Privacy

This page says what Verkla stores about people, who else can see it, how long it is kept, and what you can ask us to do with it.

Who is responsible

Verkla is a sole trader registered in the Netherlands at Smakkelaarsveld 79, 3511 EB Utrecht. Chamber of Commerce 50812904, VAT NL001124200B52.

You can reach us through the contact form or at [email protected].

Two different roles

Verkla handles personal data in two ways, and the difference decides who you ask about what.

For visitors to this site, people who write in, and the person who signs a business up, we decide what is collected and why. We are the controller, and this page is your notice.

For the team inside a customer's account, the business that opened the account decides what is recorded and why. They are the controller and we only act on their instructions. If you clean lodges for a company that uses Verkla, ask that company, not us. What we commit to as their processor is written into the terms.

Verkla sets no cookies at all. There is no advertising, no tracking pixel, no social button and no third party script anywhere on this site or in the app. Nobody outside Verkla is told that you were here. There is no consent banner because there is nothing to consent to.

We do count page views on this site, ourselves. When you open one of these pages, your browser tells our own server which page it was, which site you followed a link from if you came from one, and which browser you are using. We look at it to see which pages people read and which ones are not worth keeping.

Nothing in that record names you. So that we can tell one person reading three pages from three people reading one, we turn your IP address, your browser and today's date into a single short code. The date is part of it, so the code is a different one tomorrow and today's reading cannot be joined to any other day's. We erase the IP address after thirty days.

This is the public side of the site, which includes the sign-in and sign-up pages. The app and the console are not counted at all. None of these records holds your name, your email address, or anything else that points at your account.

Signing in stores two things in your own browser, in local storage rather than in a cookie: a session token and the name and role we show in the corner of the screen. They are needed for you to stay signed in, they never leave your device except as the token on requests you make, and signing out removes them.

If you write in

The contact form takes your name, your email address, your company if you fill it in, and your message. We store it and email it to ourselves so we can answer. We also record the IP address the message came from, to stop the form being used to send junk.

If you open an account

Your name, email address, business name, and the country you are in. Your browser also tells us its timezone and we keep it, so a checklist scheduled for nine in the morning happens at nine where the work is. When you put a card on the account we hold the billing details you type and a reference from our payment provider. We never receive your card number.

If a business you work for gave you an account

Your name and email address, which they entered or you did when you accepted the invitation. Then the work itself: which checklists you were given, when you opened one, which tasks you marked done and when, any note you wrote, any photo you took, and which location it was at. Every time you sign in we record the time and the browser your phone reports.

Whenever anything is used

Our server keeps ordinary technical records of requests. We record IP addresses against a small number of security events, such as a failed sign in or a signup, so that somebody trying addresses one after another can be slowed down.

We do not sell personal data, we do not share it for advertising, and we do not use it to train anything. These are the only companies involved in running Verkla:

• DigitalOcean hosts the site, the API and the database, in Amsterdam.
• DigitalOcean Spaces holds the photos, in private storage. They are reachable only through links that we create when somebody opens the page and that stop working shortly afterwards.
• Bird, formerly SparkPost, delivers the email we send: invitations, password resets, invoices and notices about an account.
• Mollie takes payment. Card details are typed on Mollie's own page and never reach us. Mollie decides for itself what it needs to hold to run a payment business, so for that part it is not acting on our instructions.

Everything is held inside the European Economic Area. If that ever has to change we will say so here and tell account owners first.

We will hand something over to an authority if the law obliges us to, and we will tell the account owner first unless we are forbidden to.

Your checklists, completed work, notes and photos are kept while the account is open. An owner can delete any photo at any time. When an account closes we keep it readable for ninety days in case the business comes back, then delete it, and an owner can ask us to delete it immediately instead.

A sign in lasts ninety days before it has to be done again. IP addresses are erased after thirty days, both the ones recorded against security events and the ones behind the page views on this site. Invoices and the figures behind them are kept for seven years, because Dutch tax law requires it, and that obligation outlasts a request to delete an account.

Names, email addresses and invoice details are encrypted before they are written to the database, so a copy of the database on its own does not name anybody. Everything travels over an encrypted connection. Photos sit in private storage rather than at a public address. Passwords are stored in a form nobody can read back, including us, which is why a forgotten password is reset rather than looked up.

When a photo is uploaded as a JPEG we remove the metadata blocks the camera added, including any GPS position the phone recorded in it. Photos uploaded in other formats, such as the HEIC an iPhone may produce, are stored exactly as they arrived and may still carry that metadata.

You can ask us for a copy of what we hold about you, to correct it, to delete it, to give it to you in a portable form, or to stop using it in a particular way. Get in touch and we will answer within a month, free of charge.

If you use Verkla because a business you work for gave you an account, the decisions about that data are theirs and not ours. Ask them first. If you ask us, we will pass it on and help them answer, but we are not allowed to delete their records for you.

If you think we have handled your data badly, tell us and we will try to put it right. You also have the right to complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens, and you can go to the one where you live instead.

When this page changes we move the date at the top, and we email account owners when the change matters.