Privacy Policy

What changed on 5 November 2026

• Section 9: we added sign-in with a Microsoft 365 account and recommended multi-factor authentication. We also corrected the wording on rate limiting.

See earlier changes to this Privacy Policy.

1. Introduction

SAR Portal (“we”, “us”, or “our”) operates the SAR Portal platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Company Details:

• Legal Name: Sekhon IT Consultants Ltd. (trading as SAR Portal)
• Company Registration: Ireland, CRO No. 579894
• Registered Address: 1 Beaufield Crescent, Maynooth, Co. Kildare, Republic of Ireland
• Email: info@sarportal.com
• Data Protection Officer: dpo@sarportal.com (or privacy@sarportal.com)
• Lead Supervisory Authority: Data Protection Commission (Ireland) - dataprotection.ie

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, company name, phone number
• Billing Information: Processed securely through Stripe (we do not store full payment card details)
• Case Data: Information you upload related to DSAR cases you manage
• Communications: Messages you send to our support team

2.2 Information Collected Automatically

• Usage Data: IP address, browser type, pages visited, time spent
• Cookies: Authentication tokens and, with your consent, analytics and advertising (see Section 11)
• Security Logs: Login attempts, API access, rate limiting events (application logs are kept for 90 days; our coding rules require emails, phone numbers and names to be masked, and these logs record the signed-in user’s account identifier; security-event logs keep IP addresses)

2.3 Information We Receive From Others

• Invited users: If an administrator of your organisation invites you to SAR Portal, we receive your work email address and the role they give you from that administrator. We use them to send your invitation and to create and manage your account (see Section 4). Your name is added when you first sign in.

3. How We Use Your Information

We process personal data only for the following purposes:

• Service Delivery: Provide, maintain, and improve SAR Portal
• Authentication: Secure access via Azure Entra External ID
• Billing: Process subscriptions and send invoices
• Communication: Send service updates, security alerts, and support responses
• Product and Service Updates: Occasionally tell customers and business contacts about our own, similar services, with an unsubscribe link in every email (see Section 4)
• Legal Compliance: Comply with GDPR and other data protection laws
• AI Features: Provide risk assessment and text assistance (all processing is confidential and not used for training)
• Security: Detect fraud, prevent abuse, and protect our systems

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

To create an account you must give us your email address, company name and country. We need them to enter into and perform our contract with you, and without them we cannot provide the service. Other fields, such as VAT number and company website, are optional. Contact-form details are optional, but without them we cannot reply to you. No law requires you to give us personal data.

You may withdraw consent at any time for consent-based processing. For legitimate interests, you have the right to object (see Section 8).

Your right to object to direct marketing. You can object at any time, free of charge, to our use of your personal data for direct marketing. Use the unsubscribe link in any of our emails or write to dpo@sarportal.com. When you object, we stop straight away and keep only your email address on a suppression list so that we do not contact you again.

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only with:

