Privacy notice

This notice explains how personal data is handled in the SelfCheck pilot, under the UK GDPR and the Data Protection Act 2018.

1 · Who is responsible

Pavlo Kushnirenko, acting as an individual. Correspondence to [email protected].

SelfCheck is operated by Pavlo Kushnirenko, acting as an individual. The operating company is in the course of being incorporated; until it exists, no contract is offered or concluded through this site, and the data controller is a named individual rather than a company.

For account data — the people who sign in — that person is the controller.

For the contents of messages you upload, we are a processor acting on your instructions. You decide what to upload, who may see it, and for how long. An email almost always contains personal data about people who are not our users and who have not been asked; that is precisely why the disclosure levels and expiry exist, and why the default is the narrowest one that does the job.

2 · What is processed

• Account data — email address, display name, organisation name, and where used, a password hash or passkey public key.
• Uploaded messages — the file you supply, its digest, and what the assessment derives from it. Retained so a recipient can re-verify independently.
• Access records — when a shared record was opened, by which recipient link, the browser and operating system family, the device type and the country.
• Sign-in sessions — for each place your own account is signed in: the browser and operating system family, the country, the network address it is used from, and when it was last used. The address is recorded so that you can see where your account is in use and end a session you do not recognise; it is shown to the holder of that account and to nobody else, and it is deleted with the session when that expires or is signed out. This is the one place a network address is kept in a readable form, and it is your own.
• Network address — retained only as a keyed hash. The address itself is never written to storage and is never displayed.

3 · Why

• To operate the service you asked for — our legitimate interests, and the performance of the arrangement under which you have access.
• To keep an evidential record of who accessed a shared assessment and when. This is not analytics: the record exists because both a holder and a recipient may later need to establish what was seen. It is part of the product, and it is disclosed to the holder who issued the link.
• To bound abuse — counting failed attempts against a hashed address.

We do not profile, we do not advertise, and we do not sell or share personal data with anyone for their own purposes. Optional Google Analytics runs on public pages only after you choose Allow analytics. Page addresses sent to Google exclude query strings and fragments. Email contents, shared assessment pages and private workspace pages are excluded. We set no advertising cookies.

Email we send you

Messages we send carry an invisible image that records when the message is opened, and links routed through our sending provider so that clicks are recorded. This is processed by Resend, and Amazon SES beneath it, and it is retained as long as the sending record it belongs to.

We say so here because a notice that claimed otherwise would be false, and because you are entitled to know before you open anything. If you would rather not be counted, most email clients can be set to block remote images, which prevents the open from being recorded; and you can ask us to stop by writing to [email protected], which we will honour for every future message.

It is worth knowing what the measurement is actually worth. Gmail fetches images through its own servers, often before anyone has read the message, so an open recorded against a Gmail address may be a machine rather than a person, and the recipient's address and location are never revealed to us. We treat the figure as a weak signal, which is all it is.

Separately from the messages you ask us to send, we email you when a request you raised is answered, declined, or when a message somebody supplied to you is withdrawn. These are operational messages about your own account's activity. They state what happened and link to the record; they never contain the message, the comparison, or anything the other party wrote — access to those is authenticated, time-limited and logged on this site, and putting them in an email would route around all three. You can turn them off in your settings at any time, and doing so changes nothing about the requests themselves.

4 · Cookies

Necessary cookies support the pilot gate, your session and federated sign-in. Optional Google Analytics cookies are enabled only after consent. Your choice is stored in this browser. Use Analytics preferences on public pages to change or withdraw consent; declining leaves the service available. Google may process usage data outside the UK. See https://policies.google.com/privacy for Google’s privacy information.

5 · Recipients

A shared record is disclosed only to the people you nominate, at the level you choose, until the expiry you set or until you withdraw it. We disclose nothing to anyone else except where the law requires it, and we would tell you unless prohibited from doing so.

Sign-in with Google or Microsoft, where enabled, discloses to that provider only that you signed in; it does not disclose what you upload or assess. The application, analysis services and records are hosted on Google Cloud in London. Cloudflare provides DNS and web protection, including Turnstile. Transactional and inbound email is handled by Resend; ZeptoMail is available as an alternative sending provider.

6 · Where

Records are stored on infrastructure in the United Kingdom and the European Economic Area. Where a transfer outside the UK is unavoidable, it is made on terms that the law recognises for that purpose.

7 · How long

• Assessment records: 12 months.
• The uploaded message: none beyond processing beyond what is needed to produce the assessment and to let a recipient re-verify it, and deleted with the record.
• Access records: for the life of the record it relates to, because deleting them would destroy the evidential value of the record itself.
• Access enquiries sent through this site: 90 days, then deleted.
• Account data: until the account is closed.
• Session records: expire within twelve hours.

8 · Your rights

You may ask for a copy of your personal data, ask us to correct or erase it, object to or restrict processing, and ask for portability. Where we act as processor for uploaded content, direct the request to the organisation that uploaded it and we will assist them.

Write to [email protected]. If you are not satisfied, you may complain to the Information Commissioner's Office at ico.org.uk, and you may do so without contacting us first.

9 · Automated decisions

An assessment is produced automatically. It has no legal effect on anyone by itself: it is information a person then decides what to do with. Every result states its reasons, its scope and what it does not establish, so that the person deciding can weigh it rather than defer to it.