Privacy policy

1. Who is responsible for your data

This website, valitrac.com, is operated by ValiTrac AI (“we”, “us”), the data controller for the personal data described here.

2. What we collect, why, and our lawful basis

Contact form

When you submit the form on our contact page we collect your name, email address and message, and — if you choose to provide them — your company, country and the requirement you are enquiring about. We use this solely to respond to your enquiry and to keep a record of the correspondence.

Lawful basis: our legitimate interest in responding to enquiries about our services, and, where your enquiry is a step towards an agreement, the performance of a contract.

Email signups

If you tick the consent box and submit the signup form, we store your email address and — if you provide them — your name and company, together with the page you signed up from, the date, and the exact wording of the consent you agreed to. We use this only to email you when we publish a new guide, calculator or template.

Lawful basis: your consent. You can withdraw it at any time using the unsubscribe link in any email we send, or by contacting us — we then mark your record as unsubscribed and stop emailing you. We never pass your address to anyone else, and we do not send third-party advertising.

The AI technical assistant

When you submit a question to the assistant, the text of that question is transmitted to our AI model provider (see section 4) so that an answer can be generated, and is matched against our knowledge base. We do not attach any identifier to the question and we do not build a profile of you from it.

Please do not enter personal data, client names, or confidential information into the assistant. It is a public tool and the question text may be retained in our operational logs and, if you submit feedback, in our feedback records.

If you rate an answer using the thumbs-up / thumbs-down control, we store the question, an excerpt of the answer, the status of the answer, your rating, the category you selected and any comment you write. This is stored without any visitor identifier and is used to improve the quality of the service. Feedback is never automatically promoted into AI training data; any such use requires a separate, deliberate human review decision.

Lawful basis: our legitimate interest in providing and improving the service.

Site analytics

Our own analytics. We record a small, fixed set of events — for example that a page was viewed, an article was opened, or a button was clicked — together with the page path. These records contain no cookies, no visitor or session identifier and no IP address, and cannot be linked to you or to other events you generated. The text of AI questions is not included.

Vercel Web Analytics and Speed Insights. We also use Vercel’s own measurement, which reports page views, referrers, country, device type and page-loading speed. It sets no cookies. It is not, however, identifier-free: to count returning visits within a day without cookies, Vercel derives a hash from your IP address, user agent and a secret that changes daily. Vercel states that the IP address itself is not retained and that the hash cannot be reversed or linked across days. We consider this personal data while it exists, and describe it here rather than claiming the measurement is anonymous.

Google Analytics 4. We also use Google Analytics, which reports page views, referrers, country, device type and the paths people take through the site. Unlike the two above it, Google Analytics does set cookies — _ga and _ga_<id> — and it uses a persistent identifier stored in your browser to recognise a returning visitor across days. Google processes this data as our processor and may transfer it outside the UK and EEA under its standard contractual clauses. We do not use it for advertising, we have not enabled Google Signals or advertising features, and we do not link it to any other Google product.

Google Analytics only runs if you accept it. This page used to say that a cookie of that kind normally requires consent in the UK and EU, and that we were describing the gap plainly rather than claiming an exemption we did not have. The gap is now closed: the tag is not loaded, and no _ga cookie is set, until you choose Accept. Reject is one click in the same place, the same size, and is remembered so you are not asked again. You can change your mind at any time using Cookie settings at the foot of every page, which also deletes the Google Analytics cookies rather than merely stopping new ones.

Lawful basis: your consent for Google Analytics, which you give or refuse on the banner and can withdraw at any time; and legitimate interest for our own events and Vercel’s measurement, in understanding in aggregate which content is useful and whether the site performs well. Those two store nothing on your device, which is why they do not ask. If you would rather not be counted at all, a browser or extension that blocks analytics requests will prevent all three.

Information stored in your browser

Some features remember your preferences using your browser’s local storage — your light/dark theme choice, the items you have ticked on a checklist, and the work you enter in the qualification workspace. This information stays on your device, is never transmitted to us, and you can clear it at any time through your browser settings. Aside from the Google Analytics cookies described above, we set no cookies, and none are used for advertising.

Emailed copies of a record

Some tools can email you a Word or PDF copy of the record you have made, such as a calibration record or a qualification summary. The record only leaves your browser if you tick the box asking for that. If you do, it is sent to our server and held until you click the confirmation link we email to the address you gave, for 24 hours at most, and then deleted, whether or not you confirm. We use it for one thing: attaching it to that single email, which is sent through our email provider, Resend, acting on our behalf. We keep for up to 30 days only the address, the time, the tool you used and the wording you agreed to, so that we can show what you consented to. We do not keep the record.

Asking for a copy does not add you to a mailing list; that is a separate box. If you do not tick the box, nothing you type into the tool is sent to us, and the file is produced in your browser as before.

Technical logs

Our hosting providers process connection data, including IP addresses, in order to deliver the site and protect it from abuse. We use the IP address transiently to apply rate limits to the assistant; it is not written to our database. Lawful basis: our legitimate interest in the security and availability of the service.

3. What we do not do

• We do not sell, rent or licence personal data.
• We do not use advertising networks, tracking pixels or third-party marketing cookies.
• We do not build profiles of visitors or carry out automated decision-making that produces legal or similarly significant effects.
• We do not automatically use visitor questions or feedback to train AI models.

4. Who else processes your data

We use the following providers, each under a contract that requires them to process data only on our instructions:

We will also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.

5. International transfers

Some of these providers process data outside the United Kingdom and the European Economic Area, including in the United States. Where that happens, the transfer is covered by the safeguards permitted under applicable data protection law, such as the UK International Data Transfer Addendum or the European Commission’s standard contractual clauses. You may request details of the safeguards in place using the contact details in section 1.

6. How long we keep it

• Contact enquiries: kept while we deal with your enquiry and for up to 24 months afterwards, so that we have a record of the correspondence, unless you ask us to delete them sooner.
• Email signups: kept until you unsubscribe or ask us to delete them. If you unsubscribe we keep a minimal record that you opted out, so that you are not added again by mistake.
• AI feedback: kept for up to 24 months to support quality review. It contains no identifier for you.
• Analytics events: kept indefinitely in aggregate. They contain no personal data.
• Hosting logs: retained by our providers for short periods according to their own policies, typically days to a few weeks.

7. Your rights

Under the UK GDPR and the EU GDPR you have the right to ask us to give you a copy of your personal data, to correct it, to delete it, to restrict how we use it, to object to our use of it where we rely on legitimate interests, and to receive it in a portable format. Where we rely on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us through the contact form. We will respond within one month. Because our analytics and AI feedback records contain no identifier for you, we will usually not be able to locate those entries from your name or email alone.

If you are not satisfied with how we have handled your personal data, you may complain to the UK Information Commissioner’s Office at ico.org.uk, or to the supervisory authority in your country of residence.

8. Children

This is a professional engineering resource. It is not directed at children and we do not knowingly collect data from them.

9. Security

The site and the API are served over HTTPS. Access to the database is restricted and credentials are held in the hosting platforms’ secret storage. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the limited data we hold.

10. Changes to this policy

We may update this policy as the service develops — for example if we add accounts or a newsletter. The date at the top shows when it last changed. Material changes affecting how we use data you have already given us will be notified to you directly where we hold a means of contacting you.

This policy describes our actual data handling and is written in plain English. It is not legal advice; if your circumstances require a formally reviewed notice, have it checked by a qualified adviser.