Legal

Privacy Policy

Last updated 26 October 2026.

Who we are

Verdin is a tool for mapping business processes in Universal Process Notation. Kwadrat Works Ltd runs Verdin. In this policy, “Verdin”, “we” and “us” mean Kwadrat Works Ltd, a company registered in England and Wales (company number 17404066). Our registered office is Suite A, 82 James Carter Road, Bury St Edmunds, IP28 7DE, United Kingdom.

We are the data controller for the personal data in this policy. The policy is written for the UK GDPR and the EU GDPR. For any question or request about your data, email hello@verdinmapper.com.

What we hold

Verdin is not designed to store sensitive or personal data. Process maps describe how work flows, not people. The personal data that we hold is:

  • Your account: your email address. If you sign in with Google, also the name and the profile picture that Google shares with us. If you use a password, we cannot read it. We also keep your two-factor sign-in set-up.
  • The content you enter: your processes, and the text that you type into them, such as activity names, notes, resource names, glossary terms and suggestions. You are responsible for this content. Do not enter personal data that you are not entitled to use. We do not scan what you type.
  • Your workspace: its name, its members and their roles. When you invite a person, we keep their email address with the invite.
  • Connected AI assistants: the name of each AI assistant that you connect to your account.
  • Records of use: counts of which functions a workspace uses, records of each Build with AI run, and short-lived counters that stop misuse. None of them holds the content of your processes.
  • Your messages to us: what you write in an email, a feedback form or a waitlist form.

If you do not sign in (guest), your processes stay on your own device. They never reach our servers, and we hold no account for you.

Why we use it, and our legal basis

  • To give you the service: sign you in, keep and show your processes, share them in your workspace and send the emails that the service needs, such as sign-in links and invites. Basis: our contract with you (Art. 6(1)(b)).
  • To keep the service secure: two-factor sign-in, limits that stop misuse, and records of errors. Basis: our legitimate interest in a secure service (Art. 6(1)(f)).
  • To make a draft with Build with AI, when you ask for it. Basis: our contract with you. Details are in AI features.
  • To improve the service: usage statistics and feature use counts. Basis: your consent if you visit from the EU or the EEA; our legitimate interest elsewhere. Details are in Usage statistics and feature use counts.
  • To answer your enquiries and feedback. Basis: our legitimate interest in replying to you (Art. 6(1)(f)).
  • To send you news about Verdin, only if you ask for it. Basis: your consent (Art. 6(1)(a)).
  • To obey the law, when the law requires us to keep or give data. Basis: legal obligation (Art. 6(1)(c)).

We do not sell your data, and we do not use it for advertising.

AI features

Members can use Build with AI to draw a draft process map from text that they paste or a document that they choose. Your browser reads the text from the document; the file itself never leaves your device. The text goes to the AI only when you ask it to build. We use it only to make the draft for you. Details are on How we use AI.

  • Who receives it: when you use Build with AI, Verdin sends your text, your answers to its questions, and the names of the resources in your workspace to the AI provider that runs the model we use at that time. We usually reach the provider through an AI routing service, such as Vercel AI Gateway (Vercel Inc.). We can change the model and the provider. To learn which provider we use now, email us.
  • Legal basis: we send your text to make the draft that you ask for, to perform our contract with you (UK and EU GDPR Art. 6(1)(b)). We keep the run records below for our legitimate interest in the cost and the quality of the feature (Art. 6(1)(f)).
  • Transfers outside the UK and the EU: the routing service and the provider can be in the United States or in other countries, so your text can leave the UK and the EU. We use only services whose data processing terms protect the transfer: the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or an adequacy decision such as the EU-US Data Privacy Framework. You can ask us for a copy.
  • Training: we use AI services only under their business terms, and we choose only services whose terms say that they do not use your text to train AI models.
  • How long the provider keeps it: the routing service and the provider use your text only to answer the request and to check for misuse. Each one deletes it after a limited time that its business terms set.
  • What Verdin keeps: Verdin does not store the text you send. For each run it records the date, the model, the number of tokens and the result, so that we can watch cost and quality. If you discard a draft and type a reason, we keep that reason with the record. We keep these records until your account is deleted, and then we delete them with it. A draft that you keep becomes one of your processes, and we store it like any other process.

