Data Protection Register

Privacy Notice

Last updated: 21 June 2026

Alethriko Labs ("we", "us", "our") makes the Data Protection Register, a service for creating and maintaining data protection compliance records, available at www.dataprotectionregister.co.uk. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it.

Our two roles

We handle personal data in two distinct capacities, and your rights differ depending on which applies:

  • As a controller for the data we need to run the service: your account, your organisation, billing, support, and analytics. This policy covers that data.
  • As a processor for the content of the records your organisation creates in the service (for example, descriptions of processing activities, ROPAs, and DPIAs). Your organisation is the controller of that content. We process it only on your organisation's instructions, and requests about it should go to your organisation in the first instance.

What we collect and why

Account and organisation data

When you sign up we collect your name, work email address, and the organisation you belong to. We use this to create and secure your account, to associate you with your organisation's workspace, and to manage your organisation's team membership. Lawful basis: performance of a contract.

Billing data

Payments are handled by Stripe. We never see or store your card number. We hold Stripe customer and subscription identifiers so we can link your organisation to its plan. Lawful basis: performance of a contract and our legal obligations (tax and accounting).

Record content you create

The processing activities you describe and the documents generated from them are stored in our database and may contain personal data your organisation chooses to include. We process this as a processor, as described above.

AI-assisted drafting

When you generate an assessment (such as a DPIA, a legitimate interests assessment, or a compliance review), the inputs you have captured are sent to Anthropic's Claude models, through Anthropic's API, to draft it. This processing takes place in the United States under appropriate transfer safeguards (Standard Contractual Clauses and the UK Addendum to them). Your ROPA does not involve AI: it is assembled directly from your records. The data is processed only to generate your output and is not used to train models; Anthropic retains the inputs and outputs for up to 30 days for safety and security purposes and then deletes them. We log metadata about each AI call (timing, token counts, and estimated cost) for billing and abuse prevention; these logs do not duplicate your record content.

Audit logs

We keep an append-only audit log of significant actions in your workspace (for example, who generated or regenerated a document, and who invited a team member). This exists so your organisation has an accountable history of its compliance records. Lawful basis: legitimate interests in security and accountability, and performance of a contract.

Usage analytics and advertising

We use Vercel Web Analytics to count visits and page views in aggregate. It does not use cookies or store any identifier on your device, and it does not track you across sites or sessions, which is why it does not appear in the cookie banner. Our lawful basis is our legitimate interest in understanding how the website is used.

With your consent, we use Google Analytics to understand how the website is used, with IP addresses anonymised. If you also allow the advertising category in the cookie banner, we enable Google's advertising features: Google signals (which, for signed-in Google users who have allowed ads personalisation, may associate your visit with Google's information about you across devices for cross-device measurement and ads personalisation), and audience sharing with our linked Google Ads account for conversion measurement and advertising. Both categories are off by default and independent of each other. You can change or withdraw either at any time using the Cookie settings link in the footer. This data is processed by Google, including in the United States, under the safeguards described in "Where your data lives" below. See our Cookie Notice for the full detail and for Google's own controls. Lawful basis: consent.

Support and correspondence

If you contact us at hello@alethrikolabs.co.uk we keep the correspondence so we can resolve your query. Lawful basis: legitimate interests in supporting our customers.

Where your data lives

Customer data, including all record content, is stored in our database hosted in the European Union (Frankfurt, Germany). Some of our sub-processors operate from or route traffic through other regions, including the United States. Where data leaves the UK or EU, it is protected by appropriate safeguards: the UK Extension to the EU-US Data Privacy Framework, the EU-US Data Privacy Framework, or Standard Contractual Clauses, depending on the provider.

Files you upload (your organisation logo and copies of policy documents you choose to store in the policy library) are held in Vercel's file storage rather than our EU database, and may be stored outside the UK/EU under the safeguards above. Downloads of stored policy documents require a signed-in member of your organisation. Policy documents should not normally contain personal data; if yours do, that content is subject to Vercel's storage location.

Sub-processors

We use the following providers to deliver the service:

  • Neon (database hosting, EU region): stores all application data, including your records.
  • Vercel (application hosting, content delivery, and file storage): runs the application, serves it to your browser, and stores uploaded files (logo and policy documents).
  • Clerk (authentication): manages sign-in, sessions, and credentials.
  • Stripe (payments): processes subscription payments and stores payment details.
  • Anthropic (AI drafting): runs Claude models to draft documents from the inputs you provide. Processed in the United States under Standard Contractual Clauses and the UK Addendum, retained for up to 30 days for safety and security, and not used to train models.
  • Google (analytics and advertising): measures website usage and, with your consent, supports advertising and audience features (Google signals and ads personalisation). Active only for the categories you allow.

If we add or replace a sub-processor that handles customer record content, we will update this page and, for material changes, notify organisation owners by email.

How long we keep data

  • Account and organisation data: for the life of your account, then deleted within 90 days of account closure.
  • Record content: for the life of your subscription. After cancellation your records remain available for 90 days so you can export them, then they are deleted.
  • Audit logs: retained alongside your workspace for accountability, and deleted on the same schedule as record content.
  • Billing records: kept for 6 years as required by UK tax law.
  • Support correspondence: kept for up to 2 years after the query is resolved.

Security

Data is encrypted in transit (TLS) and at rest. Access within each workspace is scoped to your organisation at the data layer, sign-in supports multi-factor authentication, and significant actions are recorded in an append-only audit log. Payment details never touch our systems.

Your rights

Under UK GDPR and, where it applies, EU GDPR, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing of it, and to receive it in a portable format. Where processing is based on consent (analytics and advertising), you can withdraw that consent at any time, using the Cookie settings link in the footer, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email hello@alethrikolabs.co.uk. We respond within one month. If your request concerns data inside your organisation's records, we may refer it to your organisation, since they control that content.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or to your local supervisory authority if you are in the EU.

Children

The service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

When we change this policy we will update the date at the top of this page. For material changes we will notify organisation owners by email before the change takes effect.

Contact

Alethriko Labs (maker of the Data Protection Register)
Email: hello@alethrikolabs.co.uk