Privacy Policy
Last Updated: 03 August 2026
This Privacy Policy ("Policy") explains how VerbaFlo Limited or any of its affiliates or subsidiaries ("VerbaFlo", "We", "Us", "Our") processes Personal Data collected from You.
This Policy explains what Personal Data We collect, how We use and share that data, and Your choices concerning our data practices.
Before using Our Platform or submitting any Personal Data to VerbaFlo, please review this Policy carefully and contact Us if you have any questions.
The Platform is an AI system. Conversations you have with a VerbaFlo customer through telephone, web chat, WhatsApp, SMS or email may be handled by our AI rather than by a person. Clause 2.5 explains what that means for the data in those conversations, and our AI Transparency Notice explains it in plainer language.
1. DEFINITIONS
"Account" means any accounts or instances created by You or on Your behalf for access and use of the Platform.
"AI System" means a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as content, predictions, recommendations or decisions, within the meaning of Article 3(1) of Regulation (EU) 2024/1689 (the EU AI Act).
"Controller" means the natural or legal person, public authority, agency, or other body which alone or jointly with others, determines the purposes and means of the processing of Personal Data.
"Customer" means the entity that has subscribed to the Platform by accepting the Terms of Service or by entering into an agreement for subscribing to VerbaFlo's Platform.
"Customer Data" means all electronic data, text, messages, personal data or other materials, including without limitation Personal Data of Users, submitted to the Platform by You through Your Account in connection with Your use of the Platform.
"Personal Data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
"Platform" means the proprietary platform of VerbaFlo, an AI-driven real estate management solution, including any software, APIs or documentation and any updates, modifications or improvements thereto.
"User" means those who are designated users within the Platform or any other individual that the Customer interacts with using the Platform, including an account administrator, agents and other designated users.
"Website(s)" means the websites that We own and operate, including https://www.verbaflo.ai/.
"Terms of Service" means the binding contract between Us and the Customer that governs the Customer's access to and use of the Platform, available at https://www.verbaflo.ai/terms-and-conditions. The Website Terms of Use at https://www.verbaflo.ai/terms-and-conditions govern use of our website only.
"You" and "Your" means an identified or identifiable natural person whose Personal Data We process, whether as a Controller or as a processor acting on a Customer's behalf. Clause 1A explains which capacity applies in which circumstances, and who you should contact as a result.
1A. OUR ROLE
1A.1 VerbaFlo processes personal data in two different capacities, and which one applies determines your rights and who you should contact.
1A.2 We act as a processor in respect of Customer Data — the personal data of residents, prospects, applicants and other individuals that flows through the Platform in the course of a Customer's use of it. For that data, the Customer is the controller. The Customer decides what the Platform is used for, what it says, what data it collects and how long it is kept. If you are a resident or prospect and you want to exercise your data protection rights, your first point of contact is the property operator you have been dealing with. We will assist them in responding to you.
1A.3 We act as a controller in respect of: personal data of our own account holders and administrators; billing and payment data; data we collect from Website visitors; marketing and prospect data; recruitment data; and data we process for our own security, legal and administrative purposes.
1A.4 Where we analyse Customer Data to produce insight for a Customer, we do so within that Customer's own data and on that Customer's instruction. We do not combine one Customer's data with another Customer's data to produce insight for either of them.
2. HOW WE COLLECT, USE AND SHARE YOUR PERSONAL DATA
2.1. PERSONAL DATA THAT YOU PROVIDE US
To create a User account, to verify a User’s identity, and to help a User log into the Platform.
To communicate with a User regarding existing Platform availed by the Customer including notifications of any alerts or updates.
To send a User information about Our other products or services, events, webinars, or programs that may be of interest to such User.
To customise the Platform.
To respond to Your comments, queries, or questions, if any.
To respond to Your comments and questions and provide customer support services.
To send a User information about Our other products or services, events, webinars, or programs that may be of interest to such User.
To customise the Platform.
To give You the demo.
Third parties such as Hubspot, Salesforce who assist Us in providing these services.
Information You have filled in or have submitted via the web forms or information You have provided in Your interaction with Us.
To respond to Your queries, questions or requests.
To evaluate You for any position that You have applied for or that We may consider You at the time that You submitted Your resume or at a later date.
With external recruiters and organisations like those that do reference or background checks on Our behalf.
f. Individuals who are Customers.
