Privacy Policy

ScanalytIQ is operated by Lothringer Limited, a company registered in England and Wales (Companies House registration number: 07450804). Lothringer Limited is the data controller responsible for your personal data. Contact: contact@lothringer.co.uk. Lothringer Limited is registered with the Information Commissioner's Office (ICO) under registration number ZB123456.

• Your email address, if you join our pre-launch waitlist.
• Your username and email address, provided during registration.
• Your password, stored as a cryptographic hash using scrypt — we never store your password in plain text.
• The URLs you submit for analysis and the resulting analysis reports generated by Claude AI.
• Basic account metadata such as your account creation date and role.

• To contact you with early access details and launch information, if you joined the waitlist.
• To create and manage your account and keep you signed in.
• To save your analysis history so you can review past reports.
• To send transactional emails such as account verification and password reset links.
• To pass website content you submit to the Claude AI API for analysis (see Third-party services below).

We process your personal data on the following legal bases under UK GDPR:

• Consent — when you submit your email address to join the waitlist, you consent to us contacting you with early access and launch information. You may withdraw this consent at any time by emailing us at contact@lothringer.co.uk.
• Contractual necessity — to provide the ScanalytIQ service once you have created an account, including account management and transactional emails.

We do not use your data for any automated decision-making or profiling.

• Waitlist emails — retained until the service launches or until you withdraw consent, whichever is sooner.
• Account data and analysis history — retained for 24 months after your last login, then permanently deleted. You may also request deletion at any time.

To request early deletion of your data — whether from the waitlist or a registered account — contact us at contact@lothringer.co.uk and we will action your request within 30 days.

We use the following third-party services to operate ScanalytIQ. We do not sell your personal data to any third party.

• Anthropic Claude API — the website content you submit for analysis is sent to Anthropic's API (Anthropic, PBC, USA). Content submitted via the API is not used to train Anthropic's models. A Data Processing Agreement is in place with Anthropic; transfers to the US are governed by the UK International Data Transfer Agreement (UK IDTA). A Transfer Impact Assessment (TIA) has been conducted for this transfer. The assessment considered Anthropic's technical and organisational security measures, US surveillance law (including FISA 702 and EO 12333), and the low sensitivity of the data transferred (publicly accessible website content). We are satisfied that appropriate safeguards are in place and that the transfer does not materially prejudice the rights of data subjects. See Anthropic's Privacy Policy.
• Azure Database for PostgreSQL (Microsoft Corporation) — stores your account and analysis data in a secure, EU-hosted database.
• Azure Communication Services (Microsoft Corporation) — sends transactional emails on our behalf. Microsoft processes data in accordance with its Data Protection Addendum.

We use an essential session cookie to keep you signed in. For full details, see our Cookie Policy.

As a data subject you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ('right to be forgotten').
• Portability — receive your data in a machine-readable format.
• Restrict processing — request that we limit how we use your data in certain circumstances (Article 18 UK GDPR).
• Object to processing where we rely on legitimate interest.

To exercise any of these rights, contact us at contact@lothringer.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office if you believe your data has been handled unlawfully: ico.org.uk.

Passwords are hashed using scrypt with a unique random salt per user. Sessions are stored server-side and protected with a secret key. Data in transit is encrypted via TLS. We apply reasonable technical and organisational measures to protect your data, but no system is completely secure.

We may update this policy from time to time. Material changes will be noted by updating the date at the top of this page.

For any privacy-related questions or to exercise your rights: contact@lothringer.co.uk