Privacy

We process account emails, essential session identifiers and one-use sign-in challenges; organisation and site labels; instrument identities and responsible owners; provider references; original certificates, filenames and hashes; review and decision history; batch events, actions, staff membership and reviewer designation; consent and billing/support references. Processing supplies the requested service, security and accounting obligations. Use business references where possible and upload only evidence you are authorised to retain. Do not store card data, health records, identity documents or passwords.

Account email/key fields, manufacturer records, original PDF bytes and filenames are encrypted at rest on the established Labs host. Transfer uses HTTPS in production. This is server-side encryption, not end-to-end encryption: authorised support can decrypt records. Original files are outside the public document root, and every download checks signed-in organisation membership. Necessary HttpOnly/SameSite session cookies last up to seven days. No advertising trackers, analytics SDKs, third-party fonts or cloud AI processing of workspace records are used. The workshop images are illustrative AI-generated assets, not customer evidence.

Stripe handles hosted payments; the app does not store full card details. SendGrid handles sign-in and transactional email. The established Labs host stores the application, encrypted records and logs. Seven daily same-host recovery snapshots retain encrypted files and private recovery configuration when maintenance succeeds; these do not provide off-host disaster recovery. Operational release backups also retain encrypted files; exact provider backup geography and provider-side deletion schedules have not been verified for this release. Providers may process internationally under contractual safeguards. Outbox, consent, security and contract records may contain contact details outside the encrypted workspace payload. Expired sign-in challenges and their outbox entries are cleaned up. There are no automatic provider reminders or external certificate-fetching integrations.

Workspace records persist while the service is available until account deletion is completed, subject to capacity. Retained history and originals are not silently overwritten when replaced. Billing/contract records may remain up to six years for accounting or disputes under existing terms. Keep your independently required archive. Owner exports remain available after subscription expiry; staff access requires active Pro and a current membership. Revocation blocks future access but cannot recall exported copies.

Export records and originals, revoke your sessions, manage staff access and cancellation from the workspace. Contact [email protected] for account deletion, access, correction, restriction, objection, portability or retention questions. Account deletion and billing cancellation are separate. No data sales. You may complain to the UK ICO or your local supervisory authority. Protect your email inbox and sign-in links; links to external services follow those services' privacy terms.