5.1 Service Providers

• Microsoft Azure Entra External ID: Authentication and identity management
• Azure Cosmos DB: Database storage (AES-256 encryption at rest, West Europe, Netherlands)
• Azure Blob Storage: Document storage (AES-256 encryption at rest, West Europe, Netherlands, with a second copy of documents in North Europe, Ireland)
• Azure OpenAI Service: AI-powered features including personal data detection, risk assessment and text assistance (your data is not used for model training; Azure Sweden Central)
• Azure AI Document Intelligence: Text extraction from documents and scanned pages for redaction analysis (Azure Sweden Central)
• Azure AI Language Service: PII detection and entity recognition (Azure Sweden Central)
• Stripe (Stripe Payments Europe, Ireland): Billing and payments. Stripe may process billing data in the US under the EU-US Data Privacy Framework and SCCs. We never see or store full card numbers.
• Twilio SendGrid: Transactional email delivery, sent from SendGrid’s EU regional account (data stored and processed in the EU; Twilio support access from outside the EEA is possible under SCCs)
• Google reCAPTCHA Enterprise: Bot protection and spam prevention
• Microsoft Graph API: User invitation and management (your users’ names and emails)
• HubSpot: Business customer relationship management, hosted in HubSpot’s EU data region (Frankfurt). Used for our own sales, marketing and customer relationship management. If you contact us through this website or request a demo, your name, business contact details and message are recorded there. We may email business contacts recorded there about our own, similar services, as described in Section 4, and you can unsubscribe at any time. No case data, uploaded documents or data subject records are ever stored in HubSpot — it is entirely separate from the SAR Portal platform.
• Google (Google Ireland Ltd / Google LLC): Google Analytics, Google Ads conversion tracking and the YouTube video player on our website, only if you accept the matching cookies in the cookie banner. No case data or documents.
• FastComet: Hosting of this website and of our @sarportal.com email (servers in Germany). It processes website server logs (IP address, browser type) and the emails you send us, including contact and demo enquiries.
• Font and script providers: When you use the application, your browser loads fonts, icons and a script library from Google Fonts (Google), Font Awesome (Fonticons, Inc., United States) and the jsDelivr CDN, and Stripe.js from Stripe. They receive your IP address and browser details (user agent), but no case data or documents. Google, Stripe and Fonticons (Font Awesome) are certified under the EU-US Data Privacy Framework. jsDelivr is run by Volentio JSD Limited (United Kingdom), covered by the EU adequacy decision for the United Kingdom; the content delivery providers it uses (Cloudflare, Fastly, Bunny and GCore), including in the United States, receive your IP address, browser details and the referring domain, and jsDelivr does not name its safeguards for those onward transfers.

5.2 Legal Requirements

We may disclose data when required by law, court order, or to protect our legal rights.

6. International Data Transfers

Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. Case content stays in the EEA. A few supporting services may process limited account, billing or technical data outside the EEA under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using our website forms and application pages, including request forms), Stripe (billing) and, only if you accept the matching cookies on our website, Google Analytics, Google Ads conversion tracking and the YouTube video player (Google may process this website usage data in the United States under the EU-US Data Privacy Framework). When you use the application, your browser also loads fonts and icons from Google Fonts and Font Awesome (Fonticons, Inc., United States), a script library from the jsDelivr CDN and Stripe.js from Stripe; these servers receive your IP address and browser details (user agent). Google, Stripe and Fonticons (Font Awesome) are certified under the EU-US Data Privacy Framework; jsDelivr is run by a UK company (Volentio JSD Limited), covered by the EU adequacy decision for the United Kingdom; its content delivery providers include servers in the United States, and jsDelivr does not name its safeguards for those onward transfers. None of them receive case content or documents. Microsoft Entra External ID keeps directory data in the EU, and Twilio SendGrid email is sent from its EU regional account; their terms allow limited transfers outside the EEA, for example security and fraud signals or vendor support in exceptional cases, under the Microsoft and Twilio data protection terms (SCCs).

6.1 Third Country Transfers

Any transfers outside the EU/EEA are protected by:

• Standard Contractual Clauses (SCCs): European Commission’s 2021 SCCs for third country transfers
• Named EU regions: our Azure services run in West Europe (Netherlands) and North Europe (Ireland), and our AI runs in Azure Sweden Central on regional deployments
• Adequacy Decisions: Transfers to countries with EU adequacy decisions (e.g., UK, Switzerland) rely on those decisions

6.2 UK Data Transfers

For services with UK-based processing, transfers are protected by the UK adequacy decision, renewed by the European Commission in December 2025. Case data and documents are stored, and AI processing runs, in the Azure regions listed above.

