Privacy at Valoren.

Who we are

Valoren is operated by Standard Index Group, a business in formation in England and Wales. Until incorporation completes, the data controller is the proprietor of the business, trading as Standard Index Group. Valoren is its sole product.

What we collect

Account information — name, email address. Payment details are processed by Stripe and not stored by us.

Delivery address — only if you order something we post to you. We ask for it at checkout, use it to print and send that item, and share it with the printing and delivery provider handling it. We do not ask for it for anything digital, and we do not keep it once the item has arrived and its return window has passed.

Governance records — the information you enter into your records. This may include personal, financial, medical, and property details.

Usage data — how you interact with the portal, which features you use, browser type, and IP address.

Special category data — health information (your Medical Abstract record) is collected only with your explicit, unbundled consent, which you can withdraw independently without affecting other records.

The Family Handover Kit's medical page — if you choose, your GP practice, your regular medicines and your allergies, so they can be printed on the medical page of your own Kit. We collect them only if you tick the separate consent box above those questions. We delete them 30 days after your Kit is delivered, or at once if you withdraw your consent by emailing privacy@valoren.uk from the address on your order. Your Kit passes through DocRaptor, which turns it into a PDF, and Postmark, which emails it to you; each keeps its copy only for a limited period set in its own service. If you ask for a printed copy, Intelliprint prints and posts it (section V). A printed copy asked for after those 30 days has a blank medical page to fill in by hand.

Information about someone else — Caring for a Parent — when you buy Caring for a Parent, you give us your parent's name, age, address where it differs from yours, where they are living, and some details of their affairs and family. We use it only to prepare your pack, on the basis of legitimate interests (preparing the documents you asked for, about your parent's affairs), and keep it with your order until you or your parent ask us to delete it. We do not ask about your parent's health. Your pack includes a short note you can pass on to your parent, and either of you can ask what we hold, or ask us to delete it, by emailing privacy@valoren.uk and naming the order.

How we use your data

Service delivery — preparing documents, monitoring renewals, maintaining your governance system, composing professional packs.

Service communications — renewal reminders, expiry alerts, system updates. These are operational, not marketing.

Marketing — some of our free guides, checklists and samples are followed by a short series of related emails. The page tells you so above the button, before you give us your address: what will arrive, over what period, and whether one of them carries a paid offer. We do not use a separate tick box — asking for the download is the consent, and the wording you agreed to is the wording shown on that page. Every one of those emails carries a one-click unsubscribe, and once you use it we do not add you back — on any list — even if you later download something else.

Service improvement — anonymised, aggregated usage data.

Legal basis for processing

Contract performance — processing necessary to deliver the service you purchased.

Legitimate interest — service improvement, security monitoring, fraud prevention, and the information about a parent described in section II.

Consent — marketing communications, special-category health data, and analytics (PostHog), which runs only if you allow it and can be declined at any time.

Who we share data with

Supabase (UK hosting, London eu-west-2), Stripe (payment processing), Postmark (transactional email), Resend (the marketing and follow-up emails described above), Cloudflare (runs the services that hold your enrolment record, your unsubscribe link and the schedule those emails are sent on), Trustpilot (when we email you certain free resources, your address is copied to Trustpilot so it can invite you to review us — you are free to ignore it), DocRaptor (document generation), Intelliprint (Innovate: Print, Direct Mail and Fulfilment Ltd, Leeds — prints, envelopes and posts a printed copy when you ask for one; they receive your name, postal address and that document, for that purpose only), Anthropic PBC (document and correspondence processing infrastructure, US — Standard Contractual Clauses), Backblaze (secure storage provider used for the independent archive of sealed correspondence — see our Custody page for how that archive is used). These are data processors acting under our written instruction.

Analytics and error monitoring. If you allow it, PostHog (analytics, hosted in the EU) records which pages are visited and how they are used, including session replays with form fields masked — it does not run until you choose "Allow analytics" on the banner, and you can decline with no loss of service. Sentry (error monitoring) receives anonymous error reports so we can fix what breaks; these carry no name, email or record contents. Neither is used for advertising.

We do not sell your data. We do not share your data with advertisers. We do not use your data for AI training.

Data retention

Active and cancelled accounts — data is retained for the duration of your subscription and, after cancellation, for as long as you want it kept, so your records are still there if you return. It is not deleted on a schedule. You may ask us to erase it at any time and we complete that in full within one month of the request; we then retain only the legal minimum (anonymised payment records for HMRC). Where you gave us an email address for a free resource, a tool result or an enquiry and never bought anything, we keep it until you unsubscribe or ask us to erase it; unsubscribing is permanent.

One-off documents — the answers you give for a one-off document are kept with your order so we can correct or re-send it, until you ask us to delete them. The Family Handover Kit's medical page answers are the exception: we delete them 30 days after delivery.

Trusted Persons access — emergency-access records survive twelve months post-cancellation under defined conditions.

Legal obligations — financial records retained for the period HMRC requires of a sole trader (Taxes Management Act 1970 s.12B: until the fifth anniversary of the 31 January following the tax year), and for six years under the Companies Act once the company is formed.

Marketing suppression — where we hold a bereavement or vulnerability marker for you, it overrides marketing consent automatically. That check runs on our subscription and retention emails; the free-resource follow-up sequences described in section III are governed by the unsubscribe above, which is permanent.

Your rights under UK GDPR

You have the right to access your data, rectify inaccuracies, erase your data, restrict processing, data portability, object to processing, and withdraw consent.

To exercise any right, contact privacy@valoren.uk.

We will respond within thirty days. Complex requests may take up to ninety days with notification.

International transfers

Your data is hosted in the UK (London, eu-west-2). Some processing — including document and correspondence processing carried out by Anthropic PBC — takes place in the United States, with appropriate safeguards including Standard Contractual Clauses in place. Other processors operating internationally are covered by the same safeguards.

Contact and complaints

Data Protection queries: privacy@valoren.uk.

Operated by Joel Patterson, trading as Standard Index Group (in formation). Contact: hello@valoren.uk.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.