Privacy notice

Version privacy-2026-10-10, in effect from 10 October 2026.

This notice covers three groups of people: visitors to this website, the staff of companies that buy ProofPack, and anyone who writes to us. If you received a marketing email from us, the outreach privacy notice is the one for you.

Who we are

The controller is Global Phoenix Solutions Ltd, registered in England and Wales, company number 14855822. Registered office: Ground Floor Flat, 259 Chichester Road, Bognor Regis, West Sussex, PO21 5AH, United Kingdom.

Contact: Joshua Sandhu, director, joshua.sandhu@globalphoenix.co.uk. We have not appointed a data protection officer; the director handles data protection himself.

The short version

• This website sets no cookies, runs no analytics, and loads nothing from any third party except the demo’s engine files on /demo. We do not know who visits it. If a request to the site fails, your browser may send Cloudflare a report of the failure (section 1).
• ProofPack runs in your environment. No test-set row, model output or patient data reaches us. There is no upload endpoint.
• We hold the commercial record needed to sell and support a licence, and whatever you choose to write to us.

1. Website visitors

What we collect: nothing. The pages of this site are static files served by Cloudflare. There is no cookie, no analytics script, no web font and no tracking pixel, and no page makes a third-party request except for the demo’s engine files and the network error reports, both described below. Cloudflare, as host, sees the ordinary connection data any web server sees (your IP address and the page requested) in order to serve the page; we do not receive or keep it, and we have no analytics product enabled on the Cloudflare account.

The demo. The in-browser demo at /demo (its first screen, published 18 September 2026) loads the Pyodide runtime files from the jsDelivr content delivery network, which is the one third-party file the site loads, and only on that page. Anything you put into the demo is parsed and analysed inside your browser tab; there is no upload endpoint, and closing the tab discards it. No other page on this site loads anything from a third party.

Network error reports. Every response from this site carries two headers, Report-To and NEL, that Cloudflare adds and that we cannot switch off from our Cloudflare account. They ask a browser that supports network error logging to send a report to a.nel.cloudflare.com, Cloudflare’s collection address, if a request to this site fails within seven days of the browser receiving them. A request that succeeds sends no report, because the headers set the share of successful requests to report to zero. The report describes the failed request, such as the address requested and the type of error, and reaches Cloudflare from your IP address. It goes to Cloudflare, not to us.

The forms. The checkout and quote forms send what you type to our server functions for the purpose in section 2. Nothing is stored until you submit.

2. Customers and their staff

This is the data of the people at a customer company who buy, accept, install or run ProofPack.

What we hold, and where it comes from

Data	Who gives it to us	Where it is held
Legal entity name	You, at card checkout or on the quote form	Stripe (the checkout’s details on the card route; the customer record and the quote’s details on the quote route) and our database
Billing address and country	You, at card checkout or on the quote form	Stripe. No column in our database holds them; on the quote route we keep the quote PDF Stripe generates in a private file store, and it carries whatever Stripe prints on it, which may include the billing address
Buyer name and email; an accounts-payable email on the quote route	You	The buyer name: Stripe only (the billing name Stripe asks for at card checkout; our database records the licensee’s legal entity in its place, or the buyer’s email if a completed checkout names no legal entity). The emails: Stripe and our database. On the quote route the accounts-payable email is the email on the Stripe customer record, and the buyer email is in the quote’s details
Regulated model name; PO number	You	Stripe (the checkout’s or the quote’s details, and the PO number on the Stripe invoice) and our database
Plan and model count; which procurement documents you need (quote route only)	You	Stripe (the checkout’s or the quote’s details) and our database
Card details	You, on Stripe’s hosted checkout page	Stripe only. No card number reaches our code or our logs
Name and role of the person who accepts a quote, their confirmation that they are authorised to bind the company, the IP address and user-agent of the acceptance, and the time	The acceptance page	Our database (the audit record of who accepted, when, from where)
The terms and DPA versions you accepted, and the Stripe consent record	Stripe and our server	Stripe (the checkout’s or the quote’s details) and our database
The licence file we issued, its id, expiry and the invoice it was issued for	Our server	Our database and your inbox
The quote PDF	Our server	A private file store (Cloudflare Workers KV since 7 October 2026), served only through our own route
Stripe event records for your payments	Stripe	Our database (for retries and reconciliation)
Runner telemetry	Your ProofPack installation, at the end of a run, unless you run --offline or set egress.telemetry: false	Our database: the ten fields listed in clause 2.1 of the DPA and on /trust, and the time we received them, sent in one HTTP request to POST /api/telemetry on this site. No IP address, user-agent string or header is stored with them, and none of the fields is personal data

Why, and on what basis

• To sell, issue and renew the licence, and to answer support questions: performance of a contract with you, UK GDPR Article 6(1)(b).
• To keep the acceptance audit record and the payment event records: our legitimate interest in being able to show who agreed to what, and in reconciling a payment to a licence exactly once, Article 6(1)(f). The impact on the person is holding their name, role, IP address and browser identifier against a contract they chose to accept.
• To keep invoices and company records: legal obligation, Article 6(1)(c), under UK company and tax law.