Enquiries, feedback and expressions of interest

When you email us, give feedback or join a waitlist, we keep what you send: usually your name, your email address, your organisation and your message. We use it to answer you and to tell you about the thing that you asked about. Our feedback and waitlist forms run on Tally, which processes your answers for us.

An enquiry does not put you on a marketing list. We send you news about Verdin only if you ask for it separately, and every such email lets you stop it. We keep an enquiry for 24 months after our last contact with you, unless you become a customer or ask us to delete it sooner.

Usage statistics and feature use counts

Usage statistics tell us how many people visit each page and how fast the pages load. They set no cookie. What they send, and the switch to turn them off, are on Cookies and Storage.

Feature use counts (members only): when you are signed in, we count which functions your workspace uses, for example each time you open a panel. Each count records the function, the time, your account, your workspace, your role and your plan. It never records the content of your processes. We use the counts to decide which functions to improve or remove. Most counts are sent by your browser, and they obey your usage statistics choice. If you turn usage statistics off, your browser sends no counts. If you visit from the EU or the EEA, your browser sends counts only after you agree to usage statistics, and the legal basis is your consent. Elsewhere, the legal basis is our legitimate interest. Our server also counts some functions that run on it, such as signing in and Build with AI. For these the legal basis is our legitimate interest, and the usage statistics choice does not stop them. The counts stay in our own database and go to no third party. Guests are not counted.

Who we share it with

We use a small number of service providers. Each one processes data for us, only on our instructions, under data processing terms:

  • Supabase: our database and sign-in service.
  • Vercel: hosts the website and gives us the usage statistics. It can also route Build with AI requests.
  • The AI provider that runs our AI model at the time, and any AI routing service that we use. See AI features.
  • Tally: our feedback and waitlist forms.

If you choose to sign in with Google, Google handles that sign-in under its own privacy policy. We share data with others only when the law requires it.

Transfers outside the UK and the EU

Some of our providers are in the United States or in other countries. When your data leaves the UK or the EU, we use only providers whose terms protect it: the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or an adequacy decision such as the EU-US Data Privacy Framework. You can ask us for a copy.

How long we keep it

  • Your account, your content and your AI run records: until you ask us to delete your account.
  • Your workspace and its invites: until the owner deletes the workspace or the account.
  • Feature use counts: 13 months, then only a daily total for each workspace. When a workspace is deleted, its counts are deleted; when an account is deleted, the counts no longer name it.
  • Enquiries and feedback: 24 months after our last contact with you.
  • Guest work: on your device until you clear your browser storage.

How we protect it

Your data is encrypted when it travels and when it is stored. Only your account, and the people that you add to your workspace, can open your processes. Every member signs in with two-factor sign-in. No security is perfect: if a breach puts your data at risk, we will tell you and the regulator as the law requires.

Cookies and storage on your device

We use only the cookies and browser storage that the service needs, plus your display preferences. None of them is for advertising. The full list, with what each one is for and how long it stays, is on Cookies and Storage.

Your rights

You have the right to:

  • access your data: you can see all of it in the app, or ask us for a copy;
  • take it with you: you can export any process as a JSON file at any time;
  • correct it;
  • delete it: ask us to delete your account and all its data. A guest deletes everything by clearing the browser storage;
  • object to a use that rests on our legitimate interest, or ask us to restrict it;
  • withdraw your consent at any time, for example to usage statistics or to news emails.

To use a right, email hello@verdinmapper.com. We answer within one month. We can ask you to prove who you are first.

Complaints

If you are not satisfied with how we handle your data, please tell us first. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority of the EU country where you live.

Children

Verdin is a tool for work. It is not for children, and we do not knowingly hold data about anyone under 16.

Changes to this policy

The date at the top shows the last change. We update this policy before we add a service that touches personal data, for example payments. If a change is significant, we will tell members.

See also our Terms of Use and Cookies and Storage.