Privacy notice
Effective from 3 November 2026. Version 2026-11-pm1.
1. Who we are
Sirin Digital Limited, registered in England and Wales with company number 17401586, is the controller for personal data processed through Loomiks AI Project Manager, except where this notice says otherwise. Registered office: Unit 403 Screenworks, 22 Highbury Grove, London N5 2ER, United Kingdom. Contact: contact@sirindigital.uk. We have not appointed a data protection officer, because the law does not require one for what we do; write to the same address about anything in this notice.
2. In short
Your file stays on your device. Only the text you approve is sent, after payment.
The document X-ray and the example workspace run in your browser and send nothing to us while you use them. Your files stay in your browser's storage on this device until you remove them, and we cannot see them. A run is different: after payment your browser sends the text you approved, and we use it to prepare your plan.
3. What we collect, and where it comes from
| What | Where it comes from |
|---|---|
| Your email address | You, when you start a run or ask for a code |
| The record of your request for immediate supply: the version of the wording, its fingerprint and the time | You, when you tick the box |
| The status of your run and its price | Our service |
| The payment confirmation, the amount, the currency and a payment reference, never your card details | Stripe, when you pay |
| The text you approve, with each document's name, page count and SHA-256 fingerprint. It can include personal data of people named in your documents | You, from your browser, after payment |
| The findings, your review notes and typed commands, the versions of your plan, the written narrative, the files you export, and a record of each analysis request and its answer | Our service, from the above and from what you do in the workspace |
| Hashes of the six-digit codes and of your sessions. We never store a code or a session itself | Our service |
| Standard request logs: IP address, time, page requested. Your IP address is also held briefly in memory to apply request limits | Your browser, through our hosting and network providers |
4. If you are named in a document someone sent us
A customer's document may name you, for example as a project contact. We receive only the text that customer approves. We do not look for people in it, and we cannot tell that you were named unless you contact us, which is why we do not write to you individually.
What we hold is your name and whatever else the text says about you, such as your role or work contact details. The customer is normally the controller of that data, and we process it on the customer's behalf to prepare the plan, for the periods given below. Your rights are best used with that customer. You can also write to us, and we will pass on your request and help.
5. Why we use it, and on what lawful basis
| Why | What we use | Lawful basis |
|---|---|---|
| To prepare, deliver and show your plan, and to email you about your run | Email address, approved text, findings, plan, files | Performance of a contract with you |
| To let you back in with a code | Email address, hashes of codes and sessions | Performance of a contract with you |
| To answer your questions and deal with faults and refunds | Email address, run, payment reference | Performance of a contract; our legitimate interests |
| To keep records of your payment, your request for immediate supply and any deletion | Payment records, consent record, deletion receipt | Legal obligation; our legitimate interests |
| To keep the service secure and working, and to see whether each run worked and what it cost us | Request logs, request limits, operating records that hold no document text | Our legitimate interests |
| To prepare the plan from personal data of others in the text you approve | Whatever the text holds | We act on the customer's instructions: see "If you are named in a document someone sent us" |
Where we rely on legitimate interests, they are keeping the service secure and working, being able to show what was agreed, and handling questions, complaints and claims. You can object to that use: see "Your rights".
You need give us nothing to use the X-ray or the example. For a run we need your email address, because that is how your code and your plan reach you, and the text you approve, because the run is made from it: without them we cannot supply a run.
6. Automated processing
Your text is read section by section by automated analysis, and your plan, its dates and its narrative are produced by software. To do that we send the text, section by section, to an analysis service provider that processes it on our behalf. Every request asks only for European endpoints that keep no copy of the text and do not use it for training. Only the reading sees your text as written. Later steps see only the quotes that passed the check, and the plan. Your email address is never sent. We make no decision about you by automated means alone that has a legal or similarly significant effect on you, and we do not build profiles of you.
7. Who receives it
We do not sell your personal data, and we use no advertising or analytics service. These organisations receive it where they need it to do their job:
- A database hosting provider, in London, United Kingdom.
- An application hosting provider, which also stores your files, in the European Union.
- A network protection and email delivery provider.
- An analysis service provider: the reading of your approved text and the preparation of your plan.
- Link, the payment service of Stripe: your payment, as merchant of record. Stripe decides how it uses that data, as a controller in its own right, under its own privacy policy at stripe.com/privacy.
We may also disclose it to professional advisers, to a buyer or successor of our business under the same protections, and where the law or a court requires it.
8. Transfers outside the UK
Some of these providers are based outside the UK, or have staff or systems there, including in the European Economic Area and the United States. Where personal data leaves the UK we rely on UK adequacy regulations (for the EEA, and for United States organisations certified under the UK-US data bridge) or on the data transfer agreement or addendum issued by the Information Commissioner. You can ask us at contact@sirindigital.uk which applies to which provider, and for a copy of the safeguard.
9. How long we keep it
| What | How long |
|---|---|
| Your approved text | 30 days |
| Stored answers from the analysis | 30 days |
| Your plan, its versions and its files, with the quotes they rest on | 24 months |
| A run that was never paid for | 14 days |
| An access code | It works for 15 minutes and is deleted within a day after that |
| Your session | 90 days at most, or until you sign out |
| A deletion receipt: each document's fingerprint, the date and what was deleted, with no document text | As long as we may need to show that the deletion happened |
| Standard request logs | A short period set by the hosting provider, for security and operations |
10. How we protect it
Traffic to this site is encrypted. Our database is reached only through checked functions and its tables are closed to direct access. Access codes and sessions are stored only as hashes, your files are kept in private storage, and our own logs hold no document text, no quotes and no email addresses. No system is perfectly secure, so if a breach is likely to put your rights at high risk we will tell you without undue delay, as the law requires.
11. Your rights
You have the right to:
- be told what we hold about you and receive a copy (access);
- have it corrected if it is wrong (rectification);
- have it deleted in certain cases (erasure);
- have its use restricted in certain cases (restriction);
- receive what you gave us in a portable format, where we use it under a contract or your consent (portability);
- withdraw any consent you gave, at any time, as easily as you gave it, which does not affect what was done before.
You can object at any time to our use of your data on the basis of legitimate interests, and we will stop unless we have compelling grounds to continue or need it for a legal claim.
"Delete now" in the workspace removes your approved text, your plan, its files and the records of the analysis at any time and gives you a receipt: each document's fingerprint, the date and what was deleted.
To use any of these rights, write to contact@sirindigital.uk. It is free. We may ask you to confirm that the address is yours. We reply within one month, and if a request is complex we may take up to two months more and will tell you so.
12. Complaints about your data
You have the right to complain to us. Write to contact@sirindigital.uk: we acknowledge a complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you live in the European Economic Area you can also complain to your local data protection authority.
14. Children
This service is a professional tool and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, tell us and we will delete it.
15. Changes to this notice
If what we do with personal data changes, we will update this notice and its version number and date. If a change matters to you and we can reach you, we will tell you directly.