Privacy notice

SEND Appeal Builder turns documents you upload into draft appeal papers. This notice says what happens to those documents. It is written for the prototype that is running now, and it describes what the software actually does, not what it might do later.

Who is responsible

Data controller: Armen Sarkisian, Komitas 57, 0032 Yerevan, Armenia. Questions about your data: privacy@vitersoft.com.

What we ask for

• The files you upload, and the text taken out of them.
• Your e-mail address, if you give one, so we can send you the link to your drafts.
• Whether you are a parent or a consultant, and the date you first asked for an assessment.
• Your answers to the three feedback questions, if you answer them.

We never ask for your child's name, date of birth or address, and the drafts never generate them. In test mode you are asked to black them out before uploading.

Health information about a child

Educational psychology, speech and language, occupational therapy and medical reports contain data about health — special category data under Article 9 of the UK GDPR. We process it only because you have explicitly asked us to, by uploading it and ticking the confirmation on the first screen. You can withdraw that at any moment by deleting the job, which erases everything immediately.

How long we keep it

The files, the text taken from them, the extracted facts and the generated drafts are deleted 30 days after upload, together with your e-mail address. The bare job record with its counts is deleted after 60 days. You can delete everything sooner, at any time, from the delete page or from the link in your e-mail.

Deletion in this prototype is run by hand rather than on a timer. If you want your data gone at a particular moment, use the delete link — that takes effect immediately and does not wait for anyone.

Who else sees it

• Cloudflare, Inc. (USA and EU) — runs the website and the application. Our worker is pinned to the EU region.
• Supabase (EU, Frankfurt) — the database and the file store. Your files sit in a private bucket that only our server can read.
• Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, France (trading as Brevo) — sends the one e-mail with your link. It receives your e-mail address and the text of that message, nothing else.
• PostHog (EU, Germany) — counts how the tool is used. It receives counts and categories, no personal data: no e-mail address, no name, no diagnosis, no case reference.
• OpenRouter, Inc. (USA) — routes requests to the language model that reads a photographed page and helps place a document we could not recognise. It receives the image or the page text, never your e-mail address. If you would rather no document of yours reached it, upload text PDFs or DOCX files only: those are read entirely in your own browser and no model is called.
• Cloudflare Workers AI (EU region) — the fallback model, used only when OpenRouter is not configured. It receives the text of the pages.

Where any of these processes data outside the UK or the EEA — OpenRouter and Cloudflare in particular — the transfer is covered by Standard Contractual Clauses. Nothing you upload is used to train a model.

Cookies

None. The analytics are configured without cookies and without local storage, no profile is built about you, and nothing is written to your device. That is why there is no cookie banner.

Your rights

You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it — the delete link does the last one instantly. You can also complain to the Information Commissioner's Office (ico.org.uk).

What we are not

We are not solicitors, we do not represent you and we never write to the tribunal or to the council on your behalf. This is not legal advice.