How long

• Commercial records: for the life of the commercial relationship, and afterwards for as long as UK company and tax record-keeping law requires; then we delete them. The licence file itself is yours to keep.
• Runner telemetry: 24 months from receipt, or 30 days after the last licence under the terms ends if that is sooner, then deleted. The deletion is not automated yet; until it is, we delete by hand. The receiver was built on 22 September 2026, so no record can reach 24 months before September 2028.
• Email you send us: until you ask us to delete the thread, and then we delete it.

Who else touches it

Party	Role	Where
Stripe	Payments, quotes and invoices; card details go to Stripe directly and never to us. Our site has used the account’s live keys since 8 October 2026, and its test-mode keys until then	Stripe Payments Europe, Limited, Ireland - the Stripe contracting entity for a United Kingdom account, with Stripe Payments UK Ltd as an additional party where Stripe’s financial-services terms say so; Stripe, Inc. is a US company
Supabase	Our database and the private bucket for quote PDFs from 18 September until 7 October 2026, when our server switched both to Cloudflare (below). Our server has written nothing to it since. The project’s address did not resolve when we checked on 7 October 2026, and we have not deleted the records written to it before then	Project in Ireland (EU); the contracting entity is Supabase Pte. Ltd, Singapore
Resend	Sends the licence and quote emails; and, when we run it, the digest to our director described in section 3, which also lists the number of active licences for which 45 days or more have passed since the last telemetry record we received for the licence, or since it was issued if none has arrived, and the number for which 60 days or more have passed, each count with the id of at most one of the licences it counts	eu-west-1 (Ireland) for the sending domain, read from its MX record on 21 September 2026; US company
jsDelivr	Serves the Pyodide runtime files to your browser when you open /demo, and nothing else	Global edge network; the operating entity’s country is [unverified]
Cloudflare	Hosts the site and runs the eight server endpoints, two of them for outreach: the stop link and the export of its records to our sending software; since 7 October 2026 also holds our database (Cloudflare D1) and the private file store for quote PDFs (Workers KV)	Global edge network; the database runs in Cloudflare’s Western Europe region; the contracting entity is Cloudflare, Inc., United States
Google Workspace	Our mailboxes, where your email to us arrives and the licence mailbox lives	Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland - the Google contracting entity for a customer with a United Kingdom billing address; Google is a US company
GitHub	Source hosting. Until 8 October 2026 it also ran the build that publishes this site and the scheduled jobs listed on the sub-processors page; all of those have been switched off since 8 October 2026, and this site is built and published from our director’s computer. No customer data	GitHub, Inc., United States

Apart from the licence and quote emails, we send you no automated email about your licence today; if we start sending one, such as a renewal reminder, it goes through Resend in the same way. From the day our support software is connected to the support@ mailbox, and not before, Anthropic also receives the text of some support emails for the yes-or-no check described in section 3; Anthropic Ireland, Limited is the Anthropic party for a UK customer, Anthropic, PBC is a US company, and where it processes a request is [unverified]. It is not connected on 2 October 2026. The full list, with each provider’s contracting entity, transfer terms and the change-notice rule, is at /legal/sub-processors.

International transfers

Our Cloudflare database runs in Cloudflare’s Western Europe region, Supabase’s project is in Ireland and Resend’s sending domain is in its Ireland region. Stripe, Resend, Cloudflare, Google and GitHub are, or are owned by, US companies, as is Anthropic once our support software is connected (section 3), and Supabase’s contracting entity is in Singapore, so some of your data may be processed outside the UK. Where a transfer leaves the UK, it is made under the provider’s data-processing terms: Stripe’s, Resend’s, Supabase’s, Cloudflare’s and GitHub’s each use the UK International Data Transfer Addendum to the EU standard contractual clauses. For Google the mechanism is [unverified], and for GitHub whether its data protection agreement covers the account we use is [unverified]. The sub-processors page gives the source for each. You can ask us for a copy of the safeguards.

