Privacy notice

Version 0.4 (draft) · Pending legal review

Correction notice, 27 October 2026: what we got wrong about file paths in error reports, and what changed.

SureMatters Ltd, company number 03724474, registered in England and Wales.

1. Who we are

SureMatters Ltd (“SureMatters”, “we”, “our”, “us”) publishes SureRedact, operates the website at surematters.com, and is developing a second product, SurePrepare, which has not been released. For the personal data described below, we are the data controller.

You can contact us at privacy@surematters.com with any data-protection question. We aim to respond substantively within 5 working days, and within 1 working day where you only need a clarification.

2. What this notice covers

This notice covers personal data we process about visitors to our website and our customers and prospective customers.

It does not cover the personal data processed by SureRedact and SurePrepare themselves when you run them. For that processing your own organisation is the controller, and our position is set out in the AI Policy and in the DPIA template we provide on request.

In short: this notice is about the data we collect from you when you visit our website or buy our software. It is not about the disclosure material your organisation works on using it.

3. What we collect, why, and our lawful basis

3.1 Website visitors

Data	Purpose	Lawful basis	Retention
Truncated IP address (no full IP stored), page viewed, browser family, referrer	Site analytics via Plausible Analytics — cookieless, EU-hosted, no fingerprinting	Legitimate interests (Article 6(1)(f)) — running and improving our website	Aggregate statistics only; no per-session identifier is retained
Email address and optional name, if you sign up to the newsletter	Sending product news, launch announcements and blog summaries	Consent (Article 6(1)(a)) — opt-in on the signup form	Until you unsubscribe; an unsubscribe link is in every email
Email address, name, organisation, message, if you use the contact form	Responding to your enquiry	Legitimate interests (Article 6(1)(f))	24 months from last contact; deleted on request
Pilot-enquiry form submissions (organisation, role, request-volume estimate, contact details)	Qualifying and responding to pilot enquiries	Legitimate interests (Article 6(1)(f))	24 months from last contact; deleted on request

3.2 Customers

Data	Purpose	Lawful basis	Retention
Account-holder name, email, organisation, billing address, VAT number	Issuing licences, invoicing, and supporting your account	Contract (Article 6(1)(b)); legal obligation for invoice records (Article 6(1)(c))	While the account is active, plus 7 years for HMRC compliance
Licence metadata (seats, term, entitlements)	Operating your licence	Contract (Article 6(1)(b))	While the account is active, plus 24 months for billing reconciliation
Operator names and email addresses, where licences are issued to named operators	Issuing and managing per-operator licences	Contract (Article 6(1)(b))	While the operator is part of your account

Licences are currently issued by hand. There is no self-service portal and no automated issuance pipeline, so this data is held in our accounting system and our internal business records — Xero and Google Workspace, both listed in §4.1 — rather than in a product database. If you buy by card in future, payment details will be handled by Stripe and never held by us.

3.3 Telemetry and error reports

We do not currently operate a telemetry service, and none has ever been transmitted to us.

Where the products record operational information about how they are being used, it stays on your own machine, where you can see it and clear it. It cannot be switched off, because there is nothing to switch off: nothing is sent to us, so nothing is stored by us and no sub-processor receives it.

One thing does leave, if you let it: an error report when something goes wrong. You are asked on first run, and you can switch it off in Settings at any time.

Data	Purpose	Lawful basis	Retention
An error report: the type of error and its code module; the stack trace as function names, code-file names and line numbers, with no directory paths; the release, operating-system and runtime versions; a pseudonymous device identifier; and two content-free error codes. No message text of any kind — every exception value is sent empty, and paths are reduced to file names on your machine before anything is sent	Finding and fixing faults in the software	Legitimate interests (Article 6(1)(f)) — keeping the software working; you can switch it off	60 days for the raw report, at the EU-hosted error-tracking provider named in §4.1; aggregate counts that identify no device, until we remove them

The device identifier is a random value generated on your own device and never registered with us; we hold nothing that links it to an organisation or to a person. We treat the report as personal data on the cautious view, and your rights in §6 apply to it. The fastest route is to switch error reporting off, which stops it at source.

If what the products send ever changes, we will say so before it does, under §8. The framework that would apply is a four-class scheme — operational counts, transformed artefacts, masked exemplars, and raw content — under which raw content is never permitted and the second and third classes would require your explicit opt-in with a preview before anything left your machine. Anything we ever collected would have an unconditional off-switch, as error reporting has today.

3.4 Support and account correspondence

Data	Purpose	Lawful basis	Retention
Support tickets, email exchanges, and any attachments you choose to send us	Resolving your request	Legitimate interests (Article 6(1)(f)); contract (Article 6(1)(b)) for paying customers	24 months from last contact; deleted on request, unless we need it for an unresolved dispute

Where a reply has been drafted with AI assistance, a named person reviews it before it is sent, and we label it — see the AI Policy.

