Privacy notice

This notice explains how the operator of RamsBox (ramsbox.co.uk) uses personal data. The controller is the operator of RamsBox. Replace this sentence with the legal name, address and ICO registration number before you rely on it.

What we hold

Account email, optional name, a password hash if you set one, and the company profile (name, address, phone, email, website, company number, accreditations, brand colour and logo). For 30 days we also hold the job details and the RAMS you asked for, so you can download the PDF again. A record that you accepted the draft wording, and where you pay the immediate-supply cancellation wording, is kept with the time and the terms version. Stripe gives us a customer id and payment references. We do not store card numbers. Paid AI generations store token counts and the model name. Those logs do not keep the job text. A plain-English account of this is on the your data page.

Why, and the lawful basis

Contract: to create your account, produce the document you asked for, and let you download it during the 30-day window. Legitimate interests: to keep the service secure, enforce the AI spend limits, and investigate fraud or abuse. Legal obligation: to keep payment records for tax. Consent is not the basis for the session cookie, which is strictly necessary. You can object to processing based on legitimate interests.

Processors

Stripe processes payments. xAI receives the job text and the draft only when a paid generation runs. Vercel hosts the application and, if a blob token is configured, the logo files. The database host (the provider named in the deployment's database URL) stores the account and, for 30 days, the document. Email, if you configure SMTP, goes through that mail provider and is used for sign-in links and a reminder three days before a document is deleted. No one else is given the contents of a RAMS for marketing.

International transfers

Stripe, xAI, Vercel and some database hosts process data outside the UK. Where that happens the operator relies on the UK adequacy regulations or on the International Data Transfer Agreement / Addendum, as the contract with that provider allows. Ask the operator which transfer tool is in place for a given processor before you upload special-category data. Do not put health data into a RAMS unless you have a reason and a lawful basis of your own.

How long

The RAMS, the job details you typed, and any file held only for that document are deleted 30 days after the document is created, or sooner if you delete it. That is so client and site information is not kept. The output is a PDF only. We do not provide a Word or plain-text copy. A job details file you download is stored on your device, not as a second copy of the RAMS. Account and company profile data are kept while the account is open, then deleted or anonymised within 12 months of closure unless a longer period is required. Payment records are kept for the period UK tax rules require, typically six years. Acceptance records are kept for the same period as the account so the operator can show what was agreed. Token logs, without the job text, are kept for 24 months. Magic-link tokens are deleted after they expire.

Your rights

People in the UK can ask for access, correction, deletion, restriction and portability, and can object to processing based on legitimate interests. You can complain to the Information Commissioner's Office at ico.org.uk. Email the operator to use these rights. Nothing in this notice limits them.

Cookies

One essential session cookie keeps you signed in. See the cookie notice.