Privacy Policy

This website is operated by Vernius (Vernius Limited, “we”, “us”, “our”), a company registered in England & Wales under company number 17114305. We are the data controller for the personal data described in this policy. In this policy, “you” and “your” mean the visitor or user of this website.

Our registered office is:

For anything about your data, email contact@vernius.co.uk. We deliberately route everything through one monitored inbox rather than advertising separate aliases that may go unread. There is no separate privacy@ address.

Data Protection Officer. We are a small studio and are not required by law to appoint a Data Protection Officer, so we have not appointed one. The inbox above reaches the person responsible for data protection at Vernius.

Complaints.You have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk/make-a-complaint. We would appreciate the chance to put things right first, so please consider raising it with us before you approach the ICO.

This policy covers only the personal data that Vernius controls: our own website, the enquiries you send through it, the on-site AI assistant, and our own business and accounting records.

When we act as a processor.When we build, host or operate software for a client and, in doing so, process personal data on that client’s instructions, we act as a processor, not a controller. The client is the controller of that data, and the client’s own privacy notice governs the individuals concerned. That relationship is governed by our Data Processing Agreement and the applicable Order, not by this policy.

How this maps to how we work:

• Scoped fixed-price projects and custom handoff builds. We are typically a processor only during the build, and often process little or no live personal data.
• Retainer or hosted service. We are a processor, sometimes for extended periods, under the Data Processing Agreement.
• Productized service. Our role depends on the offering and is set out in its Order.

Nothing in this policy limits or varies the Data Processing Agreement where that agreement applies.

We collect as little as we can: what you send us, plus the minimum our hosting layer needs to serve the site securely and reliably. That means:

• Enquiry data. The information you submit through our intake form: your name, email address, optional company name, and the free-text description of your problem, goals and constraints.
• Assistant messages. Whatever you type into the on-site AI assistant.
• Engagement records, only if we go on to work together: your business contact details, our correspondence, and the contractual, billing and project records needed to run the engagement. Personal data handled inside a build we deliver for you is covered by the Data Processing Agreement, not by this list.
• Technical data. The minimal data strictly necessary to serve the site securely, for example your IP address and basic request and security logs handled by the hosting layer to deliver pages and protect against abuse. This is used for the security purpose only.

We do not use analytics, advertising or third-party tracking, we do not profile visitors, and we do not buy or enrich data from third parties.

We do not ask for special category data (for example data about health, race, religion or political views), and we ask you not to send it. If you volunteer it, we handle it under the same minimal terms and delete it when it is no longer needed.

The on-site assistant is powered by AI. When you type a message, that message is sent to Anthropic via Vercel’s AI gateway to generate a reply.

These inputs are not used to train the underlying models. Even so, please do not enter sensitive personal data, other people’s personal data, credentials, or confidential information into the assistant.

Lawful basis. We rely on legitimate interests in operating the site and responding to enquiries. For anything you volunteer beyond what we ask, we rely on your consent.

Anthropic and Vercel act as our processors. See the “Who we share it with” and Sub-processors sections for detail.

The assistant’s output is automated, may be inaccurate, and is not advice. Its use is also subject to our Terms of Use.

We use your data for these purposes, each with a lawful basis under the UK GDPR and the Data Protection Act 2018:

• Responding to enquiries about working together. Legitimate interests (Article 6(1)(f)), the interest being to reply to someone who has approached us. You can object to this at any time.
• Delivering an engagement you have entered into. Performance of a contract (Article 6(1)(b)).
• Keeping accounting and tax records. Legal obligation (Article 6(1)(c)).
• Anything you volunteer beyond what we ask, and any future marketing. Consent (Article 6(1)(a)), freely given and withdrawable at any time.

We will not send you marketing without asking you first, we never sell personal data, and we do not use enquiry or assistant data for any purpose incompatible with the one it was given for.

We share personal data only with the suppliers that help us run the site and the business, each acting as our processor under a written contract with data-protection terms:

• Vercel. Hosting, and the AI gateway that routes assistant messages.
• Anthropic. AI model inference for the assistant and AI features.
• Neon. The managed Postgres database that stores a submitted brief.
• Resend. The transactional email service that delivers a brief to us.

The full, maintained list is on our Sub-processors page.

We may also disclose data where required by law, or to establish, exercise or defend legal claims, and to a successor if the business is reorganised or transferred, in each case under equivalent protection. We do not sell data, broker data, or share it with advertisers.

Some processors, for example Anthropic and Vercel, are based in or process data in the United States or other countries outside the UK.

Where personal data is transferred outside the UK, it is protected by an appropriate safeguard under Article 46 UK GDPR: the ICO’s International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, or reliance on UK adequacy regulations where the destination is covered by them.

We take reasonable steps to satisfy ourselves that a transfer meets the UK standard before relying on it. We can provide further information about the safeguards on request to contact@vernius.co.uk.

Per-supplier locations and transfer mechanisms are set out on our Sub-processors page.

• Enquiry and assistant data. Kept while we are in contact and for up to 24 months after our last contact, then deleted.
• Engagement records. Where we go on to work together, the engagement, contract, billing and correspondence records are kept for 6 years, to meet tax record-keeping requirements and the limitation period for contract claims, then deleted or anonymised.
• Security and technical logs. Kept only as long as needed for the security purpose, then rotated out.

You can ask us to delete your data sooner, and we will, unless we are required to keep it (for example tax records, which we must retain for the period above).

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict how we use it (restriction);
• object to how we use it, including objecting to processing based on our legitimate interests;
• receive certain data in a portable form (portability);
• withdraw consent where consent was the basis, at any time.

To exercise any of these, email contact@vernius.co.uk. We respond within one month, and will not charge unless a request is manifestly unfounded or excessive. We may need to verify your identity before we act.

If you are unhappy with how we have handled your data, you can complain to the ICO. We would appreciate the chance to put things right first.

We use appropriate technical and organisational measures proportionate to a small studio: encryption in transit (HTTPS and TLS), access control and least-privilege access to systems, a deliberately short and vetted supplier list, and reputable managed providers.

No online transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to people’s rights and freedoms, we will notify the ICO and affected individuals as required by law.

We use no non-essential cookies, no analytics cookies and no advertising cookies.

We use only the strictly necessary technology required to serve the site securely and to remember essential state. Because it is strictly necessary, no consent banner is required under the Privacy and Electronic Communications Regulations (PECR).

If this ever changes, we will update this policy and seek your consent before setting any non-essential cookie.

The on-site assistant generates replies, but it does not make decisions that produce legal effects, or similarly significant effects, about you.

We do not carry out solely automated decision-making of that kind, and we do not profile visitors. Decisions about whether and how to work together are made by people at Vernius.

The site and our Services are aimed at businesses and are not directed at children under 18.

We do not knowingly collect data from children. If you believe a child has sent us data, email contact@vernius.co.uk and we will delete it.

We may update this policy. The current version is always the one on this page, and the last-updated date shown above reflects the latest change.

Where a material change affects people who have already contacted us, we will flag it directly where we can.