3.5 What we do not collect

Your disclosure material. Your subject access requests, FOI responses, complaints files, source records, decisions logs and disclosure packs do not transit our infrastructure under any tier or any add-on. They stay on your operators’ devices. If we ever ship a connector needing a helper service in your own cloud, that material would stay inside your tenancy too; no such connector exists today.
Special-category data about you (Article 9 UK GDPR) — unless you choose to include it in a support request, in which case we use it only to resolve that request and delete it afterwards.
Browser fingerprinting, beyond the cookieless aggregate measurement Plausible performs.
Tracking or advertising cookies. We set none — see §3.6.
Children’s personal data, through our website. Our products are used by organisations whose disclosure work may involve children’s records; that material never reaches us.

There is no cookie banner because we do not set anything that needs your consent.

No tracking cookies. No advertising, analytics or tracking cookies on our website.
Cookieless analytics. Plausible Analytics stores nothing on your device and produces only aggregate, non-identifying statistics.
Strictly necessary only. Cloudflare, which serves and protects the site, may set short-lived security cookies — for example for bot protection. These are strictly necessary to deliver the site securely and are exempt from the consent requirement under the Privacy and Electronic Communications Regulations.

If we ever introduce something that does need consent — third-party advertising, or embedded media that sets cookies — we will add a clear accept-or-reject control, with rejecting as easy as accepting, and set nothing until you choose.

We do not sell, rent or trade your personal data.

4.1 Sub-processors and our own suppliers

One organisation processes personal data on our behalf, and it is our only sub-processor: the provider that stores error reports. The rest are our own suppliers. They process personal data for which we are the controller — our email, our accounting, our website — or none at all, and none of them acts on your behalf. The full list, divided on that line and with the transfer basis for each, is at surematters.com/subprocessors, which is the authoritative version.

Sub-processor

Bugsink B.V. — error and crash reporting for the desktop products, EU-hosted. An error report carries no message text of any kind — the type of error and its code module; the stack trace as function names, code-file names and line numbers, with no directory paths; the release, operating-system and runtime versions; a pseudonymous device identifier; and two content-free error codes. Every exception value is sent empty, and paths are reduced to file names on your machine before anything is sent (§3.3). Bugsink’s data processing agreement commits to processing all hosted personal data within the EU, and no US sub-processor has access to error reports.

Our own suppliers

Cloudflare, Inc. — DNS, CDN, WAF, form handling, and Turnstile bot protection. Processes visitor IP data. For Turnstile, technical signals (IP address, TLS fingerprint, browser user agent) distinguish humans from bots — never your email or the contents of your form. Cloudflare also reuses those technical signals to improve its own service, and is a controller for that use.
Plausible Insights OÜ — cookieless website analytics, EU-hosted. Aggregate data only.
Keila GmbH — newsletter delivery, EU-hosted. Processes your email address and optional name.
Anthropic PBC — AI assistance for our own engineering and drafting. Your documents are never sent to Anthropic.
Google Ireland Limited / Google LLC (Google Workspace) — our email, the handling of website form submissions, and our internal business records.
Google Cloud EMEA Ltd — key management for the signing keys behind our licence files and detector bundles. No personal data.
Microsoft Corporation — code-signing for our Windows releases. No personal data.
Apple Inc. — code-signing and notarisation for our macOS releases. No personal data.
Xero (UK) Limited — our accounting and invoicing system.
Stripe Payments UK Ltd — card payment processing. Not yet in use; it begins when self-service purchasing opens.

4.2 Other recipients

Our advisors — solicitors, accountants, auditors — under professional confidentiality obligations.
Regulators and courts, where the law requires it.
A successor organisation, in a restructuring, sale or insolvency, subject to the protections data protection law provides.

We do not share your personal data with marketing or advertising networks.

5. International transfers

Most of the personal data covered by this notice is processed in the UK or the EEA, where the UK adequacy decision for the EEA is the transfer basis and no additional safeguards are needed.

Our only sub-processor, Bugsink, processes error reports in the EU. Of our own suppliers, Anthropic processes in the United States under Standard Contractual Clauses; Cloudflare serves static content from a global edge network under Standard Contractual Clauses and the UK International Data Transfer Addendum; and Google Workspace is EU-primary with some sub-processing in the United States under Google’s published terms. Stripe, when it comes into use, will process in the UK with some sub-processing in the United States under the UK–US Data Bridge and Standard Contractual Clauses.

The transfer basis for each organisation is set out at surematters.com/subprocessors. We tell you if it materially changes, per §8.

6. Your rights

Under UK GDPR you have rights to access, rectify, erase, restrict, object to and port your personal data, and rights concerning automated decision-making. To exercise any of them, write to privacy@surematters.com.

We respond within one calendar month, extendable to three months for complex requests, and we tell you if we extend. Where we need you to clarify or narrow your request before we can find your data, the time we spend waiting for your answer does not count against that deadline — a change made by the Data (Use and Access) Act 2025.

