Skip to content
Privacy policy

What we hold, and why.

Veristep exists to keep a record. This page says what goes into that record about people, what we collect about you on the website, where it lives, and what you can ask us to do with it.

Version 2026-09. When these change, the version changes, and existing customers are told before it applies to them.

1. What the platform records about people

  • Account details: name, work email, phone if given, the organization and role you hold, and sign-in events (time, IP address, device) — the last of these is the security trail, which can be added to but never edited.
  • Work you attest to: inspections, evidence, photographs, signatures, documents, approvals, hours and, where a project turns it on, GPS presence at the moment of a check-in or a captured photograph. These are the record and are kept for as long as the workspace that owns them exists.
  • Credentials people upload about themselves (certifications, clearances) and the dates on them.
  • Billing details, if your firm pays us: the billing contact, the plan, and what was billed and paid. Card numbers go straight to Stripe’s own payment page; we never see or keep them.

The organization that admitted you to its workspace controls this data. Veristep processes it on that organization’s instructions. Ask them first about correcting or removing it; ask us if you cannot reach them.

2. What the website collects

The public site sets no advertising cookies and runs no third-party trackers. We count page views, tour steps and form submissions in aggregate to see which pages work. If you ask for a report, a template or updates, contact us, or start a trial, we keep what you typed so we can send what you asked for.

The free templates ask for a work email before the file downloads, and a name and company if you want to give them. We keep those, which template and format you took, when, and the page you came from, so we can email you the links and see who is using the templates. The box for occasional QA/QC notes is never ticked for you; we keep your answer and the wording you saw next to it. A first-party cookie remembers for a year that this browser has already given an email, so you aren’t asked twice, and if you’re signed in to Veristep you aren’t asked at all. We don’t keep your IP address with any of it. To have yours removed, write to the address on the Talk to someone page.

3. Where it lives

Data is stored with Supabase (PostgreSQL and object storage) and served through Vercel, both in the United States. We keep files in private storage and only open them through a short-lived, signed link, for someone who’s signed in and allowed to see them. The AI assistants read the records they draft against, and the assistant in the Ask box reads a typed question; the model provider receives only the text needed for that draft or that answer. Which providers we use, and their data terms, are listed under Subprocessors on the Security page.

4. Who can see it

Your organization’s administrators decide who is admitted to its workspace and in what role; the database enforces that boundary between organizations. Veristep staff can reach a tenant’s data only to operate the service or on that tenant’s request, and that access is limited to the platform’s named administrators. We do not sell personal data and we do not share it with anyone except the processors above and where the law requires.

5. How long

  • For as long as the organization is a customer; for ninety days after a plan ends so that it can export everything; and then, archived and unopened, for two years so that it can be reactivated. Earlier, at the organization’s written request.
  • The audit trail — events, sign-ins, security entries — can be added to but never edited, by design, and stays sealed after a workspace closes, out of anyone’s reach.
  • Website enquiries are kept for two years.
  • Template downloads are deleted two years after the download, or sooner if you ask.

6. Your rights

You can ask what we hold about you, ask for it to be corrected, ask for a copy, or object to a use. Where the record is a workspace’s, we route the request to that workspace’s administrator and help them answer. Where a record can only be added to, we will explain what that means for the request rather than pretend otherwise. Write to the address on the Talk to someone page; we answer within thirty days.

7. Changes

A new version of this page gets a new version number. Material changes are announced to every workspace administrator before they take effect.