Privacy notice

Last updated 15 September 2026

This notice explains how Redactics collects, uses and protects personal data when you visit this website, contact us, try Redactics, subscribe to release notes or use the Redactics application on behalf of a customer, and the rights you have.

We collect only what we need to respond to you and to provide our services.
This website sets no cookies and uses no analytics or advertising tools.
We never sell personal data.
Material our customers process in Redactics is handled only on their instructions, stays in their chosen region and is never used to train AI models.

1. Who we are

Redactics is operated by Registered company name: to be confirmed, a company registered in Place of registration: to be confirmed under company number Company number: to be confirmed, with its registered office at Registered office address: to be confirmed.

We are registered with the Information Commissioner's Office under registration number ICO registration number: to be confirmed.

For anything about this notice or your personal data, email privacy@redactics.co.uk or write to us at our registered office. Our data protection contact is Data protection officer, or the named privacy lead if no DPO is appointed: to be confirmed.

2. When this notice applies

We handle personal data in two different roles, and this notice covers only the first.

As a controller, we decide how personal data is used. This covers visitors to this website, people who contact us, trial users, subscribers to release notes, the people who use the Redactics application on behalf of our customers, and our business contacts.
As a processor, we handle the material our customers put into Redactics: the emails, documents and records gathered to answer a subject access request, assess a data breach, run a pilot or deliver our managed service. The customer is the controller of that material and decides what happens to it. We process it only on their documented instructions, under a data processing agreement, and never for our own purposes.

If your personal data is in material an organisation has processed with Redactics, for example because you made a subject access request to that organisation or are mentioned in its records, that organisation's privacy notice applies and you should contact it directly. If you contact us instead, we will tell you which organisation to contact where we are able to, and pass your request to that customer without undue delay. We do not answer requests about customer material on a customer's behalf unless they instruct us to.

Customer material is never used to train or improve artificial intelligence models, ours or anyone else's. Where a customer agrees in its contract, we produce aggregate statistics from the service itself, such as how many findings needed a reviewer's decision and how long stages took. Those statistics contain no case content and no personal data. See the research page.

3. What we collect, why, and our lawful basis

Fields marked as required on our forms are the minimum we need to do what you ask. Without them we cannot respond. Please do not include health information or other special category data, or details about other people, in free-text boxes. If we receive information like that and do not need it, we delete it.

Visiting this website

What we collect: The technical details your browser sends with every request: IP address, browser and device type, the page requested, the referring page and the time. This website sets no cookies and uses no analytics or advertising tools.
Why: To deliver pages, keep the site secure, and detect and prevent abuse.
Lawful basis: Legitimate interests: operating a secure and reliable website.
How long: Up to 30 days, unless needed longer to investigate a specific security incident.

Contacting us or requesting a demonstration

What we collect: Your name, work email, organisation, organisation type, the topic you choose and anything you write in your message.
Why: To reply, arrange a demonstration or call, and keep a record of our conversation with your organisation.
Lawful basis: Legitimate interests: responding to people who contact us about our services. Where you ask about buying Redactics, taking steps at your request before entering into a contract.
How long: 24 months after our last contact with you.

Starting the guided trial

What we collect: Your name, work email, organisation, role and organisation type. While you use the trial: sign-in times and your progress through the sample case, so you can pick up where you left off. The trial contains only synthetic data.
Why: To create your workspace, send you the link, support you during the trial and follow up about it. We look at trial progress across all users to improve the guided case.
Lawful basis: Contract: providing the trial you asked for. Legitimate interests: supporting trial users, following up once, and improving the trial.
How long: Your trial workspace and its activity record are deleted 90 days after the trial ends. If your organisation becomes a customer, your details move to its customer account. Our record of the enquiry is kept for 24 months after our last contact with you.

Requesting a pilot or the procurement pack

What we collect: Your name, work email, organisation, organisation type, and the request volume, procurement route or case description you give us.
Why: To scope a pilot, send you the procurement documents and discuss next steps with your organisation.
Lawful basis: Taking steps at your request before entering into a contract, and legitimate interests in responding to procurement enquiries.
How long: 24 months after our last contact with you. A pilot itself runs under a written agreement and a data processing agreement, and the material in it is processed as described in section 2.

Emailing yourself a calculator estimate

What we collect: Your work email, your organisation if you give it, and the inputs and results of the calculator.
Why: To send you the estimate and follow up once, by a person, to ask whether it was useful.
Lawful basis: Legitimate interests: providing the estimate you asked for and a single follow-up.
How long: 24 months after our last contact with you.

