Privacy Policy
Last updated: 20 October 2026
1. Who we are
This policy explains how VU Credentials Ltd (“VU”, “we”, “us”) handles personal data. It is registered in England and Wales under company number 17527869, and its registered office is at 20 Wenlock Road, London, England, N1 7GU.
For the personal data described in section 3, other than the last row of its table, we are the controller under UK data protection law (UK GDPR and the Data Protection Act 2018). For privacy questions and requests, write to legal@vucredentials.com.
2. Whose data, and our role
We are the controller for personal data about:
- people who use the VU dashboard on behalf of our customers;
- people who apply for an account or contact us;
- the directors and owners of companies that apply, whom we check against sanctions lists;
- visitors to our website and callers of our API.
We are a processor for personal data about credential holders and verifiers that our customers put into credentials or presentations. The customer that issued the credential is the controller, and its own privacy notice applies: contact it about that data. We process it only to provide the Service, as our Terms of Service (section 10) set out.
3. What we collect
| Whose | What, and where it comes from |
|---|---|
| Visitors to the website and API | Your IP address, the time, the page or API address requested, the response, and your browser type. Recorded by our servers. |
| Applicants | Your company’s legal name, country, registration number and VAT number, a contact email, and anything you write in the application. From you. |
| Directors and owners of applicant companies | Names, and other details the public register shows, with the result of our sanctions check. From public company registers such as Companies House, the UK Sanctions List and the US OFAC list. |
| Dashboard users | Your email address, display name and role. The passkeys you register: a public key, a device label you choose, and when each was last used. One-time sign-in links, which expire after 10 minutes and work only in the browser that asked for them. Session tokens, which last 8 hours. A record of the actions taken in your account (the audit log), with the IP address each came from. The names and creation and last-use times of API keys; never a key itself, which we store only as a one-way hash. |
| Payers, once stablecoin payments open | The wallet addresses you register, the transactions that pay us (hash, amount, network, token), the results of sanctions screening, and the billing details on your invoices. |
| Anyone who writes to us | Your emails and our replies. |
| Credential holders and verifiers (as processor) | The claims our customers put into credentials, kept for the life of the customer’s account so that it can see, revoke and suspend them. Presentations submitted to verifiers, and the claims verified in them, deleted 30 days after the request ends. The events we send to our customers’ own systems (webhooks), which can repeat those claims, deleted 30 days after they are sent. |
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the Service: accounts, sign-in, issuing and verifying credentials, billing, support | Contract, with our customer; for its team members, our legitimate interest in providing the service the customer bought |
| Keeping the Service secure and preventing abuse: request logs, the audit log, rate limits | Legitimate interests |
| Checking applicants, their directors and owners, wallets, payments and returns against sanctions lists | Legal obligation: UK sanctions law forbids making funds or services available to designated persons. Also our legitimate interest in showing that we took reasonable care |
| Keeping tax and accounting records, and issuing invoices | Legal obligation |
| Emails about your account and the Service, such as sign-in links, payment receipts and changes to our terms | Contract, and legitimate interests |
We do not send marketing email, and we do not sell personal data.
5. Who we share it with
Our sub-processors, who process personal data for us under data protection terms:
| Provider | What it does, and where |
|---|---|
| Google Cloud (Google LLC) | Runs our API, database, key management and logs. United States (Iowa). |
| Amazon Rekognition (Amazon Web Services, Inc.) | Checks that a face is live and compares it with the photo on a passport’s chip, when we check a passport and in the face check at a business’s counter. United States (Virginia). |
| Firebase Hosting (Google LLC) | Serves our website and dashboard. Global network. |
| ZeptoMail (Zoho Corporation) | Sends sign-in links and service emails. United States. |
| Blockchain node providers | Read public blockchain data so that we can verify payments. We will name them here before stablecoin payments open. |
We also share personal data with:
- authorities, such as the Office of Financial Sanctions Implementation, HMRC, the police or a court, when the law requires;
- our professional advisers, such as accountants and lawyers, in confidence;
- anyone who buys or takes over our business, who must keep to this policy.
Public blockchains. When you pay with a stablecoin, the transfer is recorded on that blockchain, publicly and permanently, by the blockchain’s own nature. We cannot change or delete it.
6. Transfers outside the UK
Our providers process data mainly in the United States. We transfer personal data outside the UK only under a mechanism UK data protection law recognises, such as the UK Extension to the EU–US Data Privacy Framework, under which Google is certified, or the International Data Transfer Agreement or Addendum.
7. How long we keep it
| Data | Kept for |
|---|---|
| Server request logs | 30 days |
| Sign-in links and sessions | 10 minutes and 8 hours, or until used or ended |
| Account data and the audit log | While the account is open, then deleted within 30 days of its closure, except the records below |
| Applications we do not approve | 12 months |
| Sanctions checks, invoices and payment records | 6 years after our relationship ends, as UK tax rules require for financial records |
| Emails with us | 2 years after our last exchange |
| Credential claims (as processor) | While the customer’s account is open, then deleted within 30 days of its closure |
| Presentations and verified claims (as processor) | 30 days after the request ends |
| Webhook events sent to customers (as processor) | 30 days after they are sent |
| Database backups | 7 days |
| Records on a public blockchain | Permanent, and outside our control |
8. Your rights
You have the right to ask us for a copy of your personal data; to have it corrected; to have it deleted; to restrict or object to our using it; and to receive it in a portable format. Some rights depend on the lawful basis, and we may keep data the law requires us to keep.
Write to legal@vucredentials.com. We reply within one month, and may ask you to confirm who you are first. If your request is about a credential, we will pass it to the customer that issued it, who is the controller.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first.
9. Cookies and browser storage
We do not use cookies, analytics, advertising or tracking of any kind, and our website loads no third-party scripts. The dashboard stores two things in your browser, both strictly necessary for signing in:
- a session token, in session storage, cleared when you close the tab;
- a random browser identifier, in local storage, which binds a sign-in link to the browser that asked for it.
10. Automated decisions
We make no decision that has a legal or similarly significant effect on you by automated means alone. Sanctions screening is automated, but a match only holds a payment or a registration until a person reviews it.
11. Security
- Encryption in transit and at rest.
- Separation between customers enforced by the database itself, so each request can reach only its own customer’s records.
- Signing keys held in Google Cloud’s key-management service.
- API keys stored only as one-way hashes.
- Passwordless sign-in with passkeys, and a passkey confirmation for sensitive actions.
- An audit log of account actions, and access limited to those who need it.
12. Children
The Service is for businesses, and is not directed at anyone under 18.
13. Changes to this policy
We will tell dashboard users of a material change by email or in the dashboard. The date at the top shows when this policy last changed.
14. Contact
- Privacy: legal@vucredentials.com
- Support: support@vucredentials.com