To process the payment made by You and provide You the subscription to the Platform.
Third parties who process the payments on behalf of Us.
2.2. PERSONAL DATA THAT WE COLLECT NOT PROVIDED DIRECTLY BY YOU
a. Website visitor
Internet Protocol (IP) addresses, operating system and browser information, and Your session activity including page views, time spent on each page, scrolling activity, and data collected through cookies.
For market analysis and market research.
To protect Our data from threats, violations, and breaches if any.
To inform, promote and offer Our Platform to You.
Third parties who provide Us with services in connection with such processing.
b. User
To enable Customer’s access and use of the Platform and, identify and resolve technical issues in the use of the Platform.
To perform analytics, to improve the Platform and enhance User experience.
information
Information as available on those third-party services that You have made public or authorised to share with VerbaFlo.
Verification of a User’s identity and to help a User log into the Platform.
To communicate with a User regarding existing products and services availed by the Customer including notifications of any alerts or updates.
To send a User information about Our other products or services, events, webinars, or programs that may be of interest to such User.
Third-party applications that enable logging in to Your Account, sending You notifications and information about our products, services, Platform, webinars, etc.
e. Individuals who interact with Our social media accounts.
To inform, promote and market Our Platform to You.
Third parties who provide Us with services in connection with such Processing.
2.3 If You provide Us with any Personal Data relating to other individuals, You represent that You have the authority to do so, and where required, have obtained the necessary consent, and acknowledge that it may be used in accordance with this Policy. If You believe that Your Personal Data has been provided to Us improperly, please contact Us by using the information in Clause 11 below.
2.4 In addition to the details provided in the table above, We may also share Your Personal Data with:
an entity to which We divest all or a portion of Our business, or otherwise in connection with a merger, consolidation, change in control, reorganisation or liquidation of all or a portion of Our business;
law enforcement authorities, government authorities, courts, dispute resolution bodies, regulators, auditors, and any party appointed or requested by applicable regulators to carry out investigations or audits of Our activities;
professional advisors who advise and assist Us in enforcing Our contracts and policies, handling Our claims, effective management of Our company and in relation to any disputes We may become involved in;
credit reference agencies, in connection with Our own billing and payment processing, to prevent fraudulent purchases.
2.5 HOW OUR AI HANDLES YOUR CONVERSATIONS
2.5.1 The Platform is an AI system. When an individual contacts a Customer through a channel the Customer has connected to VerbaFlo — telephone, web chat, WhatsApp, SMS or email — the conversation may be handled by our AI rather than by a member of the Customer's staff. The individual is told this at the start of the interaction.
2.5.2 In the course of that conversation we process, on the Customer's behalf: the content of what is said or written; contact details; the metadata of the interaction, such as time, duration, channel and outcome; and any information the individual provides.
2.5.3 Voice calls. Where the Customer has enabled voice, calls are recorded and converted to text so that the conversation can be understood and actioned and so the Customer has a record. Outbound and inbound voice uses a synthetic voice generated by an AI system; it is not a recording of a person.
2.5.4 AI-generated content. We apply marking to AI-generated audio and text so that it can be identified as artificially generated by systems designed to detect it.
2.5.5 We use sub-processors to deliver these features, including providers of AI models and voice and messaging infrastructure. Those currently in use are listed in clause 2.2. They include providers of general-purpose AI models. We obtain the transparency documentation those providers are required to supply and can make relevant parts of it available to Customers on request.
2.6 AUTOMATED DECISION-MAKING
2.6.1 The Platform does not make solely automated decisions that produce legal effects concerning an individual or otherwise significantly affect them. Decisions about whether an application is accepted, whether a tenancy is granted, how a complaint is resolved and whether recovery action is taken are taken by the Customer and involve a person. The Platform may prepare, summarise, prioritise or recommend, and a person decides.
2.7 PROFILING AND ANALYTICS
2.7.1 On the Customer's instruction we generate analytics from conversation data, which may include: engagement and response patterns; interest and intent signals; conversation quality metrics; and forecasts of demand, occupancy or enquiry volume.
2.7.2 Where this analysis evaluates personal aspects of an individual it constitutes profiling under data protection law. The Customer is the controller for that profiling and is responsible for the lawful basis and for informing the individuals concerned. Individuals may object to profiling based on legitimate interests by contacting the Customer.
