Privacy notice

Who is responsible

The requesting accountancy firm determines why it needs an identity check and is responsible for its verification decision, lawful basis, any applicable condition for biometric processing, and retention duties. Hilltop Digital processes case information on the firm’s documented instructions. Hilltop Digital is responsible for its own account administration, security and billing records. Commercial use requires the applicable processing agreement with the firm.

Information processed

Case records can contain names, contact information, date of birth, former names, address history, identity-document images and details, selfies, provider results, reviewer notes and decisions. Didit performs document, face and liveness checks. Staff accounts contain work contact information, password hashes, access roles and security audit events. Stripe processes payments; the app does not receive full payment-card numbers.

Service providers and locations

Vercel hosts the application and private document storage. Neon provides the database. Resend delivers transactional email. Didit performs identity checks. Stripe processes payments. Application storage is configured in London where supported; this is not a guarantee that all provider processing, support or transfers remain in the UK. Provider contracts and any required transfer safeguards must be reviewed for commercial use.

Didit’s verification privacy notice explains its identity-check processing.

Temporary case storage and handover

ACSPverify is a working case system, not a seven-year hosted archive. The firm must download, open and check the complete case ZIP and save it in its own protected records system. An authorised administrator then confirms this handover. The firm remains responsible for retaining every required document and record for the applicable period, including failed attempts.

After confirmation, deletion is scheduled for 24 hours later unless the administrator chooses immediate deletion. The case is locked against changes. The service removes active identity records and documents and requests deletion of the associated Didit sessions without retaining face embeddings. Failures remain visible and retryable. A minimal receipt of handover and deletion, checksums, and necessary account, billing and security records remain.

Until handover is confirmed, records remain available and administrators receive reminders after approximately 1, 7, 14 and 30 days, then monthly. An unconfirmed download alone does not trigger deletion. This avoids deleting a firm’s only copy. Firms should complete handover promptly and contact us by post if they cannot access their account.

Deletion from the active service does not instantly erase disaster-recovery copies. ACSPverify recovery snapshots expire after seven days, with cleanup on the next four-hourly maintenance run. Unreferenced document copies are removed by the same maintenance process. A separate minimal deletion ledger is kept for 30 days after completion, or while deletion remains incomplete, so restores can reapply deletion instructions before data becomes available. Infrastructure providers may also retain recovery copies under their own configured windows and contractual policies; those limits must be confirmed before commercial client data is admitted.

Security and your rights

Documents are encrypted by the application and stored privately. Access is restricted to authorised firm members. Email messages link to the signed-in workspace rather than attaching identity records. Downloaded archives are not encrypted by ACSPverify; your firm must protect them appropriately.

Clients should contact the firm that requested their check for access, correction, objection or deletion requests. Legal recordkeeping duties may restrict deletion. For Hilltop Digital’s own account processing, write to the address above. You may complain to the Information Commissioner’s Office at ico.org.uk.