Privacy notice

Effective date: 4 November 2026

1. Introduction

This privacy notice explains how Secure Technology Analytics Ltd ("we", "us", "our") collects, uses and protects personal data when you use Graffiti. This includes its bookmarklet, accounts-analysis features, hosted APIs and related websites (together, the "Service"). It also explains your rights under the UK GDPR/EU GDPR.

2. Data Controller

Secure Technology Analytics Ltd, United Kingdom
Email: graffiti@stechanalytics.com

3. Data We Collect

• Account data: name, email address, organisation and licence information supplied when you create or use an account.
• Website login: a password hash, email-verification status, session records and your bookmarklet registration, including which licence it is on. Your password is not stored in plain text.
• Terms acceptance: which version of the Terms of Service you accepted and when, kept with your account as a record of our agreement with you.
• Payment and billing data: when you buy a plan, your name, email address, billing address, company name and VAT number if you give them, the plan and number of seats, the amount, payment status and dates, and the invoices and receipts for the purchase. Card payments are taken by Stripe. When you buy a plan by card, the seller is Onelink, Stripe's checkout service, which collects your name, email address, billing address and payment details, works out any VAT or sales tax and sends your receipts and invoices. Onelink uses that data under its own privacy policy as well as for us. We receive your name, email address, business name if you give it, the plan, the number of seats and the payment status, and see only limited card details, such as the card type and the last four digits.
• Licence membership: when you enter a licence key that someone else holds, the holder can see your name, email address, registration date and the share of the monthly AI allowance you have used, and can remove you from the licence. They never see your questions, filings or notes.
• Website saved items: companies and filing references you save or open through the Browse filings page, their colour flags, recent history and website preferences. If you are signed in, these are stored with your account and available across devices. If you browse as a guest, they stay only in that browser. This feature does not record bookmarklet use or upload documents or notes.
• Followed companies and alerts: the companies you choose to follow and since when, how often you want alerts, a record of which alerts were sent, and whether sending is paused and why. Following a company is a separate choice from saving it. Alerts go to your account email address and list new filings from the Companies House register (on paid plans, new notices in The Gazette too), which can name directors and people with control of the company. Every alert email has a one-click unsubscribe, and you can unfollow companies or turn alerts off on your account page.
• Filing content: content from the filings and other accounts documents you use with Graffiti's AI and machine-learning features, including PDFs of accounts not yet filed, such as tagged data, figures, text and layout, and data the service looks up from public sources about the company and the people connected with it.
• Your questions and the answers: the questions you ask, earlier turns of the conversation, and the answers, findings and other results the service gives you.
• Usage and technical data: IP address, browser and device details, timestamps, the addresses of filings you open through the service, usage records such as the allowance used, and error and diagnostic logs. If you send us feedback, we also keep your message, an email address to reply to and details of where you sent it from.
• Graffiti notes: when you use Graffiti with your own bookmarklet or account, the notes you write on a filing are saved to your account, so they are there on your other computers and browsers. The note text is encrypted in your browser before it is sent. We hold it with your account, a code that identifies the filing, and where each note sits on the page. Notes need a Graffiti account; without one Graffiti does not add new notes. Notes already kept in your browser stay there (see Section 7).
• Browser storage: local settings and Graffiti notes stored on your device (see Section 7).

Graffiti's AI and machine-learning features send filing data to the Graffiti service, for web filings and local files alike. A PDF of accounts is read in your browser, scanned pages included: to suggest tags the service receives each figure's row label, the headings over it, roughly how large it is (not the amount) and where it sits on the page, and looks up the company number the PDF prints; tagging never sends the PDF itself or images of its pages. Graffiti notes are not included.

Keep filings in my browser. With Keep filings in my browser on (on your profile page or on the Licence screen in a filing, or set by your licence), nothing from the filing you open leaves your browser except requests for the taxonomy files it names and the check of your licence, which sends your email address and licence key. The AI and machine-learning features, the look-ups at the data sources below, notes saved to your account and feedback from within a filing are off. When the viewer runs on your own licence, our service also refuses those requests while it is on; for your own files opened from this website without a paid plan, the viewer in your browser applies the setting. Those requests still carry what any web request does, such as your IP address and the name of the website the filing is on, and opening a filing by its web address still asks that website for it. A filing opened from Browse filings or a link to Graffiti's viewer pages is fetched by our service, whether or not the setting is on.

We share data with these kinds of recipient:

• AI and machine-learning service providers we use (currently including OpenAI and TypeSafe AI), which receive filing content, questions and related data.
• Data sources the service consults (currently including Companies House, the US SEC, GLEIF, filings.xbrl.org, OpenFIGI, the European Central Bank, The Gazette, the Charity Commission, Norway's Brønnøysund Register Centre and, on paid plans, web search), which receive the look-up, such as a company number, a charity number, a name, or a currency pair and date.
• Hosting, email and infrastructure providers (currently including Amazon Web Services).
• Payment providers (currently Stripe, and Onelink as the seller of card plans), which take card payments and receive the payment and billing data that goes with them, and our accountants, for our accounts and tax records.
• Licence holders, as described above, and anyone the law requires us to share with.

When we look up which network owns an internet address, through rdap.org, we send only the network part of the address, never the full address.

