Your documents are sensitive. We treat them that way.
Last updated: 2026
VeraHold reviews financial, property and building-management documents that may contain personal, confidential or commercially sensitive information. This page explains, in plain English, how we handle those documents and data when you use VeraHold.
What we may handle
Depending on the service, you may provide documents such as:
- Service-charge budgets and accounts
- Invoices, quotes and expenditure reports
- Major-works and consultation documents
- Supplier contracts and information
- Reserve-fund or sinking-fund records
- Relevant lease documents
- Managing-agent correspondence
- Board or resident communications
- Reports and other supporting evidence
These documents may contain information about you and other people connected with the building. Please only send information that is relevant to the review. Where practical, remove or redact unrelated or unnecessarily sensitive personal information before uploading documents.
How we use your documents
We use the information you provide to deliver and operate the service you have requested. Depending on the review, this may involve:
- Organising and classifying documents
- Extracting relevant figures and information
- Comparing documents, costs and accounting periods
- Identifying changes, inconsistencies and information gaps
- Preparing summaries, analysis and reports
- Operating and supporting your VeraHold account
- Maintaining appropriate service and business records
We may also use properly anonymised or aggregated information to improve our internal methods, benchmarking, workflows and services. VeraHold does not sell personal data.
Technology and human review
VeraHold may use technology, including AI-assisted tools, to support document classification, data extraction, summarisation, cost comparison, anomaly identification, benchmarking and report preparation.
Where appropriate, AI-assisted outputs are reviewed before they are used in client-facing reports or materials. We do not use AI tools to make solely automated decisions about individuals that produce legal or similarly significant effects without appropriate human involvement.
We aim to minimise the personal information submitted to AI-assisted tools. We do not intentionally use client-uploaded documents or personal data to train third-party foundation models unless there is a lawful basis, appropriate contractual protection and, where required, consent.
Where your information is stored and processed
VeraHold uses third-party service providers to operate its platform and provide its services. Our core providers currently include:
Supabase
We use Supabase for cloud infrastructure, database functionality, file storage and related technical services. Documents, uploaded files, account information and service data may be stored or processed using Supabase infrastructure.
Google Drive and Google Workspace
We use Google Drive and Google Workspace for internal file storage, document management, email, collaboration, administrative records and internal workflows. Client documents, reports, working files and internal records may be stored or processed using these services where appropriate.
Stripe
We use Stripe to process payments and manage payment-related administration. VeraHold does not intend to store full payment-card numbers or full card-security details on its own systems.
Other service providers may be used where necessary for document processing, communications, analytics, security and the operation of our services.
International processing
Some of our service providers, including Stripe, Supabase and Google Drive / Google Workspace, may process, store or access personal data outside the United Kingdom.
Where personal data is transferred internationally, we take steps designed to ensure that appropriate safeguards are used in accordance with applicable data-protection law. You can read more about international transfers in our Privacy Policy.
Who can access your documents
We treat client documents as confidential. Access is restricted to authorised VeraHold personnel, contractors, advisers and service providers who need access for a legitimate service or business purpose.
We do not publish client documents or make them publicly available unless you expressly authorise us to do so or disclosure is required by law.
How we protect information
We use technical and organisational measures designed to protect personal data and client documents against unauthorised access, loss, misuse, alteration, disclosure or destruction. Depending on the system and circumstances, these measures may include:
- Access controls and restricted permissions
- Multi-factor authentication for key systems
- Encryption in transit and, where supported, at rest
- Secure cloud storage and database infrastructure
- Restricted access to client files
- Confidentiality obligations
- Data minimisation
- Retention and deletion controls
- Supplier and processor protections
- Security monitoring and incident-response procedures
No method of storing, transmitting or processing information can be guaranteed to be completely secure.
How long we keep information
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and for relevant legal, contractual, accounting, security and dispute-resolution purposes.
Our typical retention periods include:
- Website enquiries: up to 2 years after the last interaction
- Client account and service records: up to 6 years after the client relationship ends
- Reports, analysis files and uploaded documents: up to 6 years after the relevant service or client relationship ends, unless a shorter or longer period is appropriate
- Invoices, payment and accounting records: generally 6 years from the end of the relevant financial year
Different periods may apply to marketing records, technical logs, complaints and disputes. Properly anonymised or aggregated information may be retained for longer because it no longer identifies an individual.
See our Privacy Policy for the full retention information.
Deleting your information
You can ask us to delete personal information we hold about you. Data-protection rights are not absolute. In some circumstances, we may need to retain particular information for legal, accounting, contractual, fraud-prevention, security or dispute-resolution purposes.
To make a request, contact: support@verahold.co.uk
Your data-protection rights
Depending on the circumstances, you may have rights relating to:
- Access to your personal data
- Correction of inaccurate or incomplete information
- Erasure
- Restriction of processing
- Objection to certain processing
- Data portability
- Withdrawal of consent where processing relies on consent
- Certain forms of automated decision-making
To exercise a right or ask how your personal information is being used, contact support@verahold.co.uk. We may need to verify your identity before responding.
If something goes wrong
If we identify a suspected or actual personal-data breach, we will assess what happened and take appropriate steps to contain and investigate the issue, reduce potential harm and restore security. Where required by law, we will notify the Information Commissioner's Office and affected individuals.
If you have a security or privacy concern, contact: support@verahold.co.uk
More information
This page is a straightforward overview of how VeraHold handles documents and data. It does not replace our full Privacy Policy.
For complete information about what personal data we collect, why we process it, our lawful bases, service providers, international transfers, retention periods and your rights, please read our Privacy Policy.