6.3 Service Provider Locations and Transfers

7. Data Retention

• Active Accounts: Data retained while subscription is active
• Account Deletion: You can delete your user account at any time in the app. If the last admin deletes the account, all of the organisation’s cases, documents and users are deleted within minutes. Deleted files then remain in our cloud provider’s soft-delete copies for up to 14 days, and database backups for up to 7 days, where no one can read them through the product, and are then gone for good.
• Unused Sign-ups: If a self-service account is never signed in to, we send reminders and delete it 16 days after registration.
• Cancelled Accounts (including trials that end without a subscription, and subscriptions cancelled after 30 days of non-payment): Data available for export for 90 days. After 90 days, all tenant data (cases, documents, users, settings) is deleted from SAR Portal. Deleted files then remain in our cloud provider’s soft-delete copies for up to 14 more days, and database backups for up to 7 days, where no one can read them through the product, and are then gone for good. You will receive a reminder email 10 days before deletion. Stripe keeps its own billing record of the cancelled subscription for legal reasons.
• Audit Logs: Each entry is set to expire at the end of the organisation’s audit-log retention period (7 years by default; on request we can set a period of 3 to 10 years for the organisation, which applies to entries written after the change), counted from when the entry was last written; pseudonymising an entry restarts the period. The data subject’s personal details are removed when the related case is anonymised. We keep audit logs on the basis of our legitimate interests (Article 6(1)(f) GDPR): keeping records of our own service delivery and security, and establishing, exercising or defending legal claims within the applicable limitation period (6 years for contract and tort claims under the Statute of Limitations 1957, plus time to issue and serve proceedings). Entries under a legal hold are kept while the hold applies and for the full retention period after it is released. When a customer’s service ends, we keep a pseudonymised record of activity (which account did what, and when): email addresses, IP addresses and user-agent strings are removed, but some entries can still contain names, for example a changed contact name or a user’s display name. We keep it as an independent controller, on the basis of our legitimate interests (Article 6(1)(f) GDPR), only to keep records of our own service delivery and security and to establish, exercise or defend legal claims about the service, as our customers authorise in our Data Processing Agreement.
• Application Logs: Kept for 90 days. The application’s web server logs, which include IP addresses, are kept for 3 days.
• Billing Records: Irish tax law requires us to keep them for at least 6 years; we keep them for 7 years from the transaction date
• Contact Form Inquiries and Demo Requests: Kept for up to 24 months after our last contact with you, then deleted, unless you become a customer. If you become a customer, we keep them with your account records while you are a customer and for up to 6 years after the contract ends, so we can deal with any legal claims (the limitation period for contract claims under Irish law). You can ask us to delete them sooner at any time: dpo@sarportal.com
• Marketing Data: When you unsubscribe or object to direct marketing we stop marketing to you straight away and keep only your email address on a suppression list so we do not contact you again.

8. Your Rights Under GDPR

As an EU data subject, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in machine-readable format
• Right to Object: Object to processing based on legitimate interests; and object at any time, without giving a reason, to direct marketing, which we will then stop
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: Complain to your local Data Protection Authority

Your right to object (Article 21). Where we rely on legitimate interests, you can object at any time on grounds relating to your situation. We will stop unless we have compelling legitimate grounds, or need the data to establish, exercise or defend legal claims. If you object to direct marketing, we always stop. Write to dpo@sarportal.com.

To exercise your rights, contact: dpo@sarportal.com (or privacy@sarportal.com)

9. Security Measures

We implement technical and organisational security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Sign-in via Azure Entra External ID: your organisation’s Microsoft 365 account, a Google account or a one-time code sent to your email; SAR Portal stores no passwords. SAR Portal does not add or enforce a multi-factor step of its own: Google sign-ins follow the multi-factor settings of your Google account, for Microsoft 365 it depends on your organisation’s tenant, and a one-time email code is a single factor. We recommend multi-factor authentication on these accounts and mailboxes
• Role-based access control (RBAC) with four defined roles
• Secrets management via Azure Key Vault
• Security headers (CSP, HSTS, and others)
• Rate limiting on public API endpoints, such as registration, the contact form, public downloads and verification
• Every change is built and tested automatically and is deployed to Dev and UAT before a manually approved Production release; our procedure requires a check for vulnerable packages at every release and at least monthly
• Our coding rules require personal data (emails, phone numbers, names, financial data) to be masked before it is written to our application logs; this is a rule our code follows, not an automatic filter

For full details of our security controls, see our Security page.

