Privacy Policy

01

Who we are

AssurePath Ltd (Company No. 16741039) is the data controller for personal data processed through the Vern platform.

Registered address: Manchester, United Kingdom.

Privacy enquiries privacy@assurepath.co.uk

Data protection officer dpo@assurepath.co.uk

02

Data we collect

Account data

When you create a Vern account, we collect:

Name and email address

Company name, if provided

Password, stored securely hashed and never in plain text

Account preferences and playbook configurations

Contract documents

When you upload contracts for triage, we process:

The document content, being text extracted from uploaded PDF or DOCX files

Triage results, risk ratings and AI-generated analysis outputs

Metadata such as upload date, file name and triage status

Usage data

We automatically collect:

IP address and approximate location at country or region level

Browser type and operating system

Pages visited and features used within the Vern application

Timestamps of actions such as uploads, triages and exports

Payment data

Payment processing is handled by Stripe. We do not store your full credit card details. Stripe processes and stores payment information in accordance with PCI DSS standards. We retain only a reference to your Stripe customer ID and subscription status.

03

How we use your data

Provide the service Process your contracts, generate triage reports, and deliver results to your dashboard.

Manage your account Authentication, billing, and subscription management.

Improve the platform Analyse usage patterns, not contract content, to improve features and performance.

Communicate with you Service updates, security notifications, and support responses.

Comply with the law Tax records, regulatory requirements, and lawful requests from authorities.

What we will never do

We will never use your contract documents or triage results for marketing purposes, sell your data to third parties, or use your data to train AI models.

04

Legal basis for processing

Under UK GDPR, we process your personal data on the following legal bases:

Contract performance Processing necessary to provide the Vern service you have signed up for. Article 6(1)(b).

Legitimate interests Improving our service, preventing fraud, and ensuring security. Article 6(1)(f).

Legal obligation Complying with applicable laws, tax requirements, and regulatory obligations. Article 6(1)(c).

Consent Where you have opted in to receive marketing communications. Article 6(1)(a). You can withdraw consent at any time.

05

Contract document data

Your contracts are some of your most sensitive business documents. Here is exactly how we handle them:

Contract data is processed solely to fulfil your triage request

Documents are never used to train AI models, which is contractually prohibited by our AI sub-processor agreements

All contract data is encrypted at rest (AES-256) and in transit (TLS 1.2+)

Contract data is stored in UK and EU data centres only

You can delete individual contracts and their triage results at any time

On account closure, all contract data is permanently deleted within 30 days

06

AI processing

Vern uses a combination of proprietary processing and third-party AI services to analyse your contract documents. Our AI sub-processors, listed in section 07, operate under Data Processing Addendums that contractually prohibit the use of customer data for model training.

Processing occurs via EU-based endpoints. All sub-processor agreements include appropriate safeguards including Standard Contractual Clauses where applicable.

AI outputs are informational triage indicators to assist human decision-making. They do not constitute automated decisions with legal effects under GDPR Article 22. You can request human review of any triage output at any time.

07

Data sharing and sub-processors

We share your data only with the following categories of recipients, and only to the extent necessary to provide the Vern service.

Sub-processors

OpenAI (EU) Contract analysis, AI processing

Anthropic (EU) Contract analysis, AI processing

LlamaIndex (EU) Document parsing

Railway (EU) Application hosting

Clerk (EU) Authentication

Stripe (UK/EU) Payment processing

Resend (EU) Email delivery

We provide 30 days notice before adding or changing any sub-processor. We do not sell, rent, or trade your personal data to any third party.

Legal disclosure

We may disclose your data if required by law, court order, or to protect the rights, property, or safety of AssurePath, our users, or the public.

08

Data retention

Account data Retained for the duration of your account, plus 30 days after closure.

Contracts and results Retained until you delete them, or 30 days after account closure.

Usage data Retained for up to 24 months for service improvement purposes.

Payment records Retained for 7 years as required by UK tax law.

Support correspondence Retained for 24 months after resolution.

On account closure, you will receive a minimum of 14 days notice to export your data before permanent deletion.

09

Data security

We implement appropriate technical and organisational measures to protect your data:

Encryption AES-256 at rest, TLS 1.2+ in transit.

Access control Least-privilege access with multi-factor authentication on all admin accounts.

Infrastructure SOC 2 Type II audited hosting, UK and EU data centres.

Monitoring Logging and monitoring of all administrative access.

Audits Regular security assessments and penetration testing.

Incident response Defined procedures with customer notification within 2 hours of a confirmed breach.

For full details on our security posture, visit our Trust Centre.

10

Your rights

Under UK GDPR, you have the following rights regarding your personal data:

Access Request a copy of all personal data we hold about you.

Rectification Correct any inaccurate or incomplete data.

Erasure Request deletion of your data, subject to legal retention obligations.

Data portability Receive your data in a machine-readable format.

Restrict processing Limit how we use your data in specific circumstances.

Object Oppose processing based on legitimate interests.

Withdraw consent Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@assurepath.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11

Cookies

The Vern website uses the following cookies:

Essential Required for site functionality, being theme preference and cookie consent status. These are stored in your browser localStorage and do not track you.

Analytics Google Analytics 4 is used to understand how visitors use our site. These cookies are only set after you give consent via our cookie banner. We use Google Consent Mode v2 with IP anonymisation enabled.

Authentication Used by Clerk to maintain your login session in the Vern application.

We do not use advertising cookies or tracking pixels. For full details, see our Cookie Policy.

12

Children's privacy

Vern is a B2B service designed for business professionals. We do not knowingly collect or process personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it.

13

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before they take effect.

The last updated date at the top of this page indicates when this policy was most recently revised.

14

Contact us

If you have any questions about this Privacy Policy or how we handle your data:

Privacy enquiries privacy@assurepath.co.uk

Data protection officer dpo@assurepath.co.uk

General enquiries hello@askvern.ai

AssurePath Ltd, Company No. 16741039, Manchester, United Kingdom.