Verbench Privacy Policy
Last updated: 3 November 2026
This policy explains how Verbench handles personal data. It covers four groups of people: clients (organisations that use Verbench and their staff), candidates (people invited to take a test), website visitors and businesses we contact about our service.
1. Who we are
Verbench is a trading name of Sugar Social Networks Ltd, registered in England and Wales (company number 12497429), 17 Green Lanes, London N16 9BS. We are registered with the Information Commissioner's Office (ICO), reference ZC257586.
For any privacy question or request, email privacy@verbench.com.
2. Candidates
Who is responsible for your data
The organisation that invited you is responsible for your data (the "controller"). We process it on their behalf, to deliver the test and report to them. For questions about how they use your results, contact them. You can also contact us, and we will pass your request on.
What we collect
- Your name and email address, given to us by the organisation that invited you.
- The role or roles you are tested for, and any extra time the organisation has allowed (as a percentage only, never with a reason).
- Your answers, the time taken for each question, and your scores.
- Test-integrity records: for example, how often and for how long you left the test window, and attempts to copy or highlight questions. These are recorded as facts. They do not change your score.
We do not ask for, and do not need, information about your health, ethnicity, religion or other sensitive matters.
How it is used
- To run your test and produce a report for the organisation that invited you.
- To send you emails about your test: the invite, and a short summary of your result if the organisation has chosen to share it.
The organisation decides whether to interview or hire you. A person makes that decision. Verbench does not make hiring decisions, and results are not a qualification.
Lawful basis
The organisation that invited you relies on its legitimate interest in assessing candidates for a role. Ask them for details.
How long it is kept
Your test data is deleted automatically 12 months after your test, or after the invite expires if you never took the test. The organisation can delete it sooner.
3. Clients
What we collect
- Your name, work email address and organisation name, and whether you are a recruitment agency or an employer.
- Purchase records: what you bought, when, prices and VAT. Card details are handled by Stripe; we never see or store your full card number.
- Information about how you use your account, such as invites sent, and technical information needed to keep the service secure.
How it is used and lawful basis
| Use | Lawful basis |
|---|---|
| Providing your account and the service | Contract |
| Taking payment and issuing VAT invoices | Contract and legal obligation |
| Keeping accounting records | Legal obligation |
| Keeping the service secure and preventing misuse, including one free offer per company email domain | Legitimate interests |
| Telling you about important changes to the service | Contract and legitimate interests |
How long it is kept
Account details are kept while your account is open and for up to 12 months after it closes. Invoices and payment records are kept for 6 years, as UK tax law requires.
4. Website visitors
Our website (verbench.com) and our sign-up page use Vercel Web Analytics to count visits, and to count sign-ups and first invites (without names, emails or other personal details). It does not use cookies and does not identify you; it records only anonymous data such as the page viewed, the referring site, and the country and type of device.
5. Contacting businesses about our service
We sometimes email businesses that may want to use Verbench, such as recruitment agencies and employers that hire finance staff. For this, we are responsible for the data (the "controller").
What we collect
- Business contact details only: name, job title, work email address, company and company website.
- Our notes of the emails we send and the replies we receive.
Where it comes from
- Public sources, such as job boards and company websites. We only use email addresses that are published there.
- Business contacts we already have.
We do not buy contact lists and we do not guess email addresses.
Lawful basis
We rely on legitimate interests: telling businesses about a service that is relevant to their hiring. We balance this against your rights. We only email work addresses at companies. We never email personal or free-mail addresses, such as Gmail or Outlook.
How to opt out
Reply "no thanks" or "unsubscribe" to any of our emails, or email info@verbench.com. We stop at once. We keep a small record of your email address and company domain so that we never contact you again. We keep this record permanently, and only for this purpose.
How long it is kept
We delete other contact details 12 months after our last contact with you, unless you become a client. We delete them sooner if we no longer need them.
Who processes it
| Provider | What they do | Where |
|---|---|---|
| Google Sheets, where we keep the contact list | USA | |
| A2 Hosting | Our email server | Netherlands |
| Vercel | Hosting the tool that sends the emails | UK or USA |
| Anthropic | Sorting email replies (for example, spotting an opt-out) | USA |
Transfers outside the UK are protected as described in section 6.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, or object to us using it. You can also complain to the ICO. See section 9.
6. Who we share data with
We do not sell personal data. We use these service providers (sub-processors) to run Verbench:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database | UK (London) |
| Vercel | Website hosting | UK (London); Vercel is a US company and may process data in the USA |
| Stripe | Payments and invoices | UK, EU and USA |
| Resend | Sending emails | EU (Ireland); Resend is a US company |
| A2 Hosting | Business email (info@ and privacy@ mailboxes) | Netherlands |
| Google Sheets (business contact list) | USA | |
| Anthropic | Sorting replies to our business emails | USA |
Where a provider processes data outside the UK, we make sure an approved safeguard is in place, such as UK adequacy regulations or the UK International Data Transfer Addendum.
We may also share data where the law requires it, or with a buyer if our business is sold, in which case this policy continues to apply.
7. Security
We protect data with encryption in transit, access controls that keep each organisation's data separate, and private, unguessable links for tests and reports. No system is perfectly secure, but we work to keep data safe and will act quickly if something goes wrong.
8. Cookies
The Verbench app uses only cookies that are strictly necessary, for example to keep you signed in. We do not use advertising cookies. Our visit counter does not use cookies (see section 4).
9. Your rights
You have the right to ask for a copy of your data, to have it corrected or deleted, to object to or restrict its use, and to ask for it to be transferred. Where we rely on consent, you can withdraw it at any time.
Email privacy@verbench.com. We will respond within one month. If you are a candidate, we may need to pass your request to the organisation that invited you.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
10. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. We will tell clients about important changes by email or in the dashboard.