Privacy, plainly.
Acquisition is a provisional business identity. The programme's legal operator and privacy contact are awaiting confirmation. Personal account registration and applications remain disabled until these details are configured. Do not submit personal or confidential information to the public assessment.
What the assessment uses
We read up to three public website pages, respecting robots.txt. We extract headings, visible text, price strings and basic HTML observations. We do not access accounts, submit forms or purchase anything. Avoid URLs that identify individuals or contain private information.
Your approximate commercial figures are used for deterministic affordability calculations. No customer lists, card details or bank information are required. Public evidence may be interpreted by Groq only when that processing has been configured and reviewed; each report tells you whether AI ran. Contact details and commercial form answers are not included in AI requests. Public excerpts may still contain incidental personal data despite automated filtering.
Accounts and applications
Invited applicants provide a business name, contact name, email address, website and business information. Passwords are stored as salted Argon2 hashes. Administrators use the information to assess eligibility and communicate programme decisions through established channels. There are no automated eligibility decisions with legal or similarly significant effects.
Purpose and legal basis
Processing requested assessments and applications is intended to support steps towards a potential contract. Business-contact processing and security controls rely on legitimate interests where appropriate, subject to the operator's documented assessment. Acknowledging these terms is not blanket consent for unrelated marketing. No marketing list or advertising tracking is enabled.
Retention and deletion
Anonymous reports are accessible for one hour and cleared on subsequent assessment requests or scheduled maintenance. Public website report caches expire after 24 hours. If persistent storage is not configured, reports are held temporarily in application memory and disappear on restart. Saved pilot applications are retained while active; drafts and inactive applications are scheduled for deletion after 180 days without an update. Non-personal AI cost accounting is retained for the programme lifetime to enforce its cumulative spending cap. Rate-limit records are deleted after expiry. Invited customers can delete their account in the dashboard.
Encrypted local backups, when commissioned, rotate after 30 days. Deleted information may remain in these isolated backups until they expire and must be deleted again after a restoration. No independent off-server backup is claimed in this release.
Service providers and transfers
Hosting uses the existing ServerXL environment. Groq is the optional AI processor. Before live AI processing, the operator must review processor terms, data use, retention, processing locations and any required UK international-transfer safeguards. Website content is untrusted evidence, never instructions that the system is authorised to follow.
Cookies and security
Only essential session and CSRF protections are used. There are no analytics or advertising cookies. HTTPS, secure HttpOnly cookies, request limits and account-scoped access protect the service. A session cookie expires after up to eight hours for signed-in accounts; anonymous session cookies last for the browser session. Security rate limits use keyed hashes rather than stored raw IP addresses.
Your rights
You may request access, correction, deletion, restriction, portability or object where applicable. Use the privacy contact above once the programme opens. You can also complain to the Information Commissioner's Office. Requests should normally receive a response within one month, subject to applicable legal exceptions.