Privacy Policy

Effective date: 4 October 2026

1. Introduction

This Privacy Policy explains how Secure Technology Analytics Ltd ("we", "us", "our") collects, uses and protects personal data when you use Graffiti. This includes its bookmarklet, accounts-analysis features, hosted APIs and related websites (together, the "Service"). It also explains your rights under the UK GDPR/EU GDPR.

2. Data Controller

Secure Technology Analytics Ltd, United Kingdom
Email: graffiti@stechanalytics.com

3. Data We Collect

• Account data: name, email address, organisation and licence information supplied when you create or use an account.
• Website login: a password hash, email-verification status, session records and your bookmarklet registration, including which licence it is on. Your password is not stored in plain text. Verification and recovery emails are sent through Amazon Simple Email Service.
• Terms acceptance: which version of the Terms of Service you accepted and when, kept with your account as a record of our agreement with you.
• Licence membership: when you enter a licence key that someone else holds, the holder can see your name, email address, registration date and the share of the monthly AI allowance you have used, and can remove you from the licence. They never see your questions, filings or notes.
• Website saved items: companies and filing references you save or open through the Browse filings page, their colour flags, recent history and website preferences. If you are signed in, these are stored with your account and available across devices. If you browse as a guest, they stay only in that browser. This feature does not record bookmarklet use or upload documents or notes.
• AI request data: your question; the filing's tagged data and recovered untagged figures; and, where applicable, the company number, relevant narrative passages, document structure, earlier conversation turns, Review findings, Companies House data about the company, its officers and owners, and, for US filings, SEC data about the company, its insiders and major holders.
• Technical data: IP address, browser type, operating system, timestamps, referring URLs.
• Hosted-service data: filing URLs submitted to the hosted viewer, prompts, model responses, usage records and error logs. If you send feedback from Graffiti, we also keep your message, the filing address, the screen you were on, the viewer version, your browser, language and window size, and an email address to reply to: your account email, or the one you give if you are not signed in.
• Browser storage: local settings and Graffiti notes stored on your device (see Section 7).

When you open and inspect a local filing or report package, your browser reads the original file; it is not uploaded just because you open it. If you choose an AI feature, the extracted filing content listed above is sent through the Graffiti service to OpenAI. This applies to local files and web filings. Look-ups at Companies House, the US SEC (EDGAR), GLEIF (the global register of legal entity identifiers) and, on paid plans, live web search are made by the Graffiti service. Graffiti notes are not included in any of these requests.

4. Purposes & Legal Bases

• Provide and operate the Service – contractual necessity.
• Maintain security & prevent abuse – legitimate interests.
• Debug, monitor, and improve the product – legitimate interests.
• Comply with legal obligations – legal requirement.
• Understand how the Service is used, from our own service records rather than analytics cookies – legitimate interests.

5. Data Retention

We keep personal data only for as long as needed for the purposes above, then delete or anonymise it. Service logs and AI request and response records can contain the hosted-service and AI request data described above. We delete or anonymise the questions and IP addresses in these records after one year; the usage record (account email, licence, token counts and cost) stays with the account. We keep account data while an account is active and for a reasonable period afterwards. For the current schedule or to request earlier deletion, contact graffiti@stechanalytics.com.

Your website library keeps up to 50 recent items and 500 saved items. You can remove an item or clear recent history on the Browse filings page. Clearing history retains your saved companies and filings.

6. International Data Transfers

Some service providers, including AI providers, may process data outside the UK/EEA. Where required, we rely on Standard Contractual Clauses or other approved safeguards for those transfers.

7. Cookies & Browser Storage

The website sets no analytics, advertising or third-party cookies. It uses browser storage only for the choices and actions described below. It sets a session cookie only when you sign in. No cookie banner is shown, because nothing we store needs your consent. Two items are optional preferences, and you can switch them off (see below).

If you sign in to the website, a session cookie remembers your account. It is needed to give you the signed-in service you asked for. It lasts until you close the browser, or up to 30 days if you choose Keep me signed in. Signing out ends it. A bookmarklet you already have keeps working without a website login.

The website also keeps the things below in your browser's local storage. Each is set only when you act. Nothing in local storage is sent to us.

• Theme choice. Remembers light or dark. Set when you use the theme button. Kept until you clear it or switch off "Remember my choices on this device".
• Recent history. The last 50 companies and filings you open on Browse filings, when you are not signed in. Set when you open one. Kept until you clear it, remove the item or switch off "Remember my choices on this device".
• Saved companies, filings and flag colours. Kept on your device when you are not signed in, because you asked to save them. Kept until you remove them or clear your browser data. The switch below does not touch them.
• Your "do not remember" choice. A single marker, written only if you switch remembering off, so the website can respect it on your next visit. It is needed to honour your objection.
• Signing in or out in another tab. Nothing is stored. The website tells your other open tabs with a browser message that leaves no data behind.
• Graffiti in a filing. Keeps your document notes and the encryption salt for your notes in the local storage of that page. It also keeps your light or dark choice and the widths of tables and panels you resize, unless you switch off "Remember layout on this device" in Graffiti's Help panel. That option deletes those saved choices and leaves one marker, staRememberLayout, so Graffiti can respect your objection. The marker is needed to honour it. Graffiti also keeps your reading position in session storage, which ends when you close the tab.

How to object. Switch off "Remember my choices on this device" in the footer of any page. This deletes the stored theme and recent history on this device and stops the website saving them again. Saved items stay, because you asked for them. Remove them on Browse filings, or clear your browser data. "Clear recent history" on Browse filings deletes history on its own. In a filing, untick "Remember layout on this device" in the Help panel, under Display and accessibility. If you are signed in, your saved items, recent history and theme choice are held by the account service, not on your device. "Clear recent history" deletes that history too.

Notes stay on your device and are never sent to us. Anyone with access to that browser profile on that machine can read them. Clearing your browsing data deletes them. Use Backup to keep a copy you control.

8. Your Rights

Subject to certain conditions, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with a supervisory authority (see Section 10).

To exercise these rights, please email graffiti@stechanalytics.com. We will respond within one month as required by law.

9. Security Measures

We use reasonable technical and organisational safeguards, including TLS encryption in transit and access controls for service data. No system is completely secure, but we take reasonable steps to protect your data.

10. Complaints

If you believe we are handling your personal data improperly, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the "Effective date" above. Continuing to use the Service after changes take effect constitutes acceptance of the revised Policy.