Privacy Policy

Last updated: 20 March 2026

1. Who We Are

Redactly is the data controller for personal data collected through the Redactly platform. You can contact us at support@redactly.co.uk.

For documents uploaded to Redactly for processing, we act as a data processor on behalf of your organisation (the data controller). This policy covers both roles.

2. What Data We Collect

When you use Redactly, we collect:

• Account data: your name, email address, and the organisation you belong to, provided when you register or are invited
• Document data: files you upload for redaction, including any personal data they contain, processed solely to provide the redaction service
• Usage data: page counts, document statuses, and audit log entries recording actions taken within the platform
• Technical data: session tokens and authentication data managed by Supabase to keep you signed in

We do not collect payment card details directly. Payments are handled by Stripe, who are subject to their own privacy policy.

3. How We Use Your Data

We use your data to:

• Provide the Redactly service, including AI-assisted redaction and document management
• Maintain audit trails required for FOI and DSAR compliance
• Send you transactional emails such as account invitations and password resets
• Enforce retention schedules and notify you before documents are deleted
• Comply with our legal obligations

We do not use your documents or their contents to train AI models, and we do not sell your data to third parties.

4. Legal Basis for Processing

We process your data on the following legal bases under UK GDPR:

• Contract: processing necessary to provide the service you have subscribed to
• Legitimate interests: security logging, audit trails, and fraud prevention
• Legal obligation: where processing is required to comply with applicable law

5. Third-Party Services

Redactly uses the following third-party processors:

• Supabase: authentication, database, and file storage (EU-region infrastructure)
• Google Cloud: AI-assisted document analysis and redaction suggestions (EU-region processing)
• Stripe: subscription billing and payment processing
• Resend: transactional email delivery

Each processor is contractually bound to process data only on our instructions and in accordance with UK GDPR requirements.

6. Data Retention

Document retention periods are configured by your organisation admin within the platform, subject to minimum periods aligned with the ICO complaint window (90 days minimum for unredacted originals). Default retention settings are 3 years for unredacted originals and 6 years for redacted records, in line with the Limitation Act 1980 and typical LGRSS FOI records schedules.

Account data is retained for the duration of your organisation's subscription. On account closure, data is deleted within 90 days unless a longer retention period is required by law.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data where there is no lawful reason to retain it
• Object to processing based on legitimate interests
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at support@redactly.co.uk. We will respond within 30 days.

8. Cookies

Redactly uses essential cookies only: session cookies required to keep you signed in. We do not use tracking, advertising, or analytics cookies without your explicit consent. You can manage your cookie preferences via the banner shown on your first visit.

9. Security

We protect your data using encryption in transit (TLS) and at rest, row-level security on all database tables, and strict access controls. All document processing is performed server-side; unredacted content is never exposed to client-side code after finalisation.

10. Complaints

If you have concerns about how we handle your data, please contact us first at support@redactly.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice. The date at the top of this page reflects when the policy was last updated.