2.7.3 We do not use the Platform to evaluate the creditworthiness of natural persons, to produce a credit score, or to predict an individual's likelihood or capacity to make a payment, and our Acceptable Use Policy at https://www.verbaflo.ai/acceptable-use-policy prohibits Customers from configuring it to do so.
2.8 SENTIMENT AND EMOTION ANALYSIS
2.8.1 Where the Platform reports on the tone or sentiment of a conversation, that assessment is derived from the text of what was said. It does not analyse voice characteristics such as pitch, tone or speech patterns, and it is not an emotion recognition system within the meaning of Article 3(39) of Regulation (EU) 2024/1689.
2.8.2 Our Acceptable Use Policy prohibits Customers from using any such feature on their own employees.
3. LAWFUL BASIS FOR PROCESSING
3.1 If You are a data subject from the European Economic Area or UK, Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which We collect it.
3.2 We will normally collect Personal Data from You only where it is needed to perform a contract with You, where the Processing is in Our legitimate interests and not overridden by Your data protection interests or fundamental rights and freedoms, or where We have Your consent. In some cases, We may also have a legal obligation to collect Personal Data from You. If We Process Personal Data with reliance on Your consent, You may withdraw Your consent at any time.
3.3 If You have questions or need further information concerning the legal basis on which We collect and use Your Personal Data, please contact Us using the contact details provided below.
3A. USE OF DATA TO IMPROVE OUR SERVICES
3A.1 We do not use Customer Data, conversation transcripts or call audio to train or fine-tune the AI models that power the Platform.
3A.2 We use aggregated, de-identified operational information — such as volumes, response times and error rates — to monitor, test and improve the Platform. That information does not identify individuals and is not used to build a profile of any individual.
3A.3 Where a Customer asks us to configure or tune the Platform using its own data, we do so only for that Customer and only within its own environment.
4. INTERNATIONAL TRANSFERS
Where You are a resident of the European Economic Area or UK and when Your Personal Data is Processed outside EEA or UK, We will ensure that the recipient of Your Personal Data offers an adequate level of protection, for instance by entering into standard contractual clauses for the transfer of Personal Data as approved by the European Commission (Article 46 of the EU General Data Protection Regulation), together with the UK International Data Transfer Addendum or the UK International Data Transfer Agreement where the transfer is subject to the UK GDPR, supported by a transfer risk assessment where required. Alternatively We may rely on an adequacy decision, or We will ask You for Your prior consent to such international data transfers. You may request a copy of the safeguards We have put in place by contacting Us.
5. SECURITY OF PERSONAL DATA
5.1 We use appropriate technical and organisational measures to protect the Personal Data that We collect and Process. The measures We use are designed to provide a level of security appropriate to the risk of Processing Your Personal Data. If You have questions about the security of Your Personal Data, please contact Us using the contact details given below.
5.2 Our information security management system is certified to ISO/IEC 27001 and We maintain a SOC 2 report. Measures include encryption of data in transit and at rest, role-based access control, multi-factor authentication, logging and monitoring, supplier due diligence, and regular testing of those controls.
5.3 Where We act as processor and become aware of a personal data breach affecting Customer Data, We will notify the Customer without undue delay and provide the information they reasonably need to meet their own notification obligations. Where We act as controller, We will notify the relevant supervisory authority, and affected individuals where required, in accordance with applicable law.
6. RETENTION OF PERSONAL DATA
6.1. We retain Personal Data collected where an ongoing legitimate business requires retention of such Personal Data such as to defend or pursue legal claims, to fulfil any surviving obligations arising from a contract or to comply with any legal, tax or accounting requirements.
6.2 Where retention is no longer necessary we delete or anonymise the data. Where deletion is not technically possible we isolate the data securely from further processing until deletion is possible.
6.3 We may retain data for longer where required to comply with a legal obligation, or to establish, exercise or defend legal claims.
7. YOUR RIGHTS
7.1 You can request Us for access and correction of Your Personal Data.
7.2 If We have collected and Processed Your Personal Data with Your consent, then You can withdraw Your consent at any time. Withdrawing Your consent will not affect the lawfulness of any Processing We have conducted prior to Your withdrawal, nor will it affect Processing of Your Personal Data conducted in reliance on lawful Processing grounds other than consent.