6.1 Right of access (Article 15)

You can ask for a copy of the personal data we hold about you. We provide it in a commonly-used electronic format.

6.2 Right to rectification (Article 16)

You can ask us to correct data that is inaccurate or incomplete.

6.3 Right to erasure (Article 17)

You can ask us to delete your data where one of the Article 17 grounds applies. We keep what we must to meet legal obligations — invoice records for HMRC, for example — where Article 17(3) permits.

6.4 Right to restrict processing (Article 18)

You can ask us to restrict processing while we resolve a rectification or erasure request.

6.5 Right to object (Article 21)

You can object to processing we carry out on the basis of legitimate interests. We weigh your objection against those interests as described in §3.

6.6 Right to data portability (Article 20)

You can ask for your data in a structured, commonly-used, machine-readable format, where we process it by automated means on the basis of consent or contract.

6.7 Automated decision-making (Articles 22A–22D)

We do not make decisions about you by automated means alone that produce legal or similarly significant effects.

The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D. You will still see “Article 22” cited in older notices; it is the provision that was replaced.

How our products handle automated suggestions to their operators is a separate question, and is covered in the AI Policy.

6.8 Right to complain

You can complain to the Information Commissioner’s Office at any time, and you do not have to raise it with us first — though we would rather have the chance to put it right. Their contact details are at ico.org.uk.

7. Security

We protect your data with appropriate technical and organisational measures, described more fully in our Security Architecture summary.

TLS for all traffic to and from our systems, with HTTP requests redirected to HTTPS at the edge.
Encryption at rest, using our providers’ managed encryption.
Google Cloud KMS holds the signing keys for our licence files and detector bundles.
Two-factor authentication on every administrative account.
Dependency and supply-chain monitoring, and a security review at least annually.
A vulnerability disclosure programme — security@surematters.com, per the published policy.

8. Changes to this notice

We update this notice when our processing changes. A material change — a new category of personal data, a new sub-processor, a new lawful basis, or a new international-transfer arrangement — is notified on our website within 10 working days, and by email to current customers where it affects them. Editorial changes are made in place and recorded here.

Change history

Date	Version	Change
2026-05-09	v0.1	Initial draft.
2026-08-12 – 13	v0.3	Legal-review revision. (Consolidates the draft numbered v0.2.) Corrected two errors running in opposite directions. §3.3 said we receive operational metadata with retention periods per class — we do not operate a telemetry service and none has ever been transmitted to us. §3.2 treated customer-account processing as beginning when a customer portal launches; licences are issued by hand today, so the notice did not cover processing we actually carry out. References to a customer portal and to control-plane services we do not run were removed, along with a helper service described as available. Refreshed for the Data (Use and Access) Act 2025: §6.7 for the replacement of Article 22 by Articles 22A–22D, and §6 for the change to how the response deadline is counted. Three links to pages that do not exist were corrected, the description of transfers now names Google Workspace, and the registered office was added.
2026-08-14	v0.4	Correction. The document described SurePrepare as a released product. It has never shipped. §1 said we publish it. Corrected to say so, and to mark what it says about SurePrepare as design intent rather than description. Amended 27 October 2026, before publication, with four corrections. (a) Material, and covered by the correction notice published with this version on the AI Policy page: from 24 June to 25 October 2026 §4.1 said the error-reporting client stripped file paths, exception messages, request bodies and local variables on your machine before a report was sent, and the stripping was incomplete — a folder name containing an apostrophe could leave the rest of a path in a report, and the in-app client did not strip Windows paths at all; a path can name a Matter and so a person. The error-tracking account, checked on 15 September, held no report from any released build, and no installation of those builds is recorded outside our own machines; from SureRedact 1.2.0 no message text is sent at all, so it cannot recur. §4.1 now describes what 1.2.0 sends. (b) This notice had not set out the error report as processing at all — §3.3 said nothing is sent to us, and the one thing the products do send appeared only as a sub-processor’s entry. §3.3 now describes it, with its purpose, lawful basis and retention, and corrects a sentence that said operational records could be switched off: they never leave your machine and cannot be, and the switch is for error reports. Material by the same test. (c) §4.1 called every supplier a sub-processor, and §5 counted two outside the UK and EEA while naming three. Only one supplier acts on our behalf; §4.1 and §5 now follow the sub-processor list’s division, and §5 no longer counts. (d) Two sentences said the keys in Cloud KMS sign our software releases; they sign licence files and detector bundles, as the sub-processor list says. (e) Apple added beside Microsoft among our own suppliers, as the sub-processor list now has it.

9. How to contact us

Privacy questions: privacy@surematters.com
Security incidents: security@surematters.com
Policy questions: policy@surematters.com

SureMatters Ltd, Ground Floor, 108–112 Main Road, Sundridge, Sevenoaks, TN14 6ES.

We aim to respond within 5 working days for substantive enquiries, and within 1 working day for clarifications.

Drafted with AI assistance and reviewed by a named person, per our AI Policy.