Privacy Policy

Who we are

ROPAi Ltd is a UK-based software company providing an AI-powered GDPR compliance platform. Our service, available at ropai.io, helps organisations understand and document their data processing activities under UK GDPR.

Data Controller: ROPAi Ltd, United Kingdom

Contact: [email protected]

What data we collect

We only collect the minimum data needed to provide our service:

• Account creation: Email address (to create your account and send important updates)
• Usage data: Anonymised analytics about how you use the platform (page views, features used, errors) – we never identify you personally
• Payment data: Billing information is processed securely by Stripe and is not stored by ROPAi
• ROPA data: Any Records of Processing Activity (ROPA) you create and enter into the platform. This is your data – you are the controller, and we are the processor

We do not collect cookies for tracking or advertising. We use session cookies only to keep you logged in.

Why we collect it

We process your personal data for these lawful purposes under UK GDPR:

• Providing the service: We need your email and usage data to deliver the platform to you (Article 6(1)(b) – contract)
• Communication: We send transactional emails (password resets, invoices, service announcements) because it's necessary to perform our contract with you
• Improvement: We analyse anonymised usage data to improve features, fix bugs, and understand how the platform is used (Article 6(1)(f) – legitimate interest)

We never use your data for marketing emails or selling to third parties.

How we store and protect your data

Data location: Your data is stored with our infrastructure partners, all of whom comply with UK GDPR:

• Supabase: Our database provider (EU-based, AWS eu-west-1 region)
• Netlify: Hosts our application (CDN across Europe)
• Stripe: Processes payments securely (no data stored by us)

Security: We use industry-standard encryption in transit (TLS 1.2+) and at rest. Access to your data is restricted to authorised ROPAi staff only.

How long we keep your data

• Account data: Retained while your account is active, plus 30 days after deletion (to allow recovery)
• Usage logs: Kept for 90 days for security and support purposes, then deleted
• Payment records: Retained for 7 years to meet UK tax and accounting legal requirements
• Your ROPA data: Kept for as long as you maintain your account; deleted on request

Your rights

Under UK GDPR, you have the following rights. To exercise any of these, contact [email protected]:

• Access: Request a copy of the personal data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your data (the "right to be forgotten")
• Restriction: Ask us to limit how we process your data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest

We'll respond to all requests within 30 days. If you're unhappy with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use session cookies only – a small file that keeps you logged in while using the platform. These cookies:

• Are strictly necessary for authentication
• Expire when you close your browser (or log out)
• Do not track you across websites
• Are not shared with advertisers or analytics companies

We do not use tracking cookies, pixels, or third-party analytics that identify you personally.

Third parties we work with

We share your data only where necessary to provide the service:

• Supabase: Database and authentication (Data Processor, EU-based)
• Netlify: Application hosting (Data Processor)
• Stripe: Payment processing (Data Processor – we never see full card details)
• OpenAI: AI features use anonymised prompts only – we do not send personally identifiable information to OpenAI

All third parties are contractually obligated to protect your data and comply with UK GDPR.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in law, our service, or our practices. If we make material changes, we'll notify you by email at least 30 days before the change takes effect. Your continued use of the service after notification means you accept the updated policy.

Contact us

If you have questions about this privacy policy, how we use your data, or to exercise your rights, please contact: