Privacy Policy
Effective date:
1. Introduction
This Privacy Policy explains how Secure Technology Analytics Ltd ("we", "us", "our") collects, uses, and safeguards personal data when you use Graffiti, including its browser shortcut, accounts-analysis features, hosted APIs, and related websites (collectively, the "Service"). It also explains your rights under the UK GDPR/EU GDPR.
2. Data Controller
Secure Technology Analytics Ltd
Unit 99, The Icon
Basildon, SS14 1FH, United Kingdom
Email: privacy@stechanalytics.com
3. Data We Collect
- Account data: name, email address, organisation and licence information supplied when you create or use an account.
- AI request data: your question; the filing's structured facts and recovered untagged figures; and, where applicable, relevant narrative passages, document structure, earlier conversation turns, Review findings and Companies House comparison data.
- Technical data: IP address, browser type, operating system, timestamps, referring URLs.
- Hosted-service data: filing URLs submitted to the hosted viewer, prompts, model responses, usage records and error logs.
- Browser storage: local settings and Graffiti notes stored on your device (see Section 7).
Opening and inspecting a local filing or report package reads the original file in your browser; it is not uploaded simply because you open it. If you choose an AI feature, the extracted filing content listed above is sent through the Graffiti service to OpenAI. This applies to local files as well as web filings. Companies House and Premium live-web-search features also use hosted network requests. Graffiti notes are not included in any of these requests.
4. Purposes & Legal Bases
- Provide and operate the Service – contractual necessity.
- Maintain security & prevent abuse – legitimate interests.
- Debug, monitor, and improve the product – legitimate interests.
- Comply with legal obligations – legal requirement.
- Optional analytics or marketing – consent (where applicable).
5. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes above, after which it is deleted or anonymised. Service logs and AI request/response records can contain the hosted-service and AI request data described above. We apply retention schedules to these records and keep account data while an account is active and for a reasonable period afterwards. For the current schedule or an earlier-deletion request, contact privacy@stechanalytics.com.
6. International Data Transfers
Some service providers, including AI providers, may process data outside the UK/EEA. When doing so, we rely on Standard Contractual Clauses or other approved safeguards where required.
7. Cookies & Browser Storage
The public website does not currently use analytics or advertising cookies. Graffiti uses browser storage for local preferences and document notes. You can remove this data through your browser settings, but doing so may remove saved notes and preferences.
Notes are held on your device and are never sent to us. Because they live in your browser's storage, anyone with access to that browser profile on that machine can read them, and clearing your browsing data deletes them. Use Backup to keep a copy you control.
8. Your Rights
Subject to certain conditions, you have the right to:
- Access your personal data.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time (where processing is based on consent).
- Lodge a complaint with a supervisory authority (see Section 10).
To exercise these rights, please email privacy@stechanalytics.com. We will respond within one month as required by law.
9. Security Measures
We use reasonable technical and organisational safeguards, including TLS encryption in transit and access controls for service data. No system is completely secure, but we take reasonable steps to protect your data.
10. Complaints
If you believe we are not handling your personal data properly, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised version here and update the "Effective date" above. Continued use of the Service after changes constitute acceptance of the revised Policy.