Who is responsible for your data?
Customers control the subcontractor and document information they put into CertChaser. The service operator acts as their processor for that information, subject to an agreed data-processing agreement. The operator is a controller for its own account, billing and support records. The operator’s legal identity and contact details are awaiting confirmation.
Information the service handles
Account and team contact information; organisation details; subcontractor business and contact records; documents and their metadata; review decisions; request and delivery records; usage and subscription information; and security and audit records. Do not upload unnecessary sensitive personal data.
Why this information is used
To provide document administration, authenticate users, enforce tenant access, send requested service messages, process subscriptions, maintain security and help customers export or delete their records. Customers must establish a lawful basis for the personal information they upload and notify their contacts appropriately. Operational service messages and marketing require separate treatment.
Providers and international transfers
The proposed production stack uses providers for hosting, authentication, database and private storage, payment processing and transactional email. The deployed provider list, regions and relevant safeguards must be recorded in the final data-processing agreement. No unconfigured provider is represented as processing this preview’s records. Document contents are not sent to AI services by default.
Security and access
The production design uses membership and role checks, tenant policies, private storage and scoped upload links. Every security control requires verification in the deployed environment. No security measure guarantees complete protection. Support document access should be customer-authorised, limited and logged.
Retention and your rights
Customers determine document retention within the service’s supported policy. Production deletion times, backup retention and recovery procedures must be confirmed before launch. You may have rights to access, rectification, erasure, restriction, portability and objection under UK data protection law. For customer-controlled records, contact the organisation that requested your documents.
Questions and complaints
Use the contact page for the published support channel when available. You may also raise a concern with the UK Information Commissioner’s Office at ico.org.uk.
Local demonstration data
The demo uses local development storage and fictional seeded records. It is not configured for production personal data. Developers can reset local records as described in the repository documentation.