Privacy Policy

ScanalytIQ is operated by Lothringer Limited, a company registered in England and Wales (Companies House registration number: 07450804). Lothringer Limited is the data controller responsible for your personal data. Contact: scanalytiq@lothringer.co.uk. Lothringer Limited is registered with the Information Commissioner's Office (ICO) under registration number ZB123456.

• Your email address, if you join our pre-launch waitlist.
• Your username and email address, provided during registration.
• Your password, stored as a cryptographic hash using scrypt — we never store your password in plain text.
• The URLs you submit for analysis and the resulting analysis reports generated by Claude AI.
• Basic account metadata such as your account creation date and role.

• To contact you with early access details and launch information, if you joined the waitlist.
• To create and manage your account and keep you signed in.
• To save your analysis history so you can review past reports.
• To send transactional emails such as account verification and password reset links.
• To pass website content you submit to the Claude AI API for analysis (see Third-party services below).

We process your personal data on the following legal bases under UK GDPR:

• Consent — when you submit your email address to join the waitlist, you consent to us contacting you with early access and launch information. You may withdraw this consent at any time by emailing us at scanalytiq@lothringer.co.uk.
• Contractual necessity — to provide the ScanalytIQ service once you have created an account, including account management and transactional emails.

We do not use your data for any automated decision-making or profiling.

• Waitlist emails — retained until the service launches or until you withdraw consent, whichever is sooner.
• Account data and analysis history — retained for 24 months after your last login, then permanently deleted. You may also request deletion at any time.

To request early deletion of your data — whether from the waitlist or a registered account — contact us at scanalytiq@lothringer.co.uk and we will action your request within 30 days.

We use the following third-party services to operate ScanalytIQ. We do not sell your personal data to any third party.

• Anthropic (Claude API) — website content submitted for analysis is processed by Anthropic, PBC, a company incorporated in the United States. The data transferred consists of the URL submitted and the publicly accessible page content scraped from it; no personal data belonging to that site's end-users is included in the transfer. Anthropic does not use API-submitted content to train its AI models.
  
  Transfer mechanism (UK GDPR Article 46): Restricted transfers from the UK to Anthropic in the US are lawful on the basis of the EU Standard Contractual Clauses (European Commission Decision 2021/914, Module 2: controller to processor) supplemented by the ICO's UK Addendum to the EU SCCs (together constituting valid Article 46 safeguards under UK GDPR). A Data Processing Addendum incorporating these clauses is executed with Anthropic.
  
  Transfer Impact Assessment (TIA): A TIA has been conducted and considered the following factors: (a) nature and sensitivity of data — the content transferred is publicly accessible web page text, carrying low inherent personal-data risk; (b) Anthropic's technical and organisational measures — including encryption in transit (TLS) and at rest, strict internal access controls, and contractual commitments not to access customer data except as necessary to provide the service; and (c) applicable US surveillance law — including the potential for US government access under FISA Section 702 and Executive Order 12333. Having regard to the low sensitivity of the data category and the contractual and technical safeguards in place, we are satisfied that the Standard Contractual Clauses remain effective for this transfer and that it does not materially prejudice the rights of UK data subjects.
  
  See Anthropic's Privacy Policy.
• Azure Database for PostgreSQL (Microsoft Corporation) — stores your account and analysis data in a secure, EU-hosted database.
• Azure Communication Services (Microsoft Corporation) — sends transactional emails on our behalf. Microsoft processes data in accordance with its Data Protection Addendum.

We use an essential session cookie to keep you signed in. For full details, see our Cookie Policy.

As a data subject you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ('right to be forgotten').
• Portability — receive your data in a machine-readable format.
• Restrict processing — request that we limit how we use your data in certain circumstances (Article 18 UK GDPR).
• Object to processing where we rely on legitimate interest.

To exercise any of these rights, contact us at scanalytiq@lothringer.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office if you believe your data has been handled unlawfully: ico.org.uk.

Passwords are hashed using scrypt with a unique random salt per user. Sessions are stored server-side and protected with a secret key. Data in transit is encrypted via TLS. We apply reasonable technical and organisational measures to protect your data, but no system is completely secure.

We may update this policy from time to time. Material changes will be noted by updating the date at the top of this page.

For any privacy-related questions or to exercise your rights: scanalytiq@lothringer.co.uk