Last updated 12 August 2026
Veriframe converts proprietary CCTV and DVR exports into standard MP4 files. This notice explains what we hold, for how long, where it is kept, and who else is involved. It describes what the service actually does — the retention periods below are enforced by the software, not merely intended.
The data controller for the information described in "Your account" below is Veriframe Ltd, registered in England and Wales, company number 17390632.
Registered office: 82 Suite A James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
We are registered with the Information Commissioner's Office as a data controller, registration number ZC219332.
Contact: enquiries@veriframe.co.uk
These are separate and it matters which is which.
CCTV exports belong to you. You decide why they are being processed and for how long; we convert them on your instruction and nothing else. We do not view footage except where it is unavoidable to diagnose a conversion failure, we never share it, and we never use it to train anything. Footage frequently contains images of identifiable people, and may relate to criminal or insurance matters — we treat all of it as confidential.
Names, work email addresses, organisation names and the job records that go with them are ours to look after, and this notice covers how.
| What | Why | Lawful basis | How long |
|---|---|---|---|
| The export you upload or we fetch | To convert it | Contract — it is the service you asked for | Deleted as soon as conversion succeeds. We never hold the original and the result at the same time. |
| The converted MP4s and player | So you can watch and download them | Contract | 24 hours from the moment they are ready, whether or not you download them. Downloading brings deletion forward to about 15 minutes. |
| A job that fails, or is abandoned part-way | — | Contract | Failed: 2 hours, so you can ask us to look at why it failed — longer only if you do ask. Abandoned: within 6 hours. |
| Job record — your reference, format, camera count, sizes, timings | Support, billing and being able to evidence deletion | Contract, and legal obligation for the part that forms an accounting record | Retained after the footage is gone, and kept for six years where it forms part of our accounting records, which HMRC requires. Contains no footage. |
| Account details — name, work email, organisation | To let you sign in and to contact you | Contract | While the account is open, then removed on request. |
| Sign-in links and invitations | To let you in without a password | Contract | Stored only as an irreversible hash. Links expire in 20 minutes and work once. |
| Web server logs | Security and fault-finding | Legitimate interests — keeping the service secure, available and free of abuse | Job links are redacted before they are written. Rotated routinely. |
Every deletion is written to a log with its reason and the amount of data removed, so that "we convert, then purge" is something we can show you rather than something you have to take on trust.
Everything is processed and stored in the United Kingdom, in data centres certified to ISO/IEC 27001. Your footage is not copied elsewhere, and there is no backup of it — which is deliberate: a backup would outlive the retention promise above. Veriframe is not a storage service and must not be used as the only copy of anything.
| Who | What for | Where |
|---|---|---|
| OVH | Hosting and our email | United Kingdom / EU |
| OpenStreetMap | Street-map tiles, where a recording contains GPS. Fetched once during conversion and embedded, so the finished player contacts nobody. The request covers the map area the recording moved through; no footage, filenames or account details are sent. | EU |
Where any of this involves processing in the European Economic Area, it is covered by the UK's adequacy regulations for the EEA, so no additional transfer safeguards are needed. Your footage itself stays in the United Kingdom.
We do not sell data, and we do not use advertising or analytics trackers. The site sets one cookie, only after you sign in, purely to keep you signed in.
To have an account you must give us a work email address — it is how you sign in, because there are no passwords, and how we reach you about a conversion. There is no way to provide the service without it. A name is optional and only makes it easier for colleagues to tell who started a job.
Nothing here is decided by an automated process. No profiling is carried out, and no decision producing a legal or similarly significant effect is made about anyone automatically.
You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, ask us to restrict how we use it, or ask for it in a portable form. Where we rely on legitimate interests — which is only our service logs — you have the right to object, and we will stop unless we have compelling grounds not to. Write to enquiries@veriframe.co.uk and we will respond within one month.
For footage, the fastest route is the Delete now button on the job page, which removes it immediately.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk.
Sending us footage on behalf of an organisation? Where we process footage for you we act as your processor, and you may need a written data processing agreement with us. Ours is published at veriframe.co.uk/dpa and applies automatically.