10. AI and Automated Decision-Making

SAR Portal uses AI for:

• Risk Scoring: Automated case risk assessment
• Text Assistance: Suggestions for text improvement
• Contextual Workflow Guidance: System-specific next-step recommendations based on your configured business systems (e.g., “Search Zendesk for this email”)
• Text Extraction: Automated text extraction from PDFs, scanned pages and images using Azure Document Intelligence
• Configurable PII Detection: Automated detection of personal data in documents based on your tenant-specific configuration (standard PII types, custom patterns, keyword lists) to assist with GDPR Article 15(4) compliance

10.1 Systems Configuration Data

You can configure which business systems your organization uses (e.g., CRM, email platforms, support systems). This configuration data is used solely to provide system-specific AI guidance tailored to your environment. This data includes:

• System types and names (e.g., “Salesforce CRM”, “Zendesk Support”)
• Optional system notes and data types stored
• Business context description

This configuration data is stored securely in your tenant’s isolated database partition and is never shared with other tenants or used for any purpose other than generating contextual guidance for your organization.

10.2 PII Detection Configuration

You can customize PII detection settings including which data types to detect (names, emails, IBAN, etc.), custom regex patterns for business-specific identifiers, and keyword allow/deny lists. These settings control how AI analyzes documents but do not affect the underlying AI models.

Important: All AI-generated outputs are advisory only. AI suggests what to redact. In the upload flow you review the suggestions and choose what to redact before anything is applied. AI can miss personal data or redact too much, so always check the result before you release it. Detected items start selected, including the requester’s own details: use “Deselect Subject Data” to keep the requester’s own information in their copy. In bulk archive processing (Enterprise), suggested redactions are applied automatically and you review the results. Nothing reaches a data subject unless one of your users releases it. No solely automated decision with legal effect is made.

Data Processing: When you upload files, Azure Document Intelligence extracts the text (including scanned pages), and Azure AI Language and Azure OpenAI find personal data in it. All three run in Microsoft’s Sweden Central region, under Microsoft’s Data Processing Agreement. Your files are not used to train any AI model. Document Intelligence deletes the document and results automatically 24 hours after analysis, and Azure AI Language does not store the text. Microsoft’s abuse monitoring for Azure OpenAI may store prompts and responses that its systems flag, in the EU, for review by authorised Microsoft staff in the EEA.

11. Cookies and Tracking

We use cookies and similar technologies to operate our service. For full details, see our Cookie Policy.

11.1 Types of Cookies

11.2 Cookie Consent

When you first visit our website, you will see a cookie consent banner. You can:

• Accept All: Enable analytics and advertising cookies
• Essential Only: Only strictly necessary cookies (no analytics, no advertising)
• Manage Preferences: Turn analytics and advertising on or off separately

You can change your cookie preferences at any time via the cookie settings link in the footer.

11.3 Google Analytics

We use Google Analytics 4 to understand how visitors use our website. Google Analytics collects:

• Pages visited and time spent
• Device and browser information
• Geographic region (country/city level)
• Referral sources

Google Analytics uses cookies that expire after 2 years. Data is processed in accordance with Google’s privacy policy. Google states that Google Analytics 4 does not log or store IP addresses. You can opt out using the Google Analytics Opt-out Browser Add-on.

11.4 Google Ads

If you switch on advertising cookies, we use Google Ads conversion tracking to see whether a visit from one of our ads led to a demo request or a free-trial sign-up. If you leave advertising cookies off, the Google Ads tag does not load. See our Cookie Policy for the cookies it sets.

12. Children’s Privacy

SAR Portal is not intended for individuals under 16 years of age. We do not knowingly collect data from children.

13. Changes to This Privacy Policy

We may update this policy from time to time. We will notify you of material changes by email at least 30 days before they take effect.

14. Contact Us

For privacy-related questions or to exercise your rights:

• Email: dpo@sarportal.com
• Alternative: privacy@sarportal.com

15. Supervisory Authority

You have the right to lodge a complaint with your local EU Data Protection Authority. A list of EU supervisory authorities is available at edpb.europa.eu.