Privacy Policy

1. Controller and contact

LOUGHPOINT LTD is the controller for LoughPoint account administration, support and our own service operations. We are registered in Northern Ireland, company number NI744495, at Forsyth House, Cromac Square, Belfast, Northern Ireland, BT2 8LA. Contact legal@loughpoint.com for privacy questions or rights requests.

This notice describes the current service as reviewed on 15 October 2026. Provider-level retention, processing locations and transfer arrangements remain subject to verification before commercial launch; we do not claim UK-only storage or a completed independent privacy certification.

2. Information and purposes

Account and access: Supabase sign-in supplies a user identifier and verified email. Our account database stores the identifier, email, status, trial plan and expiry, access-code hashes and assigned recipient emails, redemption information, timestamps, administrative audit events and request-limit records. We use these to provide access and protect the service. We do not receive your email password. Staging stores session identifiers, expiry and revocation times to enforce sign-out.

Support: we store the text you submit, conversation messages, ticket status, timestamps, account linkage, read markers, email preferences and email delivery status. Authorised support administration can view conversations to investigate and reply. The feedback form sends the text you enter, not your workspace files. Please use synthetic examples and exclude other people’s personal information.

Email: welcome messages and access codes, and support receipt or reply notifications, can be sent through Cloudflare email services or the configured Cloudflare relay. These services process recipient addresses and message content. Support notifications contain a reference and website link rather than the conversation body. Reply notifications default on and can be switched off in Help & feedback; initial receipts and essential service messages are separate.

Website and security: hosting and sign-in providers process request and authentication metadata, such as IP addresses and browser/request information, to deliver and secure the site. Browser preferences are described in our Cookie Policy.

Payment testing: customer online billing is disabled. The owner-only Stripe sandbox can send the owner’s email, site account identifier and selected test plan to Stripe. The application records sandbox event identifiers, types and timestamps. Sandbox payment details are entered on Stripe’s hosted page; do not use real payment-card details for tests.

3. Planning data and your organisation

Planning files and calculations are processed in your browser. The reviewed planning workspace has no application route that uploads those datasets to LoughPoint’s servers. Optional browser recovery stores a project copy, including its data and saved scenarios, in IndexedDB on this device. Downloads remain where you save them. Account details, support messages and service security information are processed separately as described in this policy.

Use aggregated operational data and avoid identifiable customer or employee records, passwords and payment details. Removing names alone does not necessarily make data anonymous: identifiers and small groups may still identify people. You must own the data or have permission to use it in LoughPoint, including any approval required by your organisation. Local processing does not override your organisation’s software or confidentiality policies. An authority confirmation is not a waiver of our responsibilities or your statutory rights. If a proposed service would require us to process customer personal data on an organisation’s behalf, appropriate processor terms and safeguards must be agreed before that processing begins.

4. Lawful bases

We use contract necessity to provide an individual’s requested account/service and related support, including steps requested before a contract. For organisation contacts and service security, abuse prevention, administration and responding to enquiries, we rely on legitimate interests in running and protecting the service, balanced against individuals’ rights. We rely on legal obligation where we must retain or disclose information by law.

A feedback acknowledgement is not consent to marketing. Where consent is the appropriate basis for optional processing, it must be requested separately and can be withdrawn without affecting earlier lawful processing. We do not use the planning tool to make solely automated decisions with legal or similarly significant effects about you.

5. Recipients and international processing

Relevant recipients include our authorised administrators; Supabase for identity and authentication; Cloudflare for hosting, D1 account/support storage and configured email delivery; and Stripe for owner-only sandbox testing. Professional advisers, authorities or a successor business may receive information where necessary and lawful, with appropriate safeguards. We do not sell personal information.

Providers may act as processors or as independent controllers for their own services. Their privacy information also applies to those independent activities. Provider arrangements may involve processing outside the UK. The exact locations and applicable UK transfer safeguards have not yet been confirmed for every service. Contact legal@loughpoint.com for available details; this notice is not a promise that all processing stays in the UK.

6. Retention and deletion

Active planning state is held in memory. If you enable browser recovery, a project copy persists in this browser until removed using the recovery controls or browser site-data settings, or until the browser clears it. Saved scenarios and frozen forecast versions are part of the project, not browser history. Recovery is not an encrypted vault or a guaranteed backup; use a trusted device and protect it from other users. Downloaded files remain under your control and must be deleted separately. Theme and calculator-favourite preferences remain in browser storage until changed or cleared.

The current account and support database has no automatic retention/deletion schedule implemented. Closing access retains account and audit records; code expiry does not erase the code record. Account, support and email-status records are currently retained until a manual review or deletion action. Retention periods for provider logs, backups and email also require confirmation.

Our retention decisions must be based on the ongoing service relationship, unresolved support matters, security needs and any applicable legal obligations or disputes, rather than indefinite convenience. Contact us to request deletion or a retention review. We will explain any lawful reason for keeping specific information. A documented retention schedule and tested deletion process remain pre-launch requirements.

7. Your rights

Subject to applicable conditions and exemptions, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent where we rely on it. We may need proportionate information to verify identity; do not send passwords. We normally respond within one month and will explain any lawful extension.

Providing account identity is necessary for signed-in access; without it we cannot provide an account. Support text is supplied by you, and you choose whether to submit it. Contact legal@loughpoint.com to exercise rights. You can complain to complaints@loughpoint.com or directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. You do not have to complain to us first.

8. Updates

We will update this notice when our processing changes and provide additional notice where appropriate. Commercial billing or new data integrations will require a fresh review before activation.