Privacy Policy
Effective date:
1. Introduction
This Privacy Policy explains how Secure Technology Analytics Ltd ("we", "us", "our") collects, uses, and safeguards personal data when you use Graffiti, including its bookmarklet, accounts-analysis features, hosted APIs, and related websites (collectively, the "Service"). It also explains your rights under the UK GDPR/EU GDPR.
2. Data Controller
Secure Technology Analytics Ltd, United Kingdom
Email: support@stechanalytics.com
3. Data We Collect
- Account data: name, email address, organisation and licence information supplied when you create or use an account.
- Website login: a password hash, email-verification status, session records and your bookmarklet registration, including which licence it is on. Your password is not stored in plain text. Verification and recovery emails are sent through Amazon Simple Email Service.
- Licence membership: when you enter a licence key that someone else holds, the holder can see your name, email address, registration date and the share of the monthly AI allowance you have used, and can remove you from the licence. They never see your questions, filings or notes.
- Website saved items: companies and filing references you save or open through the Browse filings page, their colour flags, recent history, and website preferences. When signed in, these are stored with your account so they are available across devices. When browsing as a guest, they stay only in that browser. This feature does not record bookmarklet use or upload documents or notes.
- AI request data: your question; the filing's structured facts and recovered untagged figures; and, where applicable, relevant narrative passages, document structure, earlier conversation turns, Review findings and Companies House comparison data.
- Technical data: IP address, browser type, operating system, timestamps, referring URLs.
- Hosted-service data: filing URLs submitted to the hosted viewer, prompts, model responses, usage records and error logs.
- Browser storage: local settings and Graffiti notes stored on your device (see Section 7).
Opening and inspecting a local filing or report package reads the original file in your browser; it is not uploaded simply because you open it. If you choose an AI feature, the extracted filing content listed above is sent through the Graffiti service to OpenAI. This applies to local files as well as web filings. Companies House and Premium live-web-search features also use hosted network requests. Graffiti notes are not included in any of these requests.
4. Purposes & Legal Bases
- Provide and operate the Service – contractual necessity.
- Maintain security & prevent abuse – legitimate interests.
- Debug, monitor, and improve the product – legitimate interests.
- Comply with legal obligations – legal requirement.
- Understand how the Service is used, from our own service records rather than analytics cookies – legitimate interests.
5. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes above, after which it is deleted or anonymised. Service logs and AI request/response records can contain the hosted-service and AI request data described above. We apply retention schedules to these records and keep account data while an account is active and for a reasonable period afterwards. For the current schedule or an earlier-deletion request, contact support@stechanalytics.com.
Your website library keeps up to 50 recent items and 500 saved items. You can remove an item or clear recent history on the Browse filings page. Clearing history retains your saved companies and filings.
6. International Data Transfers
Some service providers, including AI providers, may process data outside the UK/EEA. When doing so, we rely on Standard Contractual Clauses or other approved safeguards where required.
7. Cookies & Browser Storage
The website sets no analytics, advertising or third-party cookies. It uses browser storage only for the choices and actions described below, and sets a session cookie only when you sign in. Everything it stores is needed for something you asked for, which is why there is no cookie banner.
If you sign in to the website, a session cookie remembers your account. Choosing to stay signed in keeps this session for up to 30 days. Signing out ends the website session. A bookmarklet you already have keeps working without a website login.
The website also keeps two things in your browser's local storage: your light or dark theme choice, and the filing library on your device (saved companies and filings, recent history). Graffiti in a filing keeps your document notes the same way. You can remove this data through your browser settings, but doing so removes saved notes, the library and your theme choice.
Notes are held on your device and are never sent to us. Because they live in your browser's storage, anyone with access to that browser profile on that machine can read them, and clearing your browsing data deletes them. Use Backup to keep a copy you control.
8. Your Rights
Subject to certain conditions, you have the right to:
- Access your personal data.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with a supervisory authority (see Section 10).
To exercise these rights, please email support@stechanalytics.com. We will respond within one month as required by law.
9. Security Measures
We use reasonable technical and organisational safeguards, including TLS encryption in transit and access controls for service data. No system is completely secure, but we take reasonable steps to protect your data.
10. Complaints
If you believe we are not handling your personal data properly, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised version here and update the "Effective date" above. Continued use of the Service after changes constitute acceptance of the revised Policy.