Privacy Policy

This policy explains what Techcopter Ltd (“TechPHA”, “we”) collects when you use the TechPHA website and application, why we collect it, and what rights you have over it. It covers both account information and the engineering documents you upload into a study.

Who is responsible for your data

The data controller is Techcopter Ltd (registered in England and Wales, number 14423500), 2 Frederick Street, Kings Cross, London WC1X 0ND, United Kingdom. For any question about this policy or to exercise the rights described below, contact info@techpha.com.

What we collect

Account and contact information

When an account is created we process the name, work email address, organisation and role supplied, together with authentication data. If you contact us, we keep that correspondence.

Study content you upload

TechPHA processes the P&IDs and other process documents you upload, and the study records built from them — nodes, deviations, worksheets, safeguards, recommendations and reports. This content belongs to you and your organisation. We process it in order to provide the service and for no other purpose.

Usage and technical data

We process technical information generated by using the application, including log data, IP address, browser and device information, and records of actions taken within a study. Audit records of who created, modified and approved study entries are a functional part of the product and are retained with the study.

Billing information

Where a paid plan is taken, billing details are processed by our payment provider. We do not store full card numbers.

Cookies

The marketing site sets no analytics or advertising cookies. The application uses strictly necessary cookies to keep you signed in and to maintain session security. These cannot be disabled without preventing sign-in.

We use no analytics, advertising, or session-replay tooling anywhere on this site or in the application. There is no consent banner because there is nothing to consent to. If that ever changes, this section and a consent mechanism will change with it, before the tooling loads.

How AI processing works

Analysis of your drawings involves sending document content to a third-party AI model provider. These requests are made from the TechPHA backend, so provider credentials are never exposed to your browser.

The provider is OpenAI, called through its API. What leaves our servers is the study context for the request and, when a drawing is analysed, images of the drawing pages. Analysis is only ever performed when someone asks for it — nothing is sent in the background.

OpenAI states that content submitted through its API is not used to train its models, and is retained for up to 30 days for abuse monitoring before deletion. Requests are processed in the United States. We do not currently hold a zero-retention or regional processing agreement with OpenAI; if your organisation requires one, contact us before uploading drawings.

Suggestions returned by the model are stored against your study as proposals. They are inert until an engineer accepts them, and the record of who accepted what is kept for traceability.

Legal bases for processing

• Performance of a contract — operating your account and processing your studies.
• Legitimate interests — securing the service, preventing abuse, and improving reliability.
• Legal obligation — retaining records we are required to keep.
• Consent — where we ask for it separately, for example optional product communications. Consent can be withdrawn at any time.

Sharing and sub-processors

We do not sell personal data and we do not share it for advertising. We use service providers who process data on our behalf under contract, covering hosting, AI model inference, email delivery and payments.

International transfers

We are established in the United Kingdom, but your data is not stored here. Accounts, studies and uploaded drawings are held on servers in Singapore, and analysis requests are processed in the United States. Neither country is covered by a UK adequacy decision.

[State the transfer mechanism relied on — an IDTA or the UK Addendum to the EU SCCs with each sub-processor — and confirm a transfer risk assessment has been completed. Until that is in place and stated here, this section describes where the data goes but not the safeguard it travels under.]

Retention

Study content is retained for as long as the account is active, so that historical studies remain available and interpretable. On account closure, content is deleted or returned on request, subject to any retention we are legally required to apply.

As things stand: study content and the audit record of who accepted which AI suggestion are kept indefinitely while an account is open, because a hazard study is a record someone may need to defend years later. Server and application logs are kept by our host under its own schedule.

[Set and state concrete periods — how long study content survives account closure, how long backups persist, and how long log data is kept. “Indefinitely” is a description of current behaviour, not a retention policy, and a reviewer will treat it as one.]

Security

Access to studies is controlled, credentials are never handled in the browser, and audit records are maintained. We apply technical and organisational measures appropriate to the sensitivity of process safety documentation. No system is entirely without risk, and we do not claim certification we do not hold.

Your rights

Subject to the law applying to you, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, and you may object to processing carried out on the basis of legitimate interests. To make a request, contact info@techpha.com. You also have the right to complain to your data protection authority.

Children

TechPHA is professional engineering software and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We will update this page when our practices change and revise the date above. Where a change materially affects how we handle your data, we will notify account holders directly.