This policy was drafted by describing the system's actual behaviour and has not been reviewed by a lawyer. Before relying on it commercially, have qualified counsel review it — particularly the controller identity, the legal bases, and the international-transfer section, which depend on facts about your organisation that source code cannot tell you.
Who we are
SRA (Smart Requirements Analyzer) turns stakeholder text into structured requirements specifications. For the personal data described here, the operator of this deployment is the data controller. The controller's legal name, registered address and contact address must be filled in before this page is published. Under GDPR those details are mandatory, and no one but the operator can supply them.
What we collect
Information you give us
- Account details — your email address, and your name and profile picture if you sign in with Google or GitHub. Passwords are stored only as a bcrypt hash; we never hold the password itself.
- Your content — the stakeholder text you submit, the specifications generated from it, your project and version history, and your messages in the refinement chat.
- Provider API keys — the LLM provider keys you add in Settings, encrypted at rest with AES-256-GCM. We show you only a masked form, and they are never returned to your browser or included in a data export.
Information collected automatically
- Session and security data — IP address, browser user agent, and an approximate city-level location derived from that IP, shown to you on the Sessions screen so you can recognise a device you do not know.
- Audit records — sign-ins, sign-in failures, and sensitive actions such as creating or deleting a project, with the IP and user agent that performed them.
- Usage analytics — aggregate page analytics via Vercel Analytics, which is cookieless and does not build a cross-site profile of you.
Why we have it, and on what legal basis
| Purpose | Data | Basis (GDPR Art. 6) |
|---|---|---|
| Providing the service you signed up for | Account details, your content, provider keys | Contract (6(1)(b)) |
| Keeping accounts secure; investigating abuse | IP, user agent, session and audit records | Legitimate interests (6(1)(f)) |
| Understanding aggregate usage | Cookieless page analytics | Legitimate interests (6(1)(f)) |
Who else sees it
We do not sell personal data, and we do not share it for advertising. We use these processors to run the service:
| Processor | What it receives |
|---|---|
| Your chosen LLM provider (Google, OpenAI, Anthropic or xAI) | The text you submit for analysis, sent under your own API key. Their terms govern that processing — including whether they retain or train on it. See the note below. |
| Google (Gemini embeddings) | Text converted into vectors for semantic search, under the platform's key. This is the one model call not made with your key. |
| Supabase (PostgreSQL) | All stored data |
| Vercel | Application hosting and cookieless analytics |
| Upstash (QStash, Redis) | Background job payloads and rate-limit counters |
| ip-api.com | Your IP address, to derive the approximate sign-in location |
| Google / GitHub | OAuth sign-in, if you choose it |
A note about what you submit for analysis
Text you analyse is sent to the model provider you selected. Before it leaves, we redact patterns that look like email addresses, phone numbers, payment card numbers and IP addresses. That redaction is a safety net working on patterns, not a guarantee— it cannot recognise a person's name, an address, a medical detail or an internal identifier. Treat anything you paste in as something that will reach your model provider, and do not submit personal data about other people unless you are entitled to.
Your content stays yours
Requirements you finalise are indexed so the system can reuse your earlier work when drafting something new. That index is scoped to your own account. Your requirements are never retrieved into, suggested to, or used to generate a document for another user, and they are not used to train any model.
How long we keep it
- Your account and content — until you delete them. Deleting an analysis or project removes it.
- Sessions — up to 7 days, and immediately when you sign out or revoke the device.
- Audit records — 90 days, then deleted automatically.
- Deleted accounts — 30 days, then permanently erased. See below.
Your rights
If you are in the UK, EU or EEA you have rights under the UK GDPR / GDPR; if you are in California you have comparable rights under the CCPA. You can exercise the main ones yourself, immediately, without asking us:
- Access and portability — download everything we hold about you as JSON from Settings, or via
GET /auth/me/export. Credentials are described but never included, so the file cannot be used to take over your account. - Erasure — delete your account from Settings. Your sessions end at once and the account stops working immediately. The data itself is permanently erased after 30 days, during which you can restore the account by signing in again. After that it is gone and cannot be recovered.
- Rectification — edit your content and profile in the app at any time.
- Objection and restriction — contact us at the address above.
You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office.
Cookies
We use two cookies, both strictly necessary, and no advertising or tracking cookies at all:
- refreshToken — keeps you signed in. HttpOnly, Secure, and unreadable by JavaScript. Lasts up to 7 days.
- oauth_state — protects the OAuth sign-in flow against request forgery. Lasts 10 minutes.
Because both are strictly necessary to deliver a service you asked for, and our analytics sets no cookies, we do not show a consent banner. If tracking or advertising cookies are ever added, consent must be obtained first and this section rewritten.
Security
Passwords are hashed with bcrypt and provider keys are encrypted with AES-256-GCM. Session tokens are stored only as hashes, so a copy of our database does not yield usable sessions. Traffic is served over HTTPS with HSTS. Access to your projects, analyses and reuse index is restricted to your own account and enforced in every database query.
No system is perfectly secure. If you believe you have found a vulnerability, please report it to the contact address above rather than disclosing it publicly.
International transfers
Our processors operate globally, so your data may be processed outside your country, including in the United States. The specific transfer mechanism relied on must be confirmed with counsel and stated here before publication.
Children
This service is not intended for children under 16, and we do not knowingly collect their personal data.
Changes
If we change this policy we will update the date at the top, and for material changes we will tell you in the app before they take effect.