you’re building | To tell you when early access opens, send occasional product updates, and decide which providers to build first | Consent (you can withdraw it any time with the unsubscribe link or by emailing us) |
| Account: email address, sign-in identifier and sign-in times (via Firebase Authentication) | To sign you in and run your account | Contract |
| Billing: Stripe customer and subscription identifiers, plan and payment status. Stripe holds your name, billing address and card details — we never see your card. | To take payment, provide your plan, handle refunds and keep accounting records | Contract; legal obligation (tax and accounting records) |
| Licence key: a one-way hash and the last four characters | To check your plan when the extension or agent bridge asks | Contract |
| Technical logs: IP address, browser user agent, page requested, time | To keep the service secure, prevent abuse (including rate limiting) and fix faults | Legitimate interests (security and running the service) |
| Emails you send us | To reply and help you | Legitimate interests; contract where it concerns your plan |
We also count page views per page per day on our own server. Those counts contain no personal data: no cookies, no IP addresses, no device identifiers.
The verapli extension and agent bridge
When available to you, the extension stores your identity profile, project details and captured keys in your own browser, encrypted where they are sensitive. That data is not sent to us. Telemetry is off by default; if you switch it on, it sends only provider, step, outcome and waiting times — no names, domains, account ids or free text. If you use the built-in AI assistant, page text is redacted in your browser before it is sent, through a relay that does not log message content, to our AI provider. We will publish a full extension privacy notice before it is generally available.
Who we share data with
We use these processors, under contracts that require them to protect your data and use it only on our instructions:
- Google Cloud (Google Cloud EMEA Ltd / Google LLC): hosting, database, logs and Firebase Authentication. Our database and servers are in London (europe-west2); some Firebase Authentication processing may take place outside the UK.
- Stripe (Stripe Payments Europe Ltd and Stripe, Inc.): payment processing, subscriptions, invoices and the billing portal. Stripe is also an independent controller for some data it processes for fraud prevention and its own legal obligations; see Stripe’s privacy policy.
We may also share data if the law requires it, or with a buyer if our business is sold (in which case this notice will continue to apply). We never sell your personal data.
International transfers
Where a processor handles data outside the UK, we rely on UK adequacy regulations (including the UK–US data bridge where the recipient is certified) or the UK International Data Transfer Agreement / Addendum to the EU standard contractual clauses.
How long we keep it
- Waiting-list entries: until you unsubscribe, or 24 months after general availability, whichever is first.
- Account data: while your account is open, then deleted within 30 days of closure.
- Billing records: 6 years after the end of the financial year they relate to, as UK law requires.
- Technical logs: normally 30 days.
Your rights
You have the right to access your data, have it corrected or deleted, restrict or object to how we use it, take it with you (portability), and withdraw consent at any time. Email privacy@verapli.com; we’ll reply within one month. You can ask us to delete your account from your account page.
If you’re unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Children
verapli is not intended for anyone under 18, and we don’t knowingly collect their data.
Changes
We’ll update this notice when what we do changes, and tell account holders by email about significant changes.