Privacy Policy

Last updated: 31 May 2026

This policy is a working draft provided for review and should be checked by a data-protection adviser before commercial use. It describes how the Service is built to handle data.

This policy explains how Olenium (“we”, “us”, “our”) collects, uses and protects personal data when you use Air Audits (the “Service”), in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are the data controller for the personal data described here.

1. The data we collect

Account data — the email address you register with, held in our identity provider (Amazon Cognito). Your password is stored only as a salted hash by the identity provider; we never see it.
Payment data — purchases are processed by Stripe. We receive confirmation of payment and a credit balance, but we do not collect or store your card details; Stripe handles these as a separate controller.
Audit data — the public website addresses you submit and the content we capture from those public pages, together with the findings and reports we generate. The Service assesses publicly published website content; it is not designed to collect pupil records or other special-category data.
Technical data — limited logs (such as request times and error information) needed to operate and secure the Service.

2. How and why we use it (lawful bases)

We use personal data to:

provide the Service, run audits and produce reports — lawful basis: performance of a contract;
take payment and maintain your credit balance — performance of a contract;
secure the Service, prevent abuse and keep records — our legitimate interests;
meet legal and accounting obligations — legal obligation;
send service messages (and, only with your consent, any marketing) — consent / legitimate interests.

3. Where your data is held and our processors

The Service runs on Amazon Web Services in the London (eu-west-2) region, keeping data within the UK. We use a small number of processors and sub-processors, each under contract:

Amazon Web Services — hosting, database, storage and the AI assessment (Amazon Bedrock). AI assessment uses a Claude model via an EU-resident inference profile.
Stripe — payment processing.
Anthropic (via Amazon Bedrock) — provides the Claude model used to assess captured website content. Captured content is sent only as data to be assessed and is not used to train models.

Where any transfer outside the UK occurs, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

4. Retention

We keep account and audit data for as long as your account is active and for a reasonable period afterwards, then delete or anonymise it, unless we must keep certain records longer to meet legal or accounting obligations. You can ask us to delete your account and associated data at any time (subject to those obligations).

5. Your rights

Under the UK GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in certain circumstances;
restrict or object to processing in certain circumstances;
data portability;
withdraw consent where processing is based on consent.

To exercise any right, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

6. Cookies and local storage

We use only the storage necessary to run the Service — principally your browser’s local storage to keep you signed in. We do not use advertising or third-party tracking cookies.

7. Children’s data

The Service is for school and trust staff, not children. It assesses what a website publishes; it is not intended to collect pupils’ personal data. If you believe a captured page contains personal data that should be removed, contact us and we will delete it.

8. Security

We protect data with encryption in transit and at rest, access controls, tenant isolation (each customer can access only their own data), and an immutable, hashed evidence store. No system is perfectly secure, but we take appropriate technical and organisational measures.

9. Changes and contact

We may update this policy and will note the date above. For any privacy question, or to exercise your rights, contact our privacy team at privacy@olenium.co.uk.