Privacy Policy: RAMScribe
1. What we collect
- Account / contact data: name, email (if you create an account or buy).
- Document inputs: the information you enter to generate a RAMS: company, site name & address, author name & role, client/principal contractor, and any operative/competence details you choose to include. Some of this may be personal data (e.g. named individuals).
- Saved details: the company profile and projects you choose to save (company, author, contact line, logo, client, site and project details such as permits, access and welfare), so they fill in your next RAMS.
- Optional answers: where you heard about RAMScribe and how many people work in your business, if you choose to answer after your first RAMS. We use them to see which channels bring customers and who RAMScribe is for. You can skip both questions.
- Feedback: what you write if you use Send feedback in your account, with your account email and the page you sent it from, so we can reply.
- Payment data: handled by Paddle (we do not receive or store card details).
- Usage/technical data: IP, device/browser, pages used, for security and analytics. See Section 4 for the cookies this involves.
2. Why we use it (purposes & lawful bases)
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Generate your document & provide the Service | Performance of a contract |
| Process payment | Contract / legal obligation (tax) |
| Security, fraud prevention, service improvement | Legitimate interests |
| Optional questions after your first RAMS (where you heard about us, business size) | Legitimate interests (both questions are optional) |
| Visit counts without cookies (Vercel, PostHog cookieless mode) | Legitimate interests (you can object) |
| Recording which site or link led to a purchase | Legitimate interests (you can object) |
| Analytics cookies and session replay (PostHog) | Consent |
| Reading and replying to feedback you send | Legitimate interests (sending feedback is optional) |
| Service emails (e.g. receipts) | Contract |
| Marketing emails (if any) | Consent (opt-in) |
3. AI processing & sub-processors
To generate documents we send your inputs to third-party AI providers. Suggest trade and hazards sends only your job description, and only to Anthropic:
- Anthropic (Claude API): our main AI provider. Under Anthropic's commercial terms, inputs and outputs sent through the API are not used to train its models.
- OpenAI (API): used when Anthropic is unavailable. Inputs and outputs sent through the API are not used to train OpenAI's models.
- OpenRouter: a last-resort backup, used only when both of the above fail. OpenRouter passes your inputs to the model provider it routes to, and that provider may keep or use them under its own terms. We will remove this backup once our main provider is settled.
Other processors:
- Paddle.com Market Ltd: payments / merchant of record.
- Vercel: hosting (frontend and backend).
- Neon: our database, where your account and documents are stored.
- Resend: sends sign-in codes and purchase emails.
- PostHog: analytics (see Section 4). We have or will put data-processing terms in place with each. We do not sell your data.
4. Cookies & analytics
We use PostHog (analytics and session replay) to see how the site is used, so we can fix what's broken and improve the product. PostHog is a separate, dedicated instance for RAMScribe only; it is not shared with any other product or organisation. PostHog stores all of this analytics data, including the cookieless visit counts, in the EU.
Before you make a choice, we count visits with Vercel Web Analytics, measure page speed with Vercel Speed Insights, and count page views and clicks with PostHog in cookieless mode. None of these uses cookies or stores anything on your device. PostHog tells visits apart with a code it works out on its own servers from your IP address, browser, our site and the date. The code changes every day, PostHog does not keep your IP address or browser details with the event, and the code is never linked to your account or email. There is no session replay. This runs only on pages that show the cookie banner, and we use it for totals only, such as pages viewed, referring sites, device type, country and how many visitors start a document. We use this only to improve the site, which UK law allows without consent as long as you can object. To object, choose Reject all.
If you choose Accept all, PostHog sets analytics cookies (named ph_ followed by our
project key, kept for up to 365 days) and session replay is switched on. If you choose
Reject all, neither PostHog nor Vercel Web Analytics runs, and nothing is stored on your
device for analytics.
We are testing two versions of our home page to see which one explains RAMScribe better. On
your first visit, a small first-party cookie called rs_landing records which version you were
shown, so you see the same one each time. It holds only the letter "a" or "b", is not shared with
anyone, is used only to compare the two versions in total, and expires after 90 days. UK law
allows this without consent as long as you can object. To object, choose Reject all: you
then always see the standard version, and the cookie only remembers that choice. If you have
accepted analytics, PostHog also records which version you saw.
We also record how you first found RAMScribe, so we can see which sites and posts lead to
sales. On your first visit, your browser saves a small record called ramscribe_first_touch.
It holds the name of the website that sent you (not the page), the campaign tags in the link you
followed (for example utm_source=x), the page you landed on and the date. The record stays on
your device and is not sent anywhere until you start a purchase. When you start a purchase, the
record is added to your Paddle order. The record on your device is replaced after 90 days. UK
law allows this without consent as long as you can object. To object, choose Reject all:
the record is deleted and not made again.
Some storage on your device is strictly necessary and always on: the cookie that keeps you signed in, the copy of your form that is saved as you type, the project details you entered last time, and your cookie choice with the date you made it.
You can change your choice at any time with Cookie settings in the site footer or on your account page. If you withdraw consent, PostHog stops straight away and its cookies and stored data are deleted from your browser.
Session replay (a recording of on-screen activity, not audio or video) is used to understand navigation and usability issues. Text you type into forms is masked in every recording by default, and the generated document itself (which can contain names and addresses) is masked separately: neither is visible in a replay.
5. International transfers
The operator and some processors are outside the UK. Where we transfer personal data internationally we rely on appropriate safeguards (e.g. the providers' standard contractual clauses / adequacy mechanisms). (Launch-stage position; solicitor to confirm the exact transfer mechanism once there's real revenue.)
6. Retention
We keep document inputs, generated documents, your company profile and your projects until you delete them. You can delete any document, project or your company profile yourself at any time from your account, or email us to request deletion (see Section 7). Feedback emails are kept until you ask us to delete them. Payment/tax records are kept for as long as the law requires.
7. Your rights (UK GDPR)
You may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent. Contact info@ramscribe.co.uk. You can complain to the UK Information Commissioner's Office (ICO).
8. Security
We use reasonable technical and organisational measures (encryption in transit, access controls). No system is perfectly secure.
9. UK representative
As a non-UK controller offering services to UK individuals, a UK GDPR Article 27 representative may be required (subject to the occasional-processing exemption for low-risk, non-large-scale processing, which likely applies at launch volume). Genuinely open, not yet resolved: get this confirmed by a solicitor before volume grows beyond occasional processing.
10. Children
The Service is for business users and not directed at children.
11. Changes
We may update this policy; the current version is published on the site.
RAMScribe. info@ramscribe.co.uk.
Effective date: 20 October 2026.