Privacy Policy: Change History

The current version is the Privacy Policy. These are the changes made before the latest update.

What changed on 4 November 2026

• Sections 5.1 and 6: the Twilio SendGrid entries now say that email is sent from an EU regional account, with data stored and processed in the EU. We now give the transfer basis for Font Awesome and jsDelivr, which the application loads in your browser, instead of saying that it is under review.
• Section 4: we gave a separate legal basis for invited users’ accounts and for contact-form enquiries.
• Section 6: we made clear that Google reCAPTCHA also checks the forms on our website.
• Section 7: we added the retention periods for application logs and web server logs.
• Section 8: we set out your right to object (Article 21) separately.

What changed on 2 November 2026

• Sections 5.1 and 6: case content stays in the EEA; we named the services that may process limited account, billing or technical data outside it, and the safeguards used.
• Sections 7 and 9: we corrected how sign-in works (Google account or a one-time email code; SAR Portal adds no multi-factor step of its own), described audit-log retention (7 years by default; on request 3 to 10 years for your organisation) and when deleted documents are erased.

What changed on 30 October 2026

• Section 1: we added our company registration number (CRO No. 579894).
• Section 4: we explained that we process case data for our customers as their processor under our Data Processing Agreement, and that product and service update emails to business contacts rely on our legitimate interests, with your right to object at any time.
• Sections 5 to 7: we listed the services and browser-loaded resources we use, where they process data and the transfer safeguards, and added retention periods for security logs, unused accounts and billing records.
• Section 11: we described the embedded video on our website, which loads only after you accept the matching cookies.