4. Purposes and Legal Bases

• Provide and operate the Service: contractual necessity.
• Send the company alerts you ask for: contractual necessity.
• Take payment and manage your plan, including renewals, cancellations and refunds: contractual necessity.
• Maintain security & prevent abuse: legitimate interests.
• Debug, monitor, and improve the product: legitimate interests.
• Our own analysis and research, including understanding how the Service is used, from our own service records rather than analytics cookies: legitimate interests.
• Train and evaluate machine-learning models, including our own: legitimate interests.
• Comply with legal obligations, including keeping invoices and payment records for tax: legal obligation.

Our legitimate interests are running a secure, reliable service and making Graffiti and its analysis better. You can object to any use that relies on them (see Section 8).

5. Data Retention

We keep personal data for as long as the purposes above need it. That includes keeping service records, filing content, questions and answers to improve the Service, for our own analysis and research, and to train and evaluate models. We keep account data while the account is active, and afterwards for as long as those purposes or the law need it. To ask what we hold or to request erasure, contact graffiti@stechanalytics.com.

When Companies House does not answer, we show the last copy of a company's details we kept (its profile, officers, persons with significant control, charges, insolvency record and filing list) with the date it was fetched. We keep a copy of the data from Companies House streaming, API and downloads, to provide the best performance and features to users.

6. International Data Transfers

Some of these providers, including AI providers, process data outside the UK, for example in the United States. Stripe and Onelink may process payment data in the United States. For those transfers we rely on UK adequacy regulations or, where they do not apply, on approved safeguards such as Standard Contractual Clauses with the UK Addendum.

7. Cookies and Browser Storage

The website sets no analytics, advertising or third-party cookies. It uses browser storage only for the choices and actions described below. It sets a session cookie only when you sign in. No cookie banner is shown, because nothing we store needs your consent. Two items are optional preferences, and you can switch them off (see below).

When you buy a plan, the checkout page is Stripe's own website, which sets its own cookies under Stripe's cookie policy. Our pages load nothing from Stripe.

If you sign in to the website, a session cookie remembers your account. It is needed to give you the signed-in service you asked for. It lasts until you close the browser, or up to 30 days if you choose Keep me signed in. Signing out ends it. A bookmarklet you already have keeps working without a website login.

The website also keeps the things below in your browser's local storage. Each is set only when you act. Nothing in local storage is sent to us, apart from Graffiti notes saved to your account as described below.

• Theme choice. Remembers light or dark. Set when you use the theme button. Kept until you clear it or switch off "Remember my choices on this device".
• Recent history. The last 50 companies and filings you open on Browse filings, when you are not signed in. Set when you open one. Kept until you clear it, remove the item or switch off "Remember my choices on this device".
• Saved companies, filings and flag colours. Kept on your device when you are not signed in, because you asked to save them. Kept until you remove them or clear your browser data. The switch below does not touch them.
• Your "do not remember" choice. A single marker, written only if you switch remembering off, so the website can respect it on your next visit. It is needed to honour your objection.
• Signing in or out in another tab. Nothing is stored. The website tells your other open tabs with a browser message that leaves no data behind.
• Graffiti in a filing. Keeps your document notes and the encryption salt for your notes in the local storage of that page. When notes are also saved to your account, it keeps a marker of which account they were saved to, stored as a code rather than your email address, and which changes are still to be sent. It also keeps your light or dark choice and the widths of tables and panels you resize, unless you switch off "Remember layout on this device" in Graffiti's Help panel. That option deletes those saved choices and leaves one marker recording that setting, so Graffiti can respect your objection. The marker is needed to honour it. Graffiti also keeps your reading position in session storage, which ends when you close the tab. When you tag a PDF or a filing yourself, Graffiti keeps a random reviewer code, not your name or email address, and writes it into the journal of edits saved with your tags, so a colleague opening your files can tell your edits from theirs.

How to object. Switch off "Remember my choices on this device" in the footer of any page. This deletes the stored theme and recent history on this device and stops the website saving them again. Saved items stay, because you asked for them. Remove them on Browse filings, or clear your browser data. "Clear recent history" on Browse filings deletes history on its own. In a filing, untick "Remember layout on this device" in the Help panel, under Display and accessibility. If you are signed in, your saved items, recent history and theme choice are held by the account service, not on your device. "Clear recent history" deletes that history too.

Notes are saved to your account when you use Graffiti with your own bookmarklet or account, with the note text encrypted in your browser before it is sent, so your notes are there on your other computers and browsers. A copy is also kept on your device. Without an account (demo links, and Open a filing or the Companies House page without your own bookmarklet) Graffiti does not add new notes. Notes already kept on your device from before stay there, and whenever we switch saving to accounts off, notes are kept only on your device. Anyone with access to that browser profile on that machine can read the notes kept there, and clearing your browsing data deletes them.

8. Your Rights

Subject to certain conditions, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing, or object to processing based on our legitimate interests, including analysis, research and model training.
• Data portability.
• Withdraw consent at any time (where processing is based on consent).
• Lodge a complaint with a supervisory authority (see Section 10).

To exercise these rights, please email graffiti@stechanalytics.com. We will respond within one month as required by law.

9. Security Measures

We use reasonable technical and organisational safeguards, including TLS encryption in transit and access controls for service data. No system is completely secure, but we take reasonable steps to protect your data.

10. Complaints

If you believe we are handling your personal data improperly, please contact us first. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.

11. Changes to This Policy

We may update this privacy notice from time to time. We will post the revised version here and update the "Effective date" above. Continuing to use the Service after changes take effect constitutes acceptance of the revised notice.