Summary: We collect your name, email, company details, and construction project data to provide carbon tracking services. Your project data is stored in the United Kingdom (Google Cloud, London). We never sell it. You can request deletion at any time.
VerdCore Ltd ("we", "us", "our") is an environmental compliance software service for UK construction businesses, registered in England and Wales under company number 17341522, registered office 5 Brayford Square, London, E1 0SG.
We are the data controller for the account and company data described below. Where you upload content that happens to contain other people’s personal data — an evidence photo showing a site worker, for example, or a supplier contact in a questionnaire — you are the controller for it and we act as your processor, on the terms set out in section 6 of our Terms of Service.
Contact: hello@verdcore.com
When you create an account and use VerdCore, we collect:
We do not collect payment card details, government identifiers, or any special category data under UK GDPR.
Your project data is stored in Google Firebase. The Firestore database and the evidence file storage for this application are both hosted in Google Cloud’s London region (europe-west2), so that data stays in the United Kingdom. Firebase Authentication, which holds your name, email address and password hash, is operated by Google globally and cannot be pinned to a region — see section 7. Firebase is ISO 27001 certified and SOC 2 / SOC 3 compliant.
Access to your data is protected by:
We retain your personal data for as long as your account is active. If you request account deletion, all your data (account, sites, logs, waste records) will be permanently deleted within 30 days.
We do not sell, rent, or share your personal data with third parties for marketing purposes. We use the following sub-processors:
All sub-processors are bound by data processing agreements and comply with UK GDPR.
Your project data is stored in the UK, as described in section 4, but some of the processing in section 6 happens outside it. Firebase Authentication (Google LLC), our serverless functions (Netlify), Anthropic and Resend are all operated from the United States.
Where personal data is transferred outside the UK we rely on the transfer mechanisms in our agreements with each provider — the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where that provider is certified under it. You can ask us which applies to a particular sub-processor and we will tell you.
VerdCore uses browser localStorage (not traditional cookies) to:
We do not use advertising trackers, third-party analytics cookies, or cross-site tracking.
You have the right to:
To exercise any of these rights, email hello@verdcore.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
VerdCore is intended for use by construction professionals and businesses. We do not knowingly collect data from anyone under the age of 18.
We may update this privacy policy from time to time. We will notify registered users by email of any material changes. The "Last updated" date at the top of this page will always reflect the current version.
For any privacy-related questions or requests:
VerdCore Ltd
Company No. 17341522, England and Wales
5 Brayford Square, London, E1 0SG
Email: hello@verdcore.com