Two different things, and only one of them involves us.

The website

What you send us

If you email us or submit a form, we hold what you wrote — your address, your name if you gave it, and the message — in order to reply. We keep it while the conversation is live and for as long afterwards as the relationship warrants, and we delete it on request.

Server logs

This site is served by Cloudflare, which records requests — IP address, user agent, the page — for delivery and abuse prevention. We do not join those to anything, do not build profiles from them, and do not use them for advertising.

If you subscribe

Your address is stored by Cloudflare and a confirmation is delivered by Resend. Nothing is sent until you confirm, an unconfirmed address is deleted after seven days, and unsubscribing removes it immediately and without asking you to identify yourself. There is no open or click tracking, so we do not know whether you read anything.

Analytics

This site runs Google Analytics 4, which records which pages are visited, roughly where from, and on what kind of device. It is the only third party loaded here and it is named explicitly in the content security policy, so your browser will refuse anything else. There is no session recording, no advertising pixel, no chat widget and no A/B testing. It is not connected to any RotaGrant deployment, and no governed record, evidence pack or customer payload is visible to it or to us. You can verify what loads from your browser's network tab, which is still a better assurance than this paragraph.

The demo console

If you ask for demo access, we record which pages of the console you open and how long you stay, against the address you gave us, in our own database rather than a third party's. Not keystrokes, not what you type, and no session replay. It is how we learn which parts of the product need explaining. The demo access page links here before you hand over an address.

Cookies

Nothing is stored until you say yes. Google Analytics runs with storage denied by default, everywhere and for everyone, so on a first visit no _ga cookie is set and nothing is read from your machine. If you allow it, that cookie is set to tell repeat visits apart; if you decline, or ignore the banner entirely, it never is. We set no cookies of our own. Your theme, your consent choice and whether you collapsed a post's contents live in localStorage and are never sent anywhere. Declining costs you nothing here, because nothing on this site is gated on it.

The product

RotaGrant is deployed in your cloud account, your data centre, or airgapped. We are not a processor of your data, because we never receive it: no payload reaches us on any code path, the platform calls no model provider, and the outbound connections a deployment could make are enumerable and disabled by default.

Which means the transfer analysis, the sub-processor list and the retention schedule that consume most vendor reviews are questions about your deployment rather than about us. Where a customer wants a data processing agreement anyway — for the support relationship, or because procurement requires one — we sign one.

Your rights, and how to use them

Where the GDPR or a comparable law applies, you can ask what we hold about you, ask for it corrected, ask for it deleted, object to our processing, or complain to your supervisory authority. Write to [email protected] and a person will answer. We do not require a form.

This describes what actually happens rather than what a template would say. It is written to be accurate, not to be exhaustive, and it has not been through outside counsel. If you need a formal notice for a procurement file, ask and we will produce one that says the same things in the expected shape.