Privacy Policy

1. Controller and contact

LOUGHPOINT LTD is the controller for LoughPoint account administration, support and our own service operations. We are registered in Northern Ireland, company number NI744495, at Forsyth House, Cromac Square, Belfast, Northern Ireland, BT2 8LA. Contact legal@loughpoint.com for privacy questions or rights requests.

This notice describes the current service as reviewed on 20 October 2026. We do not claim UK-only processing or a completed independent privacy certification.

2. Information and purposes

Account and access: Supabase sign-in supplies a user identifier and verified email. Our account database stores the identifier, email, status, trial plan and expiry, access-code hashes and assigned recipient emails, redemption information, timestamps, administrative audit events and request-limit records. Request-limit records contain a keyed one-way hash of your IP address or email, not the address itself. We use these to provide access and protect the service. We do not receive your email password. We store session identifiers, expiry and revocation times to enforce sign-out.

Support: we store the text you submit, conversation messages, ticket status, timestamps, account linkage, read markers, email preferences and email delivery status. Authorised support administration can view conversations to investigate and reply. The feedback form sends the text you enter, not your workspace files. Please use synthetic examples and exclude other people’s personal information.

Email: welcome messages and access codes, and support receipt or reply notifications, can be sent through Cloudflare email services or the configured Cloudflare relay. These services process recipient addresses and message content. Support notifications contain a reference and website link rather than the conversation body. Reply notifications default on and can be switched off in Help & feedback; initial receipts and essential service messages are separate. Emails you send to our @loughpoint.com addresses are delivered to business mailboxes we operate with Microsoft 365, where we read and reply to them.

Early access: if you apply for early access, we store your name, work email, company, role, team size, channels, how you plan today and anything you choose to add. We use this to decide who to invite and to contact you about early access, based on our legitimate interest in running a small, well-matched trial. If you are invited, we email you an access code and, during your free month, two short follow-up emails: a check-in and a reminder before your month ends, each linking to an optional survey run on Microsoft Forms. You can reply “stop” to end these emails. Survey answers are kept in our Microsoft account for up to 24 months.

Website and security: hosting and sign-in providers process request and authentication metadata, such as IP addresses and browser/request information, to deliver and secure the site. Our hosting keeps request logs (such as time, page requested and error details) for troubleshooting for up to 7 days. Browser preferences are described in our Cookie Policy.

Payment testing: customer online billing is disabled. Stripe test mode is limited to our own test accounts. It can send the tester’s email, site account identifier and selected test plan to Stripe. The application records sandbox event identifiers, types and timestamps. Sandbox payment details are entered on Stripe’s hosted page; do not use real payment-card details for tests.

3. Planning data and your organisation

Planning files and calculations are processed in your browser. The reviewed planning workspace has no application route that uploads those datasets to LoughPoint’s servers. Optional browser recovery stores a project copy, including its data and saved scenarios, in IndexedDB on this device. Downloads remain where you save them. Account details, support messages and service security information are processed separately as described in this policy.

Use aggregated operational data and avoid identifiable customer or employee records, passwords and payment details. Removing names alone does not necessarily make data anonymous: identifiers and small groups may still identify people. You must own the data or have permission to use it in LoughPoint, including any approval required by your organisation. Local processing does not override your organisation’s software or confidentiality policies. An authority confirmation is not a waiver of our responsibilities or your statutory rights. If a proposed service would require us to process customer personal data on an organisation’s behalf, appropriate processor terms and safeguards must be agreed before that processing begins.

4. Lawful bases

We use contract necessity to provide an individual’s requested account/service and related support, including steps requested before a contract. For organisation contacts and service security, abuse prevention, administration and responding to enquiries, we rely on legitimate interests in running and protecting the service, balanced against individuals’ rights. We rely on legal obligation where we must retain or disclose information by law.

A feedback acknowledgement is not consent to marketing. Where consent is the appropriate basis for optional processing, it must be requested separately and can be withdrawn without affecting earlier lawful processing. We do not use the planning tool to make solely automated decisions with legal or similarly significant effects about you.

5. Recipients and international processing

Relevant recipients include our authorised administrators; Supabase for identity and authentication; Cloudflare for hosting, account and support storage, request logs and automated email delivery; Microsoft for our business email mailboxes and early-access surveys; and Stripe for test payments made from our own test accounts. Professional advisers, authorities or a successor business may receive information where necessary and lawful, with appropriate safeguards. We do not sell personal information.

Providers may act as processors or as independent controllers for their own services. Their privacy information also applies to those independent activities. Our account and support database is stored by Cloudflare in the European Union. Supabase processes sign-in data in its West EU (Ireland) region. UK law recognises the EU and EEA as providing adequate protection for personal data. Cloudflare delivers the site from its global network, so a request may be handled in the data centre nearest to you, and some providers process limited data (such as logs or their own support records) outside the UK and EU; they rely on the transfer safeguards in their data processing terms. Contact legal@loughpoint.com for details.

6. Retention and deletion

Active planning state is held in memory. If you enable browser recovery, a project copy persists in this browser until removed using the recovery controls or browser site-data settings, or until the browser clears it. Saved scenarios and frozen forecast versions are part of the project, not browser history. Recovery is not an encrypted vault or a guaranteed backup; use a trusted device and protect it from other users. Downloaded files remain under your control and must be deleted separately. Display preferences (appearance, saved calculators and open Summary sections) remain in browser storage until changed or cleared, or until you switch off “Remember my display preferences on this device”.

We delete records automatically each day once they reach these periods: sign-in sessions 30 days after they expire; request-limit records after 7 days; unused access codes 90 days after they expire; accounts with no active subscription after 12 months without access or sign-in, together with their support conversations and email records (your sign-in identity with Supabase is deleted on request, and signing in again starts a new account); other support conversations after 24 months without activity; email delivery and administrative audit records after 24 months; early-access applications 90 days after a decision not to invite (or 90 days after applying if no decision is made) and 12 months after an invitation; billing records after 6 years, for tax and accounting. Hosting request logs are kept for up to 7 days. We delete emails in our mailbox once they are no longer needed, and within the same 24-month support period.

Our retention decisions must be based on the ongoing service relationship, unresolved support matters, security needs and any applicable legal obligations or disputes, rather than indefinite convenience. Contact us to request deletion earlier. We will explain any lawful reason for keeping specific information.

7. Your rights

Subject to applicable conditions and exemptions, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent where we rely on it. We may need proportionate information to verify identity; do not send passwords. We normally respond within one month and will explain any lawful extension.

Providing account identity is necessary for signed-in access; without it we cannot provide an account. Support text is supplied by you, and you choose whether to submit it. Contact legal@loughpoint.com to exercise rights. You can complain to us about how we use your personal data at complaints@loughpoint.com or through Help & feedback. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You can also complain directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. You do not have to complain to us first.

8. Updates

We will update this notice when our processing changes and provide additional notice where appropriate. Commercial billing or new data integrations will require a fresh review before activation.