Verafy
Privacy Policy
Last updated 17 September 2026
Who we are
Verafy is operated by Cultural Capital Partners Limited, registered in England and Wales under company number 15935646, registered office 20-22 Wenlock Road, London N1 7GU. We are the data controller for the personal data described below. Contact us at privacy@verafy.co.uk.
The most important thing in this policy
Verafy gathers published information about organisations and the people who run them, so that our customers - arts, cultural and charitable organisations - can decide whether to accept money from them. That means we process personal data about people who are not our customers and who have not come to us. If you are a company director, a trustee, or a person with significant control, and an organisation has screened a company you are connected with, we may hold information about you. Part 2 is for you.
Part 1 - If you are a Verafy user
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Name, work email address, job role | To create and operate your account | Contract |
| Your organisation's name, type, mission, values and tolerance settings | To generate reports tailored to your organisation's policies | Contract |
| Records of your activity - reports created, completed and downloaded, decision records opened, feedback sent, with times | To operate the service, diagnose faults and improve the product | Legitimate interests |
| The content of the reports you produce | During the beta period only: to diagnose faults, verify accuracy and improve the product. Access is limited to our sole director, and we do not disclose which organisations you have screened, or your assessments of them, to anyone | Legitimate interests, disclosed to you in your beta agreement |
| Technical data - IP address, browser type, session information | Security and fault diagnosis | Legitimate interests |
We do not use advertising cookies or third-party advertising analytics.
Who we share it with
| Provider | What they do |
|---|---|
| Supabase Pte. Ltd. | Database, login and file storage |
| Railway Corp. | Hosting for our report generation service |
| Anthropic PBC | The large language model that summarises the material we gather and drafts report narrative |
| Resend | Sending account and report notification emails |
Some of these providers process data outside the United Kingdom. Where they do, the transfer is made under the UK Addendum to the EU Standard Contractual Clauses or an equivalent safeguard. The large language model is accessed through the Anthropic API, whose commercial terms provide that inputs and outputs submitted through the API are not used to train its models.
We do not sell personal data and we do not share it for advertising.
How long we keep it
Account data: while the account is open, then 12 months. Reports and their underlying data: for the term of our customer's agreement with us, and 30 days after it ends. Activity logs: 12 months. Feedback: kept in a form that does not identify you.
Part 2 - If you appear in a Verafy report
Why we hold information about you
A Verafy customer, usually an arts or cultural charity, asked us to check an organisation you are connected with, because they were considering accepting funding, sponsorship or a donation from it. We gathered published information about that organisation, which includes information about the people who direct or control it.
Where it comes from
Every piece of personal data in a Verafy report comes from a source that is already public: Companies House; the Charity Commission for England and Wales; the UK, UN and US sanctions lists published by OFSI, the United Nations and OFAC; the Financial Conduct Authority register; the Gender Pay Gap Service; and published news reporting.
We do not buy personal data from data brokers, we do not collect it from private sources, and we do not collect it from social media profiles.
What we do with it
We match published records to the organisation our customer asked about, summarise them, and present them to that customer in a report. A large language model drafts the narrative summary. The report is a research aid about an organisation. It does not make a decision about you, and no decision about you is made by automated means.
Our lawful basis
We process this data under legitimate interests - the interest of charitable and cultural organisations in understanding who they take money from, and the wider public interest in the propriety of charitable funding. We have carried out a legitimate interests assessment balancing that interest against your rights, and will provide a summary of it on request.
Your rights
You have the right to be told what we hold about you, to have inaccurate data corrected, to object to our processing, and to ask for erasure. Email privacy@verafy.co.uk and we will respond within one month. Where an inaccuracy is in a public register we will correct our copy, but the register itself must also be corrected at source, because we reproduce what it says.
We will not tell you which of our customers screened which organisation, because that is their confidential information, but we will tell you what we hold about you and where it came from. We will not use your data for marketing and we will not sell it.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
We will post changes here and update the date at the top. If a change is significant we will tell account holders directly.