Who we are
Readybrief is run by [company name], [registered address] (“we”). We are the data controller for the personal data described here. Contact: [privacy@readybrief.co.uk]. ICO registration number: [number]. Readybrief is independent and is not affiliated with or endorsed by the SIA, the Home Office, ProtectUK or the Martyn’s Law Campaign.
What we collect, and why
- Free scope check: nothing. Your answers stay on your device unless you choose to save them to a venue.
- Venue walkthrough: what you tell us about your building and the roles of the people who run it. We send this to our AI provider to draft your procedures. If you don’t save, we don’t keep it.
- Saved venues: your procedures (stored encrypted), the name and role of the person who signs them off, your scope decision, and practice records, including any photos you add. Photos are shrunk, location and camera data are removed, and they’re stored encrypted and shown only to people with access to your venue. Purpose: to provide the service you asked for (contract).
- Staff and volunteer briefings: the name and optional role of each person who completes a briefing, and when. Purpose: so the venue can show its team has been briefed (legitimate interests of the venue and of the person briefed).
- Partner accounts: your work email address, your organisation’s name and a sign-in cookie. Purpose: to let you manage your venues (contract). We send a weekly email about venues needing attention; you can ask us to stop at any time.
- Partner waitlist: your name, organisation, work email and anything you tell us. Purpose: to contact you about Readybrief (consent, which you can withdraw).
- Martyn’s Law countdown emails: your email address, the page you signed up on, the wording you agreed to, and the dates you signed up, confirmed and unsubscribed. Purpose: to send the updates you asked for (consent, which you can withdraw at any time using the link in every email). Nothing is sent until you confirm by email.
- Contact form, email and WhatsApp messages: your name, email and message. Purpose: to reply to you (legitimate interests). The form sends your message to our inbox; we don’t store it on the website. Please don’t send security procedures this way.
- Website statistics: [if switched on] Cloudflare Web Analytics counts page visits without cookies and without identifying you.
- Abuse prevention: a one-way scrambled form of your IP address, which changes daily, to limit how often forms can be used. We never store the address itself.
Cookies
We only use one cookie, which keeps partners signed in. It is strictly necessary, so we don’t ask for consent. We use no advertising or analytics cookies. [Update if analytics are added.]
Who we share data with
- [Supabase]: database hosting in the UK/EU (London region).
- [Cloudflare]: website hosting, security and email forwarding. Requests may be handled in Cloudflare data centres outside the UK [confirm transfer safeguard].
- [Anthropic]: drafts procedures from your walkthrough answers. [Confirm: provider’s commercial terms on data retention and model training.]
- [Resend]: sends sign-in and notification emails.
Some of these providers are based in the United States. Where data leaves the UK we rely on [the UK International Data Transfer Addendum / UK–US data bridge, to confirm per provider]. We never sell personal data.
How long we keep it
- Sign-in links: 15 minutes. Sign-in sessions: 30 days.
- Saved venues, briefings and practice records (including photos): until the venue or its partner asks us to delete them.
- Waitlist details: until you ask us to delete them, and at most [24 months].
- Countdown sign-ups: unconfirmed sign-ups [deleted after 30 days]; after you unsubscribe we keep only your address and dates for [up to 2 years], to respect your choice and show you consented.
- Abuse-prevention records: [up to 1 day].
Your rights
You can ask to see, correct or delete your data, object to how we use it, or withdraw consent. Contact [privacy@readybrief.co.uk]. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.