Privacy Policy: RAMScribe
1. What we collect
- Account / contact data: name, email (if you create an account or buy).
- Document inputs: the information you enter to generate a RAMS: company, site name & address, author name & role, client/principal contractor, and any operative/competence details you choose to include. Some of this may be personal data (e.g. named individuals).
- Payment data: handled by Paddle (we do not receive or store card details).
- Usage/technical data: IP, device/browser, pages used, for security and analytics. See Section 4 for the cookies this involves.
2. Why we use it (purposes & lawful bases)
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Generate your document & provide the Service | Performance of a contract |
| Process payment | Contract / legal obligation (tax) |
| Security, fraud prevention, service improvement | Legitimate interests |
| Service emails (e.g. receipts) | Contract |
| Marketing emails (if any) | Consent (opt-in) |
3. AI processing & sub-processors
To generate documents we send your inputs to third-party processors. We use providers on paid/enterprise tiers that do NOT use your data to train their models:
- Google (Gemini API, paid tier): AI generation. Confirmed on the paid Google AI Studio tier: inputs are not used to train Google's models.
- Paddle.com Market Ltd: payments / merchant of record.
- Vercel: hosting (frontend and backend). We have or will put data-processing terms in place with each. We do not sell your data.
4. Cookies & analytics
We use PostHog (analytics and session replay) to see how the site is used, so we can fix what's broken and improve the product. PostHog is a separate, dedicated instance for RAMScribe only; it is not shared with any other product or organisation.
Session replay (a recording of on-screen activity, not audio or video) is used to understand navigation and usability issues. Text you type into forms is masked in every recording by default, and the generated document itself (which can contain names and addresses) is masked separately: neither is visible in a replay. We do not send your email address to PostHog when you join the waitlist, only that a signup happened and where from.
5. International transfers
The operator and some processors are outside the UK. Where we transfer personal data internationally we rely on appropriate safeguards (e.g. the providers' standard contractual clauses / adequacy mechanisms). (Launch-stage position; solicitor to confirm the exact transfer mechanism once there's real revenue.)
6. Retention
We keep document inputs and generated documents until you delete them. You can delete any document yourself at any time from your account, or email us to request deletion (see Section 7). Payment/tax records are kept for as long as the law requires.
7. Your rights (UK GDPR)
You may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent. Contact info@ramscribe.co.uk. You can complain to the UK Information Commissioner's Office (ICO).
8. Security
We use reasonable technical and organisational measures (encryption in transit, access controls). No system is perfectly secure.
9. UK representative
As a non-UK controller offering services to UK individuals, a UK GDPR Article 27 representative may be required (subject to the occasional-processing exemption for low-risk, non-large-scale processing, which likely applies at launch volume). Genuinely open, not yet resolved: get this confirmed by a solicitor before volume grows beyond occasional processing.
10. Children
The Service is for business users and not directed at children.
11. Changes
We may update this policy; the current version is published on the site.
RAMScribe. info@ramscribe.co.uk.
Effective date: 17 July 2026.