Data Processing & Sub-Processing Disclosure
This page explains how VETRO.AI LIMITED, trading as VetroCheck ("we", "us"), processes personal data as the data controller, and which sub-processors we use to provide the Service to UK users. It is a transparency and accountability disclosure, not a contract requiring signature — VetroCheck is a consumer service, and this document is addressed to individual users as data subjects rather than to a business counterparty.
1. Who We Are
VETRO.AI LIMITED, trading as VetroCheck, is the data controller for personal data processed through the Service.
Company No. 17366338
Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
Data protection contact: [email protected]
2. What We Process, and Why
| Who this concerns | Registered users of the Service, and any third parties whose personal data appears within documents that users choose to upload (for example, other tenants, employees, or family members named in a document) |
| What we process | The content of uploaded documents (which may include identifiers, financial information, and in some cases special category data); account and sign-in details; payment metadata; technical and usage logs (including IP address); records of the consents you give us |
| What we do with it | Documents are uploaded, temporarily staged, and processed to extract relevant text. Identifiable personal details are masked before the content is analysed by our AI provider. The analysis is combined with relevant legal reference material to produce your report, which is delivered as a PDF and, where applicable, by email. Temporary processing data is deleted automatically once it is no longer needed. |
| Why we do this | To provide the document analysis service you have requested, on the basis of the contract formed when you use the Service, and, for the free preview step, your consent. Where a document contains special category data, we rely on your explicit consent to that specific processing. Security-related logs are processed on the basis of our legitimate interest in keeping the Service safe and reliable. |
| How long we keep it | Free preview data: 24 hours. Paid analysis results: 30 days. Records of your consent: up to 365 days, or longer where we are required to keep them for legal reasons. Temporary upload sessions: approximately 60 minutes. Account data: for as long as your account is active, plus a reasonable period afterwards. Payment records: typically retained for up to 6–7 years where required by law. |
Further detail is available in our Privacy Policy.
3. Sub-Processors We Use
We only work with sub-processors who provide sufficient guarantees that they will process personal data in line with UK GDPR, and each is bound by a data processing agreement compliant with Article 28 UK GDPR.
The following sub-processors currently process personal data on our behalf as part of providing the Service to UK users:
| Sub-processor | Role | Location | Data categories involved |
|---|---|---|---|
| Mistral AI | AI-based analysis of document content (personal identifiers masked before processing) | European Union | Masked document content, extracted facts |
| Stripe Payments Europe Ltd | Payment processing | European Union (Ireland) | Payment metadata, transaction identifiers, billing email |
| Resend, Inc. | Delivery of account and report emails | United States | Email address, name (where provided), secure links |
| Google Ireland Limited | Sign-in via Google (optional) | EU / US | Email address, name, Google account identifier, profile image |
| Hetzner Online GmbH | Hosting, database, and file storage | European Union | All categories of data described in Section 2, as stored or processed on our infrastructure |
| Cloudflare, Inc. | Content delivery network and protection against malicious traffic | Global network with EU edge locations | IP address, request metadata |
The following providers are integrated in our systems as fallback options but do not currently process personal data of UK users, because our configuration for UK users routes all AI analysis exclusively to Mistral AI:
| Provider | Role | Location | Status |
|---|---|---|---|
| Google LLC (Gemini) | Fallback AI provider | United States | Not currently active for UK users |
| Anthropic PBC | Fallback AI provider | United States | Not currently active for UK users |
We keep this list under review. If we intend to appoint a new sub-processor that would begin processing UK user data, we will update this page and, where the change is material, take reasonable steps to notify users in advance (for example via a notice on the Service or by email).
4. International Data Transfers
Where a sub-processor is located outside the United Kingdom, we rely on appropriate safeguards recognised under UK GDPR before personal data is transferred, such as the UK International Data Transfer Addendum or the UK's Standard Contractual Clauses, as applicable to that provider.
5. Security Measures
We apply technical and organisational measures appropriate to the risks involved in processing document content, including:
- Encryption of data in transit
- Encryption of uploaded documents while temporarily staged for processing
- Masking of personal identifiers before documents are sent for AI analysis
- Access controls and logging for administrative access to our systems
- Automated deletion of data once retention periods (Section 2) expire
- Regular backups of our systems, held within access-controlled infrastructure
A more detailed technical and organisational measures record is maintained internally and can be made available to regulators or auditors on request.
6. Your Rights and Our Assistance
You can exercise your data protection rights (including access, correction, deletion, and objection) as described in our Privacy Policy. Where responding to your request requires information held by a sub-processor, we will coordinate with that sub-processor to assist in responding to you within the timeframes required by UK GDPR.
7. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so we can try to resolve the issue. You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.
8. Changes to This Disclosure
We may update this page from time to time, for example when we change sub-processors or security measures. The date below shows when it was last updated.
Last updated: 1 August 2026