Legal

Privacy Policy

Effective date: 29 September 2026 · Last updated: 23 October 2026

This Privacy Policy explains how Go Regulatory Ltd (company number 17430980) ("we", "us", "our"), registered at Homelands, Rock Hill, Orpington, United Kingdom, BR6 7PP, collects, uses, and protects your personal data when you use the GORA AI platform. We are the data controller for the purposes of UK GDPR and EU GDPR.

1. Data we collect

Category	Examples	Why we collect it
Account data	Name, work email address, job title, organisation name	To create and manage your account and provide the service
Profile data	Role, organisation size, primary regulatory market	To personalise your workspace experience
Workspace data	Products selected, regulatory markets, readiness checklist state, notes, templates	To provide and restore your workspace across sessions
Payment data	Billing name, payment card details (handled by Stripe)	To process subscription payments. We never store card numbers.
Usage data	Pages visited, features used, browser type, IP address, timestamps	To improve the platform and diagnose errors
Communications	Emails you send us, support requests	To respond to your enquiries

We do not collect special category data (health, biometric, etc.) and do not ask for it. We do not collect data from children under 16.

2. Legal basis for processing

Contract performance — processing necessary to provide the subscription service you signed up for.
Legitimate interests — improving the platform, preventing fraud, security monitoring. We have assessed these interests do not override your rights.
Legal obligation — retaining certain records required by law (e.g. tax records).
Consent — where you have given explicit consent (e.g. marketing emails). You can withdraw consent at any time.

3. Cookies

By default we use only essential and functional cookies and browser storage — what is needed to keep your session active, remember your consent choice, and restore your workspace preferences. We do not use advertising or marketing cookies. Product analytics (PostHog, see section 4) runs only if you choose "Allow analytics" on the cookie banner; if you decline or ignore the banner, no analytics script is loaded. Error monitoring (Sentry, see section 4) runs for everyone because it is needed to keep the service working, and it does not use advertising or tracking cookies. You can control cookies through your browser settings, though disabling essential cookies may break core functionality. See our Cookie Policy for the full list of cookies, their purpose, and how to manage them.

4. Third-party processors

We share data only with processors necessary to operate the service, each bound by data processing agreements:

Supabase — cloud database, authentication, and transactional account emails (e.g. sign-up confirmation, password reset). Data hosted in the EU (Frankfurt, eu-central-1).
Stripe — payment processing and billing receipts. Stripe is PCI-DSS Level 1 certified. See Stripe's Privacy Policy.
Anthropic — AI model provider (Claude API) for the GORA AI assistant. Your questions and the relevant workspace context are sent to Anthropic to generate an answer; Anthropic does not use API data to train its models. If you add your own API key, queries go directly from your browser to Anthropic under their terms.
Vercel — website and application hosting.
Resend — delivery of account emails such as password resets.
Sentry (Functional Software Inc.) — error monitoring, hosted in the EU (Germany). When something breaks we receive technical details (browser, page, error) and, for errors only, a session replay in which all text and form entries are masked. Email addresses, passwords and login tokens are removed before data is sent.
PostHog — product analytics, hosted in the EU (Frankfurt), used only if you choose "Allow analytics" on our cookie banner. It records how features are used (for example which buttons are clicked) linked to an anonymous account ID; text and form entries are never recorded. You can withdraw consent at any time via "Cookie settings".

We do not sell your data to third parties. We do not use your data for advertising.

The public sandbox (demo)

When we say the sandbox "saves nothing", we mean your demo workspace: the example devices, checklist ticks, notes, templates, labels and uploads you try in the sandbox stay in your browser's memory, are not stored on our servers, and are cleared when you reload or after 15 minutes idle. A few things do leave your browser, as they would on any website:

AI questions you type are sent to Anthropic (via our server) to generate an answer. To limit demo use, we keep a daily counter against a one-way hash of your network address — not the address itself and not your question.
Forms you choose to send — for example a contact request or a label print quote — are stored by us so we can reply.
Error reports (Sentry) and, only if you allow analytics, usage analytics (PostHog), as described above.

5. Data retention

Account and workspace data is retained while your account is active and for 90 days after deletion, then permanently erased.
Payment records are retained for 7 years as required by UK tax law.
Server logs are retained for 30 days then deleted.

6. International transfers

Your data may be processed outside the UK/EEA by our sub-processors. Where this occurs, we rely on standard contractual clauses or adequacy decisions to ensure equivalent protection.

7. Your rights

Under UK and EU GDPR you have the following rights:

AccessRequest a copy of data we hold about you.

RectificationCorrect inaccurate personal data.

ErasureRequest deletion of your personal data ("right to be forgotten").

RestrictionAsk us to limit processing in certain circumstances.

PortabilityReceive your data in a structured, machine-readable format.

ObjectObject to processing based on legitimate interests or for direct marketing.

Withdraw consentAt any time, where processing is based on consent.

Lodge a complaintWith the UK ICO (ico.org.uk) or your local supervisory authority.

To exercise any right, contact us at support@goregulatory.com. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but take our obligations seriously.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the platform. The date at the top of this page reflects when it was last updated.

10. Contact us

Data controller: Go Regulatory Ltd, Homelands, Rock Hill, Orpington, United Kingdom, BR6 7PP
Privacy enquiries: support@goregulatory.com

If you are in the EEA and have a concern we have not resolved, you have the right to contact your local data protection authority.