Downloading templates or subscribing to release notes

What we collect: Your work email and, if you give it, your organisation.
Why: To send the template download link, or to send release notes when we publish them.
Lawful basis: Templates: legitimate interests in providing what you asked for. Release notes: your consent, which you can withdraw at any time with the unsubscribe link in every email or by writing to privacy@redactics.co.uk.
How long: Until you unsubscribe. We then keep your email address on a suppression list, only so that we do not email you again.

Using the Redactics application for a customer

What we collect: Your name, work email, role and permissions, single sign-on identifiers, sign-in and security events (including IP address and device), support conversations, and, for billing contacts, invoicing details. The application records which user took each action in a case; those audit entries belong to the customer's case record.
Why: To provide the service our customer has contracted for, control access, keep the platform secure, provide support and bill the customer.
Lawful basis: Legitimate interests: providing and securing the service under our contract with your organisation. Legal obligation: keeping financial records.
How long: Account details for as long as you have access, and up to 90 days after the customer's subscription ends. Platform security logs for 12 months. Case audit entries for as long as the customer's retention settings require. Financial records for six years after the end of the financial year they relate to.

Reporting a security issue or accessibility problem

What we collect: Your contact details and the content of your report.
Why: To investigate, fix the issue and reply to you.
Lawful basis: Legitimate interests: keeping our services secure and accessible.
How long: As long as we need to resolve the report, then 24 months after our last contact with you.

Suppliers, partners and advisers

What we collect: Business contact details and correspondence.
Why: To manage our relationship and meet our contractual and legal obligations.
Lawful basis: Legitimate interests, and contract where you contract with us personally.
How long: For the length of the relationship and six years after the end of the financial year they relate to for financial records.

4. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Within the application, automated steps suggest findings; a named person at the customer makes every disclosure decision.

We share personal data only with organisations that help us run Redactics, under contracts that require them to protect it and use it only on our instructions:

Website hosting: Vercel Inc., which hosts this website and runs its server functions in its London region.
Application hosting and processing: Microsoft Azure, in the UK or EU region each customer selects.
Enquiry management: System that receives and stores enquiries, such as a CRM: to be confirmed.
Email delivery: Email service that sends workspace links, estimates, templates and release notes: to be confirmed.
Business email and documents: Email and office software used by the team, such as Microsoft 365: to be confirmed.

We may also share personal data with our professional advisers, auditors and insurers; with law enforcement, regulators or courts where the law requires it; and with a buyer or successor if our business is sold or restructured, who would be bound by this notice.

We do not sell personal data, and we do not share it with anyone for their own marketing. The providers that process customer material are listed in the Trust Centre.

6. International transfers

Customer material in the application is stored and processed only in the UK or EU Azure region the customer selects. Some providers that support the website and our business are based outside the UK, or deliver content through servers in other countries.

Where personal data is transferred outside the UK, we make sure it is protected by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Email privacy@redactics.co.uk for details of the safeguard that applies.

7. How long we keep personal data

We keep personal data only for as long as we need it for the purpose we collected it for, then delete or anonymise it. The periods for each activity are in section 3. In summary:

Website request logs: 30 days.
Enquiries, estimates and procurement requests: 24 months after our last contact with you.
Trial workspaces: 90 days after the trial ends.
Application accounts: up to 90 days after the customer's subscription ends; platform security logs 12 months.
Release notes subscriptions: until you unsubscribe.
Financial records: six years after the end of the financial year they relate to.

We may keep information longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim.

8. How we protect personal data

We use encryption in transit and at rest, role-based access, multi-factor authentication and audit logging, and we limit access to personal data to people who need it for their work. The Trust Centre describes our controls and the real status of each certification.

9. Your rights

Under UK data protection law you have the right to:

ask for a copy of your personal data (a subject access request);
have inaccurate data corrected and incomplete data completed;
have your data erased in some circumstances;
restrict how we use your data in some circumstances;
object to processing based on legitimate interests, and object at any time to direct marketing;
receive data you gave us in a portable format, where processing is based on consent or contract;
withdraw consent at any time, without affecting processing that took place before you withdrew it.

To use any of these rights, email privacy@redactics.co.uk. You do not have to use a particular form of words. It is free, and we respond within one month. If a request is complex or you make several, we may extend that by up to two further months and will tell you why within the first month. We may ask for information to confirm your identity before we act.

10. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@redactics.co.uk. We acknowledge complaints within 30 days, investigate them and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection: ico.org.uk/make-a-complaint, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Children and other websites

Our website and services are intended for organisations and their staff. They are not directed at children and we do not knowingly collect children's personal data through them.

This website links to other websites. We are not responsible for their privacy practices; read their privacy notices.

12. Changes to this notice

We update this notice when the way we use personal data changes, and change the date at the top. If a change materially affects how we use personal data you have already given us, we will tell you directly before it takes effect.