7.3 You have the right to opt out of marketing communications We send You at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing e-mails We send You.
7.4 You can request Us for deletion and erasure of Your Personal Data.
7.5 You can object to the Processing of Your Personal Data, ask Us to restrict the Processing of Your Personal Data, or request portability of Your Personal Data.
7.6 Where You are of the opinion that Your data has been misused or that it is not being adequately protected, You may make a complaint to the Information Commissioner's Office (ICO) by contacting them at 0303 123 1113 or at ico.org.uk/make-a-complaint. Making a complaint to the ICO does not affect any other remedy available to You.
7.7 If You seek to exercise Your rights under this clause, please contact Us at the details provided below. We will verify any requests before acting on the request and respond to all requests We receive from individuals wishing to exercise their data protection rights within one month of receipt. Where a request is complex, or where We have received a number of requests from You, We may extend that period by up to two further months and will tell You within one month of receipt, explaining why.
7.8 Human review. If you have interacted with our AI and want a person to review the interaction or its outcome, you may request that. Where we act as processor, we will pass the request to the Customer, who is responsible for responding.
7.9 Reaching a person. You can ask to be transferred to a person at any point in a conversation with our AI. Our AI Transparency Notice at https://www.verbaflo.ai/ai-transparency-notice explains how.
7.10 If you are in the EEA, you may also complain to the supervisory authority in your country of residence, in addition to the routes in clause 7.6.
8. COOKIE POLICY
8.1 Cookies are text files that are placed on Your computer to collect standard internet log information and visitor behaviour information by Us. When You visit the Website(s), We may collect Personal Data automatically from You through cookies or similar technology. We set cookies to collect information that is used either in aggregate form to help Us understand how Our Website is being used or how effective Our marketing campaigns are, to help customise the Website for You or to make advertising messages more relevant to You.
8.2 Necessary Cookies: We set essential cookies that enable core functionality such as security, network management, and accessibility. You may not opt-out of these cookies. However, You may disable these by changing Your browser settings, but this may affect how the Website(s) functions.
8.3 Statistics, Preference, and Marketing Cookies: We set these cookies to help Us improve Our Website by collecting and reporting information on how You use the Website. The cookies collect information in a way that does not directly identify anyone.
8.4 When You visit the Website, a cookie banner will be displayed providing additional information about cookies and options to opt out of non-essential cookies as required by applicable laws.
9. PRIVACY OF CHILDREN
9.1 The Platform and Website are intended for use by adults. Our Website Terms of Use require Website users to be at least 18.
9.2 We do not knowingly collect personal data directly from children. Where local law sets a minimum age for consent to information society services, we apply the age applicable in the individual's jurisdiction, which in the EEA is between 13 and 16 depending on the member state.
9.3 Where a Customer uses the Platform in a context in which an applicant may be under 18 — for example a student accommodation enquiry — the Customer is responsible for establishing a lawful basis and for any parental or guardian consent required.
9.4 If a parent or guardian believes a child has provided us with personal data, please contact us at contact@verbaflo.ai and we will delete it.
10. EXCLUSIONS
Our Website(s) contain links to other websites. Our Policy applies only to Our Website(s), so if You click on a link to another website, You should read their privacy policy. We encourage You to review the privacy statements of any such other websites to understand their Personal Data practices.
11. CONTACT INFORMATION
You may contact Us if You have any inquiries or feedback on Our data protection policies and procedures in the following manner:
Email Address: contact@verbaflo.ai
Postal address: VerbaFlo Limited, Arquen House, 4-6 Spicer Street, St Albans, England, AL3 4PQ, Company Number 16007307.
12. OUR REPRESENTATIVES
If You are a resident of the EEA or the UK, please contact the representative if You have any questions or concerns about how Your Personal Data is being handled by Us. Our EU GDPR Representative is:
Rickert Rechtsanwaltsgesellschaft mbH
- VerbaFlo Limited -
Colmantstraße 15
53115 Bonn
Germany
Contact: art-27-rep-verbaflo@rickert.law
13. CHANGES TO THE POLICY
We keep this Policy under regular review and may update this webpage at any time. This Policy may be amended at any time. Where changes are material We will notify You by email or by prominent notice on the Website at least 14 days before they take effect, and We will update the "Last Updated" date at the top of this page. We encourage You to review this page periodically.
