Verdure
Privacy Policy
Last updated: 20 July 2026 · Version: 1.2
This policy explains what personal information Verdure Studio Limited (“Verdure”, “we”, “us”) collects when you use the Verdure website and service, why we collect it, who we share it with, and the rights you have over it. We are the “controller” of your personal information under the UK GDPR and the Data Protection Act 2018.
1Who we are
Verdure is a service operated by Verdure Studio Limited, a company registered in Scotland (company number SC896086), with its registered office at 5 South Charlotte Street, Edinburgh EH2 4AN.
For any privacy question, or to exercise your rights, contact us at support@myverdure.garden.
2The information we collect
We collect the following when you use Verdure:
- Account details — your email address, and an encrypted form of your password.
- Photographs of your garden that you upload. These may incidentally show the exterior of your property, vehicles and number plates, and people — so we treat every uploaded photo as personal information.
- Location — the postcode or place name you enter, used to look up your local climate.
- Garden preferences — for example style, which way the garden faces, soil type, allergy sensitivity, the time you can give, and budget.
- The plans we generate for you, and any saved versions.
- Purchase records — when you commission a garden, payment is taken by Stripe; we keep a record of the purchase (what was bought, the amount and currency, your billing country, and its Stripe reference) but we never see or store your card number.
- Feedback you choose to give during the beta.
- Technical information — your IP address and basic request logs, used for security and to prevent abuse.
3How and why we use it
We use your information only for these purposes, each with a lawful basis under the UK GDPR:
| What we do | Lawful basis |
|---|---|
| Create your account and sign you in | Performance of our contract with you |
| Analyse your photo and preferences to generate a garden plan, visualisation and planting calendar | Performance of our contract with you |
| Look up climate and plant data for your location | Performance of our contract with you |
| Keep the service secure and prevent abuse (rate-limiting, logs) | Our legitimate interests in protecting the service |
| Understand and improve the product using beta feedback | Our legitimate interests; consent where you volunteer feedback |
| Take payment for a garden commission and keep records of it | Performance of our contract with you; our legal obligations (tax and accounting records) |
| Send you service messages (e.g. password reset, email confirmation) | Performance of our contract with you |
| Send marketing, if you have opted in | Your consent (which you can withdraw at any time) |
| Produce anonymised, aggregated statistics (which can no longer identify you) to understand and improve the service | Our legitimate interests |
4Your photographs and AI processing
Your photos are sent to third-party AI providers
To produce your plan and the “after” images, the photograph you upload is sent to and processed by external artificial-intelligence providers — currently Anthropic (the written plan and calendar), OpenAI (the visualisation image), and Google (the sunlight heat-map). These providers are based in the United States. They process your photo to return a result to us; under our agreements with them your photo is not used to train their public models. We only ever send your photo and the preferences needed to generate your plan — never your account password.
5Who we share information with
We do not sell your personal information. We share it only with the service providers (“sub-processors”) that make Verdure work, and only as far as each needs:
| Provider | What they handle | Location |
|---|---|---|
| Anthropic | Generates your plan and seasonal calendar from your photo and preferences | United States |
| OpenAI | Generates the “after” visualisation from your photo | United States |
| Google (Gemini) | Generates the sunlight heat-map from your photo | United States |
| Replicate | Hosts image-generation models | United States |
| Stripe | Payments — your card details are entered on and held by Stripe, never by us; we receive your billing country and a payment reference | United States / EU |
| Supabase | Account sign-in, database, and photo storage | United Kingdom / EU |
| Resend | Sends our service emails — sign-up confirmation and password reset — to your email address | United States / EU |
| Upstash | Rate-limit counters that help prevent abuse of the service | United States |
| Perenual | Plant reference data | United States |
| Open-Meteo | Local climate and weather lookups | European Union |
| Railway | Website hosting | European Union (West) |
| Wikipedia · iNaturalist · Unsplash | Plant photo lookups — we send plant names only, never your data | Various |
We may also disclose information if required by law, or to establish, exercise or defend legal claims.
6International data transfers
Some of the providers above are outside the UK — notably the United States AI providers in sections 4 and 5. Where your information is transferred outside the UK, we rely on appropriate safeguards: the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the UK International Data Transfer Agreement (or the International Data Transfer Addendum to the EU Standard Contractual Clauses). You can ask us for more detail on the safeguards in place.
7How long we keep it
We keep your account, photos and plans for as long as your account is open, so you can return to your gardens. When you delete your account — or ask us to erase your data — we remove it from our live systems within 30 days, and from routine backups within 90 days. We may keep minimal records for longer where the law requires it (for example, tax or fraud-prevention records).
8Your rights
Under UK data protection law you have the right to: access a copy of your information; have inaccurate information corrected; have your information erased; restrict or object to how we use it; receive your information in a portable format; and withdraw any consent you have given. To exercise any of these, email support@myverdure.garden — we will respond within one month.
If you are unhappy with how we have handled your information, you can complain to the ICO at ico.org.uk, though we’d appreciate the chance to put things right first.
9Cookies and local storage
Verdure uses only essential cookies and browser storage needed to sign you in and run the service — we do not use advertising or tracking cookies. See our Cookie & Storage Notice for the detail.
10Children
Verdure is not intended for children. You must be at least 13 years old to create an account, in line with the UK GDPR age of consent.
11How we protect your information
We take reasonable technical and organisational measures to keep your information safe: traffic to and from Verdure is encrypted in transit (HTTPS); your data is held in access-controlled databases with row-level security, so accounts are isolated from one another; passwords are stored only in hashed form; and access to production systems is limited to those who need it. No online service can be completely secure, but we work to protect your information and will notify you and the ICO of a personal-data breach where we are required to.
12US residents (including California)
If you use Verdure from the United States, this section applies to you in addition to the rest of this policy. The categories of personal information we collect, and the purposes we use it for, are set out in sections 2–5. We do not sell or “share” your personal information (as those terms are used under California law), and we do not process it for cross-context behavioural advertising.
Subject to your local law, you may have the right to know what personal information we hold about you, to request a copy, to ask us to delete or correct it, and not to be treated differently for exercising these rights. To make a request, email support@myverdure.garden; we will verify it and respond within the time your law allows.
13Changes to this policy
We may update this policy as Verdure develops. When we make a material change we will update the date at the top and, where appropriate, let you know by email.
14How to contact us
For any question about this policy or your information, contact Verdure Studio Limited at support@myverdure.garden.