Privacy policy

VerdiCost (“we”, “us”, “our”) provides software that helps trade businesses process invoices and receipts, track supplier prices, and manage job costs. For the personal data described in this policy, VerdiCost acts as the data controller in respect of your account information, and as a data processor in respect of the business documents you upload for processing.

If you have any questions about this policy or how we handle your data, please use our Data Rights page to get in touch.

We collect and process the following categories of information:

• Account details: your name, email address, password (stored in encrypted form), organisation name, and role within your organisation.
• Business documents: invoices, receipts, and quotes you or your team upload, including the supplier names, line items, prices, quantities, VAT amounts, and totals contained within them.
• Usage data: information about how you use the platform, such as documents processed, projects created, and feature usage, used to enforce plan limits and improve the service.
• Technical data: log information such as timestamps and error records needed to operate and secure the service.

We do not intentionally collect special category personal data. Please do not upload documents containing sensitive personal information that is not required for job costing.

We use your information to:

• Provide the core service — extracting data from your documents, normalising materials, tracking prices, and calculating job costs.
• Authenticate you and manage your account, organisation, and team members.
• Enforce subscription plan limits and process billing.
• Send service communications such as password resets, team invitations, and price-creep alerts.
• Maintain the security, integrity, and performance of the platform.

Under UK GDPR we rely on the following legal bases:

• Performance of a contract — to deliver the service you have signed up for.
• Legitimate interests — to secure, maintain, and improve the platform, provided your rights do not override those interests.
• Legal obligation — where we must retain certain records to comply with the law.
• Consent — where you have opted in to optional communications, which you can withdraw at any time.

To extract data from your invoices and receipts, document images and PDFs are processed by an artificial-intelligence model. Documents are sent securely for the sole purpose of reading their contents and returning structured data (such as line items and totals) to your account. This automated processing does not make legally significant decisions about individuals. Extracted financial figures are always presented for your review before they affect your project totals.

We do not sell your personal data. We share it only with:

• Service providers who host our infrastructure, store your files, process documents, and send transactional emails on our behalf, under appropriate data-protection terms.
• Members of your own organisation whom you have invited, according to their assigned role.
• Authorities where we are required to do so by law.

Your account data and uploaded documents are stored on secure, access-controlled infrastructure. Passwords are stored using strong one-way encryption, and files are held in private cloud storage. We apply technical and organisational measures to protect your data against unauthorised access, loss, or misuse.

We keep your account and document data for as long as your account is active. If you close your account or request deletion, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain certain records to meet legal or accounting obligations. You can request deletion at any time via our Data Rights page.

Under UK GDPR you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. You can exercise any of these rights through our Data Rights page. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

We use only essential cookies needed to keep you signed in and to operate the service securely. For more information see our Cookie policy.

We may update this policy from time to time. When we make significant changes we will update the “Last updated” date at the top of this page and, where appropriate, notify you within the app.