3. People who write to us

If you email us, ask a question about buying, report a security issue, or ask a procurement question, we hold your email and whatever you wrote, in our Google Workspace mailbox, in order to reply. Lawful basis: our legitimate interest in answering, Article 6(1)(f), or, if you are a customer, the contract. We keep it until you ask us to delete the thread, and then we delete it. We do not add you to any marketing list because you wrote to us.

The digest. When we run it, our outreach software sends our director, through Resend, a digest listing up to ten of the messages its reply-reading software read in the seven days up to the digest’s date, each cut to its first 60 words, with the date it was read. Messages the software classed as a request to stop, an out-of-office reply or a bounce are left out. The reply-reading software can read the outreach mailbox, joshua.sandhu@globalphoenix.co.uk, through the connection our director signed in on 8 October 2026, and from 12 October 2026 a scheduled task runs it; once it has read an email you sent to that address, the digest can quote your email. When you ask us to delete a thread, we also delete the digests that quote it.

Our support software, and Anthropic. On 2 October 2026 no software reads the support@ mailbox. From the day our support software is connected to it, and not before, it reads each email sent to our support address (support@). Each reply it writes says it is automatic and ends with a note that Josh replies himself: either the reply is fixed text we wrote, saying your message has been passed to Josh, who will reply within one business day, or it answers your question with sentences quoted word for word from our documentation. Before it may answer on its own it runs a series of filters, and only a message that passes all of them goes to Anthropic, which runs the model claude-opus-5-5 for us through its API and answers yes or no to one question: does the message ask for a regulatory opinion, a judgement on a model or a result, advice on acceptance criteria, margins, thresholds or sample size, or prices or contract terms, or contain patient data, table rows or model outputs. Only an answer of no lets the software answer your question itself; an answer of yes, no clear answer or an error passes your message to Josh. What is sent is the subject and your newest text: each line that starts with “>” and everything from the first reply header the software recognises (such as a line “On … wrote:” or -----Original Message-----) onwards are left out. A reply header it does not recognise, such as a line “From:” followed by a name with no address, is not left out: that line and the text below it are sent as part of your newest text. Your address and every header other than the subject are never sent, and nor is an attachment or its name. A message whose subject or newest text holds a digit or other numeric character, an email address, a reference to your own model or results, or a word outside the words our documentation uses (as a personal name usually is) is not sent, and goes to Josh. That filter does not read the lines left out: a digit, an address or a reference to your own model that stands only in a line starting with “>”, or below a recognised reply header, does not stop the subject and your newest text being sent. A number written in words, such as “three”, is not stopped by that filter: such a message is sent when every other filter passes. Lawful basis: our legitimate interest in answering documentation questions quickly, Article 6(1)(f). Anthropic deletes what it receives within 30 days, with the exceptions its privacy centre lists; the sub-processors page gives them, its contracting entity and the transfer terms. The model writes no part of any reply.

If your message includes something we should not hold, such as test data, we will tell you, delete it, and ask you not to send it again.

4. Things we do not do

• We do not sell personal data, and no third party uses it for its own purposes on our instruction. Stripe may act as a controller of payment data in its own right under its own terms, which we have not restated here.
• We do not profile anyone and we make no automated decision with legal or similar effect about anyone.
• We do not send marketing email to customers or correspondents without a separate lawful basis, and the outreach privacy notice governs any marketing we do send.
• We do not use a language model anywhere in this site or in the pack pipeline. The one place we will use one is the yes-or-no check on support email in section 3, from the day it is connected; on 2 October 2026 it is not.

5. Your rights

You have the right to ask for access to the personal data we hold about you, to have it corrected or erased, to restrict or object to our use of it, and to receive the data you gave us in a machine-readable form. Where we rely on legitimate interests you have the right to object, and we will stop unless we can show a compelling reason to continue.

Email joshua.sandhu@globalphoenix.co.uk. We do not charge, and we will reply within one month. To answer an access request we look your address up in our database and our mailbox, and send what we find to the address we hold for you.

6. Complaints

Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

7. Changes

If this notice changes, the new version appears here with a new version line and date. If the change matters to existing customers we email the contact on the account.

On 10 October 2026 this notice changed from version privacy-2026-10-08: section 3 now says that the reply-reading software can read the outreach mailbox, and from when a scheduled task runs it; GitHub’s row now says that the jobs it ran have been switched off since 8 October 2026.