Privacy Policy

Who is responsible for your data

The data controllers for the processing described here are the founders, Luke Taylor and Sam Davies, operating under the Verna Solutions name. Verna Solutions is their Manchester-based web development trading name. Sam is the contact point for privacy questions and requests: sam@vernasolutions.co.uk. This notice describes the current website and client services; individual client projects may have different arrangements.

Information we collect

The information depends on how you interact with us:

• Call bookings: your name, business name, email, phone number, selected time, optional industry and message, appointment status and staff notes. We save these in our server-managed database and link the appointment to an enquiry so Sam can make the call. A hashed cancellation token supports your private cancellation link. Confirmation is shown on screen with a calendar download; this booking feature does not send automatic emails or texts. Please do not submit sensitive information in the message.
• Contact and project enquiries: your name, email address, optional business details, selected services, and the project information you choose to provide. These submissions are saved in the Verna-managed database so the team can review and respond.
• Client and staff accounts: account name and email, password hash, encrypted authenticator setup information, session information, company association, and requests or messages submitted through the client portal. We also record who enabled or reset an authenticator, when it happened, and the reason for a reset.
• Website statistics: on this Verna website and participating client websites, only after a visitor chooses to allow analytics, our tracker records daily totals grouped by approved public page, event type, broad traffic source, and device category. Events include page views, successful enquiry submissions, and phone or email link clicks. It does not save raw events, visitor IDs, form contents, full referrers, or URL query strings. The totals and a last-seen timestamp are stored in the Verna-managed database. Account, sign-in, authenticator setup and dashboard pages are excluded.
• Technical/security data: the server or reverse proxy may process IP addresses and request details for security, rate limiting, and operation. These may appear in infrastructure logs outside the application database; we cannot promise that the host creates no such logs.
• Business research: when Verna staff use the business-research feature, the place or address searched is sent to OpenStreetMap’s Nominatim and Overpass services to find nearby businesses.
• AI helper: if enabled, the question you submit is processed by the local Ollama model configured on the Verna server. The application does not save chat transcripts or use them to look up customer records. Please do not submit passwords or sensitive information.

Why we use it

We use enquiry information to answer your request, discuss and deliver a project, provide support, and keep appropriate business records. We use account information to provide secure client access. Aggregate site statistics help Verna and its clients understand broad usage of their own websites. Technical information helps protect and operate the service.

Depending on the circumstances, processing may be necessary to take steps you request before entering an agreement, perform an agreement, meet a legal obligation, or pursue legitimate interests such as responding to business enquiries and protecting our systems. For our website analytics tracker we rely on your consent, which you can change using the analytics preferences at the bottom of public pages.

We do not sell personal data or use enquiry details for unsolicited marketing. We do not add people to a mailing list through these forms.

Where information is stored and who receives it

Enquiry, account, request, and aggregate website analytics records are stored in the PostgreSQL database on a server managed by Verna Solutions. The application does not send customer records to a cloud database service. Passwords are stored as hashes rather than readable passwords. Access to customer records is restricted by the application to signed-in Verna staff; client users are limited to their own company portal data. The operators remain responsible for server access, backups, and keeping that access secure.

We do not use Vercel Analytics, Speed Insights or Google Analytics. Our own optional tracker sends aggregate statistics to Verna’s server. A local-storage setting remembers your analytics choice; no analytics event is sent before opt-in, and browser Do Not Track and Global Privacy Control signals are respected. The website also uses essential session/security mechanisms for sign-in and a local-storage setting for the display theme. Choosing Remember me keeps a verified login valid for up to 30 days on that browser; otherwise the login expires after eight hours. The session cookie may remain longer, but cannot authorise access after the server-enforced deadline. Sign out on shared devices. Password changes, account disabling and authenticator resets revoke access. Client websites using Verna’s optional tracker have their own consent control.

Some features can involve external services: Cloudflare Turnstile may verify a contact-form submission if its keys are configured; OpenStreetMap receives staff-entered location searches for business research; and Resend can send enquiry notifications only if an API key is configured. We understand Resend is not currently configured, so the Verna-managed database—not an email notification—is the authoritative record. This repository cannot confirm the live server’s environment settings.

We do not use an external cloud AI provider for the Verna helper. Normal website delivery, DNS, email transport, and server infrastructure may involve providers selected or configured outside this application; check the live hosting setup for the complete list.

For analytics installed on a client’s website, the client and Verna must agree their respective data-protection roles and responsibilities before launch. Where Verna processes personal data on a client’s instructions, the parties should put the required written processor terms in place. The client remains responsible for its own privacy information and consent controls.

How long we keep information

We keep enquiries and customer records while they are needed to consider or deliver work, provide support, resolve issues, and meet applicable record-keeping obligations. We retain client account details while the account is active and for a reasonable period afterwards for security and administration. Aggregate analytics do not have an automated deletion schedule confirmed at present. We will review records and remove them when they are no longer needed, subject to legal, security, and backup constraints. We do not currently promise a fixed deletion deadline.

Your choices and rights

Where data protection law applies, you may have rights to access, correct, erase, restrict, or object to certain processing, and to withdraw consent where processing relies on it. These rights depend on the circumstances. To make a request, email sam@vernasolutions.co.uk. You may also complain to the UK Information Commissioner’s Office. We will respond within the time required by applicable law.

Use the analytics preferences at the bottom of this website’s public pages, or the equivalent control on a participating client website, to withdraw consent and stop future analytics events. Essential sign-in and security functions may not work if required session technologies are blocked.

Updates and contact

We may update this notice when our practices or legal obligations change. The date below indicates when the text was last reviewed. Questions or data requests: sam@vernasolutions.co.uk.