Privacy at Valoren.

Who we are

Valoren is operated by Standard Index Group, a business in formation in England and Wales. Until incorporation completes, the data controller is the proprietor of the business, trading as Standard Index Group. Valoren is its sole product.

What we collect

Account information — name, email address. Payment details are processed by Stripe and not stored by us.

Delivery address — only if you order something we post to you. We ask for it at checkout, use it to print and send that item, and share it with the printing and delivery provider handling it. We do not ask for it for anything digital, and we do not keep it once the item has arrived and its return window has passed.

Governance records — the information you enter into your records. This may include personal, financial, medical, and property details.

Usage data — how you interact with the portal, which features you use, browser type, and IP address.

Special category data — health information (P-08 Medical Abstract) is collected only with your explicit, unbundled consent, which you can withdraw independently without affecting other records.

How we use your data

Service delivery — preparing documents, monitoring renewals, maintaining your governance system, composing professional packs.

Service communications — renewal reminders, expiry alerts, system updates. These are operational, not marketing.

Marketing — only with your explicit opt-in consent, collected separately from service delivery. You can unsubscribe at any time.

Service improvement — anonymised, aggregated usage data.

Legal basis for processing

Contract performance — processing necessary to deliver the service you purchased.

Legitimate interest — service improvement, security monitoring, fraud prevention.

Consent — marketing communications and special-category health data.

Who we share data with

Supabase (UK hosting, London eu-west-2), Stripe (payment processing), Postmark (transactional email), DocRaptor (document generation), Anthropic PBC (document and correspondence processing infrastructure, US — Standard Contractual Clauses), Backblaze (secure storage provider used for the independent archive of sealed correspondence — see our Custody page for how that archive is used). These are data processors acting under our written instruction.

We do not sell your data. We do not share your data with advertisers. We do not use your data for AI training.

Data retention

Active accounts — data retained for the duration of your subscription plus ninety days after cancellation for export.

Trusted Persons access — emergency-access records survive twelve months post-cancellation under defined conditions.

Legal obligations — financial records retained for six years as required by UK Companies Act and HMRC.

Marketing suppression — bereavement or vulnerability states override marketing consent automatically.

Your rights under UK GDPR

You have the right to access your data, rectify inaccuracies, erase your data, restrict processing, data portability, object to processing, and withdraw consent.

To exercise any right, contact privacy@valoren.uk.

We will respond within thirty days. Complex requests may take up to ninety days with notification.

International transfers

Your data is hosted in the UK (London, eu-west-2). Some processing — including document and correspondence processing carried out by Anthropic PBC — takes place in the United States, with appropriate safeguards including Standard Contractual Clauses in place. Other processors operating internationally are covered by the same safeguards.

Contact and complaints

Data Protection queries: privacy@valoren.uk.

Standard Index Group, United Kingdom.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.