This notice is issued by Archstone Labs Ltd (company number 17041943), trading as Valgrind (“Valgrind”, “we”, “us”). Registered office: 20 Wenlock Road, London, N1 7GU, United Kingdom. It applies from 12 October 2026.
It covers valgrind.io, app.valgrind.io, and Valgrind mobile apps worldwide. Valgrind is a business product. You must give company details when you sign up, including if you are a sole trader. This notice does not replace a customer’s own privacy notice to the people stored or verified in that customer’s workspace.
1. Who is responsible
For website visitors, demo enquiries, and Valgrind account, billing, and support data, Archstone Labs Ltd is the controller.
For contacts, companies, files, connected email and calendar, voice notes, call recordings, share links, legal holds, and other records a customer stores in a workspace, the customer is the controller and we are the processor. We host that data for them. We do not treat it as ours.
For Valgrind Verify, the customer who starts a KYC, KYB, or AML check is the controller of the person or company being checked. We are the processor. We run the check through an identity-verification subprocessor. That provider’s terms apply to that slice of processing. We will name the current provider to a customer on request. We are not, by this notice, taking on the customer’s own regulated AML duties. Those stay with the customer.
Privacy requests: privacy@valgrind.io or support@valgrind.io.
2. Personal data we collect
- Identity and contact: name, email, company name, role, phone if you give it.
- Account: workspace membership, roles, authentication identifiers from WorkOS.
- Billing: plan, invoices, partial payment details processed by Stripe. We do not store full card numbers.
- Usage and device: pages viewed, product feature use, IP address, browser type, and similar logs needed to operate and secure the service.
- Support and sales: messages you send through the contact form or email.
- Customer Content (processor): contacts and companies; files; connected email and calendar; voice notes; call recordings and transcripts; share links; legal holds; mobile-app records; and similar workspace data.
- Verify Content (processor): identity documents, selfies, liveness, business-registry data, and screening results the customer submits or receives through Verify.
We do not collect special-category data as a controller. Verify may involve biometric data (for example a face match). That is processed on the customer’s instructions through our identity-verification provider. The customer must have a lawful basis, including for biometrics where the law requires it.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide Valgrind, authenticate users, and host workspaces | Contract (UK GDPR / GDPR Art. 6(1)(b)) |
| Bill subscriptions and keep accounting records | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Respond to demo, sales, and support requests | Legitimate interests in answering people who contact us (Art. 6(1)(f)), or contract if you are a customer |
| Secure the service, prevent abuse, and keep audit logs | Legitimate interests (Art. 6(1)(f)) |
| Optional analytics cookies (PostHog) | Consent (Art. 6(1)(a) and PECR / ePrivacy) |
| Optional marketing cookies and pixels | Consent (Art. 6(1)(a) and PECR / ePrivacy) |
| Process Customer Content and Verify checks | Processor instructions under the DPA (Art. 28) |
4. Cookies
Necessary storage keeps the site working. Analytics (PostHog) and marketing pixels stay off unless you allow them. See the Cookie Policy and the cookie banner.
5. Who we share data with
We share personal data with the subprocessors listed on the Subprocessors page, including Convex, WorkOS, Stripe, Resend, Vercel, Cloudflare, Bunny.net, Backblaze (encrypted file storage), an identity-verification provider for Verify, and PostHog (analytics after consent). We do not sell personal data.
Valgrind staff cannot assume a customer identity or jump into a live workspace to read Customer Content as that customer. Encrypted storage (including Backblaze) is designed so we cannot read the contents in the ordinary course.
6. International transfers
The default service uses vendors in the United States and the EEA. Convex, WorkOS, Stripe, Resend, and Backblaze typically process in the US. Verify identity checks are typically processed in the EEA. We use the UK and EU Standard Contractual Clauses where a transfer needs them. If you need a custom residency arrangement, that is an enterprise contract, not the default.
7. How long we keep data
- Account and workspace metadata: for the life of the account, then a short period needed to close it down.
- Billing and tax records: for the period UK law requires, typically six years.
- Contact-form messages: up to 24 months unless a longer sales or support thread continues.
- Security logs: for a limited period needed to investigate incidents.
- Customer Content: until the customer deletes it, closes the workspace, or instructs us otherwise, subject to legal hold the customer places in the product.
- Verify sessions: as the customer configures, and as our identity-verification provider retains under its contract with us (retention can range from days to years depending on the check).
8. Your rights
Depending on UK GDPR and EU GDPR you may request access, correction, deletion, restriction, portability, and to object. You may withdraw consent for analytics or marketing cookies at any time without affecting processing that already occurred.
To exercise rights over your Valgrind account or this website, email privacy@valgrind.io or support@valgrind.io. To exercise rights over Customer Content or a Verify check, contact the customer who controls that workspace. We will assist them under the DPA. Our identity-verification provider may also need to act on a Verify erasure instruction.
We may need to verify your identity. There is no fee unless a request is manifestly unfounded or excessive.
9. Automated decisions and AI
We do not make solely automated decisions that produce legal or similarly significant effects about website visitors or account holders.
If you ask a Valgrind AI agent to do work in your workspace, it acts on your instruction as a processor of Customer Content. We do not use Customer Content to train our models or anyone else’s.
10. Children
Valgrind is a business service. It is not directed at children under 18. We do not knowingly collect personal data from children as a controller.
11. Security
We use encryption in transit, encrypted storage, access controls, authentication, audit logs, and legal hold in the workspace. Staff cannot assume a customer identity. No method of transmission or storage is perfectly secure.
12. Complaints
Please contact privacy@valgrind.io or support@valgrind.io first. You may also complain to the UK Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/). If you are in the EEA you may contact your local supervisory authority.
13. Changes
We will update this notice when processing changes. The effective date at the top of the page is the version in force. Material changes to Customer Content processing are also handled under the DPA.