Legal

Privacy Policy

Last updated: 17 June 2026  ·  VerdCore, United Kingdom

1. Who We Are

VerdCore ("we", "us", "our") is a carbon compliance software service for UK construction businesses. We are the data controller for personal data collected through this application.

Contact: hello@verdcore.com

2. What Data We Collect

When you create an account and use VerdCore, we collect:

• Account data: full name, email address, password (hashed by Firebase — we never see it)
• Company data: company name, registered number, address, postcode, website, job title, phone number
• Project data: construction site names, locations, carbon log entries (fuel, materials, transport quantities), waste records, carbon targets
• Usage data: pages visited, features used — collected automatically by Firebase Analytics (if enabled)

We do not collect payment card details, government identifiers, or any special category data under UK GDPR.

3. Why We Collect It (Legal Basis)

• Contract performance — to create and manage your account and provide the carbon tracking service you signed up for (Article 6(1)(b) UK GDPR)
• Legitimate interests — to improve the service, diagnose errors, and prevent abuse (Article 6(1)(f) UK GDPR)
• Consent — where you have explicitly agreed, such as marketing communications (you can withdraw at any time)

4. How We Store and Protect Your Data

All data is stored in Google Firebase (Firestore database and Firebase Authentication). Firebase servers used by this application are located within the European Economic Area (EEA). Firebase is ISO 27001 certified and SOC 2 / SOC 3 compliant.

Access to your data is protected by:

• Firebase Authentication — you must be signed in to access any data
• Firestore Security Rules — your data is readable and writable only by your own account (UID-scoped)
• HTTPS — all data in transit is encrypted using TLS

5. How Long We Keep Your Data

We retain your personal data for as long as your account is active. If you request account deletion, all your data (account, sites, logs, waste records) will be permanently deleted within 30 days.

6. Who We Share Data With

We do not sell, rent, or share your personal data with third parties for marketing purposes. We use the following sub-processors:

• Google Firebase (Google LLC) — authentication, database storage, hosting
• Anthropic — AI recommendation processing (carbon log data sent in anonymised aggregate form; no personal identifiers)
• Netlify — application hosting and serverless functions

All sub-processors are bound by data processing agreements and comply with UK GDPR.

7. Cookies and Local Storage

VerdCore uses browser localStorage (not traditional cookies) to:

• Keep you signed in between sessions (Firebase Auth token)
• Remember your cookie consent preference

We do not use advertising trackers, third-party analytics cookies, or cross-site tracking.

8. Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data (you can update most data in the app under Settings → Profile)
• Erasure — request deletion of your account and all associated data
• Portability — export your carbon data via the CSV export feature
• Object — object to processing based on legitimate interests
• Restriction — request we limit processing of your data

To exercise any of these rights, email hello@verdcore.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children

VerdCore is intended for use by construction professionals and businesses. We do not knowingly collect data from anyone under the age of 18.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users by email of any material changes. The "Last updated" date at the top of this page will always reflect the current version.

11. Contact

For any privacy-related questions or requests:

VerdCore
Email: hello@verdcore.com