Home › Legal › Privacy notice
Privacy notice
What we collect, why, who it reaches and how long we keep it. Written to be read rather than to be survived — each section opens with the plain version.
01 When we are a controller, and when we are not
For our website and sales enquiries, the decisions are ours. For everything you do inside the product, you decide and we act on your instructions.
We are a controller for our marketing site, enquiries, and our own account administration. We are a processor for the data you put into the service — the domains and vendor lists you ask us to analyse, contracts you upload, and the decisions your team records. That processing is governed by our data processing agreement, and our own sub-processors are listed here.
02 What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, work email, organisation, role | Google sign-in |
| Billing | Company name, billing contact, VAT number | You, via Stripe |
| Service data | Domains, vendor lists, uploaded contracts, decisions you record | You |
| Public data | Sub-processor pages published by companies in the register | Their own websites |
| Technical | IP address, user agent, request logs | Automatically, on request |
We do not ask for, and have no use for, special category data. Please do not upload contracts containing it.
03 Why, and on what legal basis
- To provide the service — performance of a contract.
- To keep it secure and working — legitimate interests in operating a reliable service.
- To bill you — performance of a contract, and a legal obligation to keep records.
- To email you about changes we detect — performance of a contract; this is the service.
- To send the weekly digest — consent, withdrawable in one click.
We do not sell personal data, we do not share it for advertising, and we do not profile you.
05 How long we keep it
| Data | Retained | Then |
|---|---|---|
| Account | While active, plus 30 days | Deleted |
| Uploaded contracts | Until you delete them | Deleted with the extracted clause |
| Dated change records | Retained as your compliance record | Exported on request; deleted on instruction |
| Billing records | Six years | Legal obligation |
| Request logs | 30 days | Deleted |
06 International transfers
Several sub-processors are in the United States. Those transfers rely on the Standard Contractual Clauses, and where the recipient is certified, the EU–US Data Privacy Framework. The current basis for each is recorded against its entry on the sub-processor list.
07 Your rights
Access, rectification, erasure, restriction, portability and objection. Email [email protected] and we will respond within 30 days. There is no charge and you do not need to explain why.
Where we act as a processor for your organisation, direct the request to them — we will assist them in answering it.
08 Cookies
One cookie, to keep you signed in. No tracking, no advertising, no consent banner — because there is nothing to consent to.
| Cookie | Purpose | Expires |
|---|---|---|
sp_session | Keeps you signed in | 30 days |
sp_csrf | Protects forms against cross-site requests | Session |
09 Complaints
Tell us first — [email protected]. If we do not resolve it, you have the right to complain to your local supervisory authority.