Privacy notice

VeriFlow is a FaciliFlow service. When a client uses VeriFlow for its people, contracts, sites, projects and asset evidence, that client normally decides why the information is used and acts as the data controller. FaciliFlow provides the platform and normally acts as the processor.

FaciliFlow is the controller for its own staff, supplier and business-contact information.

We may process names, work email addresses, job roles, access assignments, project and site details, asset records, engineer comments, photographs and report history.

We use this information to invite authorised users, control access, carry out asset verification, provide an evidence-backed report, keep an audit trail and support the service. We only ask for information that is relevant to those purposes.

VeriFlow uses carefully selected infrastructure providers, including Supabase for application data and authentication, Vercel for hosting and Resend for transactional email. Their access is limited to what is needed to provide the service and is governed by the relevant contractual and security arrangements.

Client organisations set the business retention period for their project records. We retain issued reports and audit history for as long as the client’s contract, legal or insurance requirements need them, then securely remove or anonymise them. Invitations and working drafts should be removed when no longer needed.

You can ask the organisation that invited you to access, correct or delete your personal data, or to restrict how it is used. FaciliFlow will support the client with those requests where it acts as processor.

Access is role-based, client workspaces are isolated, and issued records retain an audit history. Do not upload unnecessary personal information or photographs of people into an asset record.

For privacy or data-protection questions, contact FaciliFlow through enquiries@facili-flow.com and include the client organisation and workspace involved.