Legal
Privacy notice
Last updated 12 November 2026
Core Thoughts Assured Ltd ("we") is the data controller for personal data about the people who use our website and accounts. For evidence collected from a customer's cloud account, the customer is the controller and we act as their processor under our Data processing addendum.
What we collect
- Account data: your work email, organisation name, role, and the date you accepted our terms. If you sign in with Google, we receive your name and email from Google.
- Product content: services, contracts, commitments, answers, notes and evidence seals you create. Every change is recorded in an audit log linked to your account.
- Cloud configuration metadata: read-only settings such as encryption, region and MFA status. We do not read the contents of your files or databases.
- Marketing preference: whether you opted in to product updates. This is off unless you tick the box.
Why we use it (lawful basis)
- To provide and secure your account — performance of a contract (Art. 6(1)(b)).
- To keep audit records and prevent fraud — legitimate interests (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)).
- To send product updates — consent (Art. 6(1)(a)), which you can withdraw at any time.
Where it is stored
Our application data is hosted in the United Kingdom. The providers we use are listed on our sub-processors page. Where any provider processes data outside the UK we rely on the UK International Data Transfer Agreement or an adequacy decision.
How long we keep it
Account data is kept while your account is open and for 6 years after it closes, for contract and tax records. Evidence seals and the audit log are kept for the life of the contract they support. If payment fails we suspend accounts after 14 days but do not delete evidence.
Visitor analytics
Our hosting provider, Lovable, counts visits to this site. It uses no cookies, stores nothing on your device, doesn't keep IP addresses and doesn't identify visitors. Lovable collects this data for us. Lovable's privacy policy explains how it handles it.
It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked. Detailed data is kept for 90 days and daily summaries for a year. We have no cookie banner, so this is recorded for every visitor.
Other services on this site
- Sign-in: when you sign in, a session token is stored in your browser's local storage so you stay signed in. It is removed when you sign out.
- Google sign-in: if you choose it, Google receives your sign-in request and shares your name and email with us.
- Google Fonts: our typefaces load from Google's servers, which receive your IP address and browser details when a page loads.
Your rights
You can ask to access, correct, delete, restrict or port your data, and object to processing based on legitimate interests. Email privacy@corethoughtsassured.co.uk; we reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.