Privacy Policy

Viculo is a platform for identity-verified building communities. We are the data controller responsible for your personal data. This policy explains what we collect, why, and how you can control it.

Viculo is registered with the Information Commissioner's Office (ICO) as a data controller under the UK GDPR. ICO registration number: ZC186230.

For privacy enquiries, contact us at support@viculo.io.

We collect the following categories of data:

• Identity data: Full name, date of birth, and government-issued ID (processed during onboarding for verification only).
• Biometric data: Facial scan and liveness check, processed by our verification partner during onboarding. Viculo does not store raw biometric data after verification completes.
• Residency data: Proof of address documents (utility bills, lease agreements) used to confirm your building membership.
• Contact data: Email address and, where provided, mobile number.
• Usage data: Posts, messages, maintenance requests, and calendar activity you create on the platform.
• Technical data: IP address, browser type, device identifiers, and session logs for security purposes.
• Analytics data: Page views and interaction events, collected only with your explicit cookie consent.

We rely on the following lawful bases under UK GDPR:

• Contract (Art. 6(1)(b)): Processing your name, email, and residency data to provide the platform service.
• Explicit consent (Art. 9(2)(a)): Processing biometric data for identity verification. You provide this consent during onboarding and may withdraw it by deleting your account.
• Legitimate interests (Art. 6(1)(f)): Processing technical and security data to protect the platform and its users.
• Consent (Art. 6(1)(a)): Analytics cookies and tracking, only when you accept via the cookie banner.

• To verify your identity and building residency during onboarding.
• To provide access to your building's community features (chat, notices, maintenance).
• To send you notifications related to your building activity.
• To investigate security incidents and prevent fraud.
• To improve the platform, using aggregated and anonymised analytics (only with your consent).

We share data only with service providers necessary to operate the platform, each bound by a Data Processing Agreement:

• Didit Identity: Processes your government ID and biometric data for identity verification. Acts as an independent data processor for the verification step.
• Supabase: Hosts our database and authentication infrastructure on servers in the EU.
• Vercel: Hosts our web application and serves pages globally via CDN.
• PostHog: Provides product analytics, only when you have consented to analytics cookies. Data is hosted in the EU.

We do not share your personal data with other residents. Your verification status is visible to building managers; your documents are not.

Our core infrastructure (Supabase, PostHog) is hosted within the EU/EEA. Vercel operates a global CDN, meaning request metadata may pass through servers outside the UK/EEA. Where transfers occur, they are covered by Standard Contractual Clauses or equivalent safeguards.

• Identity and residency documents: Not retained by Viculo after verification completes. Didit's own retention policy applies to data processed by them.
• Profile and usage data: Retained for the lifetime of your account, plus 30 days after deletion to allow recovery from accidental deletions.
• Analytics data: Retained for 12 months in PostHog, then automatically deleted.
• Security logs: Retained for up to 12 months for fraud prevention.

You have the following rights, which you can exercise at any time:

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Ask us to correct inaccurate data.
• Erasure (Art. 17): Request deletion of your data (the "right to be forgotten").
• Restriction of processing (Art. 18): Ask us to pause processing while a dispute is resolved.
• Portability (Art. 20): Receive your data in a machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent for biometric processing or analytics at any time.

To exercise any right, visit Settings: Your Data Rights (if you are logged in) or email support@viculo.io. We will respond within 30 days.

We use cookies in two categories: necessary (required for the platform to function) and analytics (optional, used to improve the product). You can manage your choices at any time via the cookie banner or by contacting us.

Analytics cookies are never set without your explicit consent.

If we make material changes to this policy, we will notify you by email and display a notice in the app at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance.