Legal

Privacy Policy

Last updated: 4 August 2026

1. Who We Are

Red Flag AI Pro ("we", "us", "our") operates the website at www.redflagaipro.com. Red Flag AI Pro is a trading name of James Stokes, a sole trader established in the United Kingdom, whose trading address is 17 Mariston Way, Warmley, South Gloucestershire, BS30 8UD. James Stokes is the data controller for the personal data described in this policy. We are committed to protecting your personal data and complying with the UK GDPR, EU GDPR, and applicable data protection laws.

For data protection queries, contact us at: support@redflagaipro.com

2. What Data We Collect

Data	Why we collect it
Name & email address	To create and manage your account
Payment information	Processed securely by Stripe, we never store card details
Copy you submit for checking	To generate your compliance check results only
Check results and history	To display your dashboard and check history
AI governance quiz answers and scores	To generate your governance maturity score, gap report and roadmap. Stored against your email address in our database.
Governance records you create (including names and roles of your personnel)	Sentinel governance features let you log authorization records naming the person in your business accountable for a decision, their role, the decision itself, its expiry and its conditions. This content is stored solely to provide those features back to you. You remain the controller of personal data you enter about your own personnel and are responsible for having a lawful basis to record it; we process it only on your instructions and delete it with your account.
Email addresses entered to use our free tools	To deliver your result and send occasional relevant updates about compliance and governance. You can unsubscribe at any time.
Information you type into our guided document tools (DPIA generator, FRIA assistant, documentation assistant, EU database registration assistant, monitoring plan generator, AI use policy generator, AI literacy log)	Not collected by us. This content is processed entirely in your browser to generate your draft and is never transmitted to our servers. Only your email address, if you choose to unlock the result, is sent to us.
Business contact details of prospects	Names, job titles and published business email addresses collected from public sources, used to make a one to one business introduction. See section 4a.
Usage data (pages visited, features used)	To improve our service
IP address	For security and fraud prevention

3. Your Submitted Copy: Data Handling and Confidentiality

The marketing copy you paste into Red Flag AI Pro is used solely to generate your check results. This is your data. It remains your data. We do not:

Store your submitted copy beyond processing (removed after check delivery unless you retain history)
Allow any human to view, access, or read your submitted copy
Use your copy to train AI models or improve our service
Share your copy with third parties for any reason
Retain your copy for longer than necessary to display your check history

You can delete your check history at any time from your dashboard. Deletion is permanent.

No human review, no training: Red Flag operates under contractual terms that prohibit human review, training, or onward disclosure of your data. This is equivalent to closed enterprise AI tools.

4. Legal Basis for Processing (UK & EU GDPR)

Contract: Processing your account data and checks to deliver the service you signed up for
Legitimate interests: Improving our service, preventing fraud, ensuring security, contacting business prospects using published business contact details (see section 4a), and sending occasional relevant updates to people who used our free tools, with an unsubscribe in every email
Legal obligation: Retaining billing records as required by law
Consent: Marketing emails where we asked for and you gave consent, you can unsubscribe at any time
Consent: Sharing conversion data with Google Ads for advertising measurement and Customer Match, you can opt out via Google's Ads Settings

4a. Business Contacts and Prospects

This section applies if we have contacted you at your business and you have never used our service. It explains, as required by Article 14 of the UK GDPR, what we hold about you and where it came from.

What we hold and where it came from. Your name, job title and published business email address, obtained from public sources such as your company website, your public LinkedIn profile, Companies House filings, and public regulatory registers including published rulings of the Advertising Standards Authority.

Why, and our lawful basis. We use these details to make a one to one, business relevant introduction, typically where a public regulatory finding suggests our service may be genuinely useful to your business. Our lawful basis is legitimate interests: our interest in introducing a relevant business service, balanced against the limited intrusion of a single email to a published work address. We do not use these details for any other purpose, and we do not sell or share them.

How long we keep them. Prospect records are kept for 12 months from our last contact with you, then deleted. If you ask us not to contact you, we keep the minimum needed to honour that request permanently.

Your right to object. You have an absolute right to object to direct marketing. Reply "stop" to any email from us, or write to support@redflagaipro.com, and we will not contact you again.

5. Third Parties We Use

Supabase: Database and authentication (data stored in EU region)
Stripe: Payment processing (PCI DSS compliant)
Vercel: Website hosting
OpenAI / Anthropic: AI processing of check requests and the site assistant
DigiCert / freeTSA: For Sentinel customers only: the cryptographic hash of certain governance records is sent to an independent time stamping authority to seal them with a verifiable timestamp. The record's content itself is never sent, only its hash.
Witness Network peers: Red Flag AI Pro's own company-level audit chain exchanges hourly cryptographic hashes with independent peer companies (currently sebbi.pro / AILeash) under the open, published Witness Network protocol. This exchange is company-level infrastructure only: it shares a hash of our own operational record, never your personal data, account details, or check content. See redflagaipro.com/witness-network.
Loops: Email marketing and transactional emails (your email address and plan tier are shared to send relevant communications). You can unsubscribe at any time.
Google Ads: Conversion data (e.g. signups) may be shared with Google to measure ad performance and show our ads to similar audiences (Customer Match). You can opt out via Google's Ads Settings.

All third parties are bound by appropriate data processing agreements.

Sharing a report by link is optional and off by default. If you choose to share one, its score and flags become visible to anyone with the link until you turn sharing off again.

6. How Long We Keep Your Data

Account data: retained while your account is active and for 30 days after deletion
Billing records: 7 years as required by UK law
Check history: retained until you delete it or close your account
Free tool emails: retained until you unsubscribe or ask us to delete them
Business prospect records: 12 months from last contact, then deleted (see section 4a)

7. Your Rights

Under UK and EU GDPR, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate data
Erasure: Request deletion of your data (right to be forgotten)
Portability: Receive your data in a portable format
Object: Object to processing based on legitimate interests
Restrict: Request we limit how we process your data

To exercise any of these rights, email support@redflagaipro.com. We will respond within 30 days.

8. Cookies

We use essential cookies for authentication and session management. No consent banner is required for these under UK GDPR, since the service cannot function without them.

We also use non-essential cookies for Google Ads conversion tracking and our affiliate referral programme. These are not loaded until you accept cookies via the banner shown on your first visit. You can withdraw consent at any time by clearing your browser's site data, which will show the banner again. Google Ads conversion data is used to measure advertising performance and for Customer Match (showing ads to existing and similar potential customers). You can opt out of personalised advertising at any time via Google's Ads Settings.

9. Data Security

We implement industry standard security measures including encrypted data storage, HTTPS, and access controls. However, no method of transmission over the internet is 100% secure and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes by email. Continued use of Red Flag AI Pro after changes constitutes acceptance.

11. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve it:

Email: support@redflagaipro.com
Response time: We will acknowledge your complaint within 5 working days and aim to resolve it within 30 days.

If you remain dissatisfied after our internal process, you have the right to escalate to the UK Information Commissioner's Office (ICO) at ico.org.uk. This internal complaints process is provided in accordance with the Data Use and Access Act 2025.

12. Contact

For any privacy questions: support@redflagaipro.com