Privacy notice

VerifyStack is sold only to verification firms (ACVAs and empanelled energy auditors). The firm decides what evidence goes in and why. VerifyStack stores and processes it on the firm's behalf, to run the verification work the firm has been engaged to do.

The audited entity does not hold an account. If a firm sends an entity a response link, this notice also applies to what that entity submits through it.

• Account details: name, work email and role, through email and password or Google sign-in.
• Evidence files: invoices, lab certificates, electricity bills, production logs, spreadsheets and SCADA exports. These can include personal data such as names and signatures.
• Extracted and entered values, with the page, cell, time range or observation each came from.
• Site fieldwork: observations, meter readings, interview notes and photos recorded by a verifier, with time and the recording user.
• Entity responses: the text and files an entity submits through a single-use link.
• Audit trail: who did what and when, kept as an append-only log.

When a Gemini API key is configured for a deployment, evidence pages may be sent to Google Gemini to classify documents and propose field values, and finding text may be sent to draft citations and corrective-action wording. We do not use extracted values to train models in this application.

Model output is a proposal. A named verifier must accept or reject each material value, and no model output is ever used as a number in a calculation.

Do not upload evidence unless your firm has a lawful basis to process the personal data and industrial records in it under the Digital Personal Data Protection Act, 2023, and under any confidentiality terms that apply to the scheme and to your engagement.

Audit events, accepted facts, calculation runs and sign-offs are append-only by design, so that a verification can be reproduced and inspected later. Evidence files are kept under their content hash.

A self-service deletion workflow is not built yet. Retention and erasure requests are handled with us directly, case by case, and we will tell you what can be removed and what the append-only record requires us to keep.

We use only the cookies needed to keep you signed in. There is no advertising or cross-site tracking. Optional error monitoring may be enabled on a deployment, and it is configured not to collect personal information by default.

You can ask to access, correct or erase personal data we hold, withdraw consent where consent is the basis, and raise a grievance. If your data was uploaded by a verification firm, we may refer the request to that firm.

Use the request form and say that it is about a privacy request.

When the product changes what it does with data, we change this page first and update the review date above.