Last updated: August 2026 · Version 2.1 · UK GDPR Article 13 compliant
🔒 Short version: If you create an account, your email address and saved compliance reports are stored securely in Google Cloud Firestore, hosted in London, UK (europe-west2). Documents submitted for analysis are processed by Google’s Gemini AI and not retained after analysis. Documents you save to My Library are stored securely in Firestore, London UK. You can delete your account and all saved data at any time.
Data Controller: Privacomply Ltd
DPO / Responsible Person: David Anderson, CIPP/E, CIPM (Data Protection Officer)
Email: privacy@privacomply.co.uk
Website: childsafe-ai.privacomply.co.uk
ChildSafe AI is a compliance assessment tool for organisations that process children’s data. It is operated by Privacomply Ltd and designed by an IAPP-certified privacy professional.
When you run a compliance analysis, the first 4,000 characters of your document are transmitted to Google’s Gemini AI via our serverless function. This content is:
⚠️ Please do not submit documents containing personal data (e.g., individual names, email addresses). ChildSafe AI is designed for policy documents and compliance reports, not personal records.
ChildSafe AI offers optional user accounts via Google Sign-In (Firebase Authentication). If you create an account, the following data is collected and stored in our cloud database, hosted in London, UK:
| Data | What’s stored | Location | Retention |
|---|---|---|---|
| Email address | Your Google account email, used for authentication and account identification | 🇬🇧 Firebase Auth, London UK | Until you delete your account |
| Firebase User ID (UID) | Anonymised unique identifier assigned by Firebase at sign-up | 🇬🇧 Firebase Auth, London UK | Until you delete your account |
| Compliance reports | Saved analysis results: scores, findings, framework assessments, article and standards breakdowns. No document content is stored. | 🇬🇧 Firestore, London UK (europe-west2) | Until you delete the report or your account |
| Report metadata | Document name (as entered by you), date of analysis, risk level, frameworks assessed | 🇬🇧 Firestore, London UK (europe-west2) | Until you delete the report or your account |
| Documents saved to My Library | The full content of documents you explicitly save to My Library for future reference | 🇬🇧 Firestore, London UK (europe-west2) | Until you delete the document or your account |
If you do not sign in, no account data is collected. The tool operates fully without an account; reports are stored in your browser only.
The following data is stored in your browser only — it never leaves your device via our systems:
| Key | What’s stored | Retention |
|---|---|---|
childsafe_ai_history | Up to 25 analysis summaries: document name, score, risk level, framework tags, date. No document content. | Until you clear browser data |
childsafe_welcome_seen | Whether you have seen the onboarding modal | Until you clear browser data |
childsafe_ai_reviewers | Reviewer registry: name, qualifications, hashed PIN (SHA-256), review count | Until you clear browser data |
childsafe_audit_log | Anonymised audit entries: timestamp, framework IDs, document type, risk band. No document content. No names. | Last 50 entries (FIFO) |
Our hosting provider Netlify automatically records standard access logs including your IP address, request timestamp, and response size. These logs are retained for 30 days and are governed by Netlify’s privacy policy.
| Processing activity | Lawful basis |
|---|---|
| Transmitting document content to Gemini API for analysis | Legitimate interests (Article 6(1)(f)) — you actively submit the document; processing is necessary to deliver the service you requested |
| Creating and managing your user account (email, UID) | Contract (Article 6(1)(b)) — processing is necessary to provide the account-based service you have signed up for |
| Storing compliance reports in Firestore | Contract (Article 6(1)(b)) — report persistence is a core feature of the signed-in service you have requested |
| Storing My Library documents in Firestore | Contract (Article 6(1)(b)) — My Library document storage is a core feature of the signed-in service; users explicitly choose to save documents and retain full control to delete them at any time |
| Netlify access logs (IP, timestamp) | Legitimate interests — security, abuse prevention, service operation |
| Browser localStorage (history, reviewers, audit log) | Legitimate interests — functionality and audit capability; all stored locally under your control |
| Data | Retention |
|---|---|
| Document content submitted for analysis | Session only — discarded immediately after analysis. Zero server-side retention. |
| User account (email, UID) | Retained until you delete your account. Request deletion: privacy@privacomply.co.uk |
| Saved compliance reports (Firestore) | Retained until you delete individual reports or your account. |
| Documents saved to My Library | Retained until you delete the document or your account. Deletable within the app. |
| Browser localStorage | Retained until you clear your browser data. You are in full control. |
| Netlify access logs | 30 days (Netlify standard) |
🇬🇧 All personal data is stored and processed in the United Kingdom (London). Our cloud database (Firestore) and authentication service (Firebase Auth) are configured to use Google Cloud’s europe-west2 (London) region. No personal data is transferred outside the UK.
| Processor | Processing Location | Purpose | Safeguard |
|---|---|---|---|
| Google Cloud / Firebase Authentication | 🇬🇧 London, UK (europe-west2) | User authentication — Google Sign-In, account management | UK-region configuration; governed by Google Cloud DPA. |
| Google Cloud / Firestore | 🇬🇧 London, UK (europe-west2) | Cloud database — storing compliance reports, metadata, and My Library documents | UK-region database; governed by Google Cloud DPA. Data does not leave the UK. |
| Google Gemini API | 🇬🇧 London, UK (europe-west2) | Processing of document content for compliance analysis. Document content transmitted in-session only and not retained after response. | Governed by Google AI API Terms and UK GDPR Data Processing Addendum. |
| Netlify Inc. | UK/EU CDN edge | Hosting, CDN, serverless function proxy | Netlify DPA; transit proxy only — no content storage. |
All personal data is stored in Google Cloud’s London (europe-west2) region. No personal data is intentionally transferred outside the United Kingdom. Should any incidental transfer occur via CDN infrastructure, Standard Contractual Clauses (SCCs) apply via both processors’ DPAs.
As a UK data subject, you have the following rights under UK GDPR:
To exercise any right, contact: privacy@privacomply.co.uk
You also have the right to lodge a complaint with the ICO: ico.org.uk/make-a-complaint
ChildSafe AI produces AI-generated compliance assessments. These are advisory outputs only and do not constitute automated decisions about individuals under Article 22 UK GDPR. All compliance certificates require human expert review and sign-off before they are issued.
ChildSafe AI uses the following browser storage mechanisms:
We do not use any advertising, analytics or third-party tracking cookies.
ChildSafe AI is a professional compliance tool intended for use by organisations and privacy professionals. It is not directed at children and we do not knowingly collect data from individuals under 18.
Version 2.1 (August 2026) reflects the introduction of Firebase user accounts and Firestore cloud report storage in London, UK, and clarifies My Library document storage. The version number and date at the top of this page reflect the current version.
For any privacy questions: privacy@privacomply.co.uk
For general enquiries: privacy@privacomply.co.uk
ChildSafe AI Privacy Notice v2.1 · August 2026 · Privacomply Ltd · Designed by David Anderson CIPP/E CIPM