Who is responsible
Controller identity
BLACK LONDON LTD, trading as RAMSCloud, is the controller for the personal information we use to operate our business. Company number: 16534792. Registered office: 23 Ashdene Road, Bicester, England, OX26 2BH.
Privacy contact
Controller and processor roles
We are controller for account administration, billing, security, service communications and our own support and service-improvement activities. We act as processor for personal information in customer workspace content handled on the customer’s instructions. Our Data Processing Agreement covers that processing. Customers are responsible for the lawful basis and notices for people included in their content.
Children
RAMSCloud is a business service and is not intended for children.
Data and lawful use
Personal data collected
We process account and sign-in details, organisation membership, billing and subscription records, support and chat communications, and technical and usage information. Customer content can include company and project details, site addresses, named workers and contacts, safety documents, training evidence and uploaded files. Stripe handles payment-card entry. AI inputs are described below. Our custom analytics events exclude document text, raw searches, names, emails and account, organisation and document identifiers.
Where data comes from
Information comes from you, your employer or other authorised customer users, your browser or device, and providers supporting sign-in, payments and service delivery. Google provides the identity details authorised when you choose Google sign-in.
Purposes and lawful bases
We use information to provide accounts and requested services, administer purchases, answer support requests, communicate service matters, prevent misuse and improve reliability. We rely on contract where necessary for an individual customer’s service, legitimate interests for business-account administration, support, security and proportionate service improvement, and legal obligations for required records. Our interests are balanced against individuals’ rights through limited data collection, restricted access and proportionate retention. Where consent is required, the relevant processing must wait for it. The Cookies and browser storage notice explains measurement technologies and choices. Customers determine the lawful basis for their own workspace content.
Required or optional information
Required account information is needed to create and secure an account, and billing information is needed for paid services. Without it we may be unable to provide the requested service. Optional attachments, workspace details and AI requests should contain only information needed for the task.
Automated decisions and AI
OpenAI provides AI assistance. AI help receives your submitted question and product guidance. Drafting and editing tools receive the work description, selected wording or relevant current-document context needed for the request. Support reply assistance can send support messages, internal notes and selected PDF or image attachments; drafting may start when staff open an unanswered support message. Staff review drafts before sending replies. Direct chat is separate and is not automatically read by this support-AI integration. Relevant requests include a pseudonymous safety identifier. Provider retention and processing arrangements are described in the Subprocessors schedule; we do not promise zero retention. Accepted output and original messages may remain in normal service records. Review AI output before use. These tools do not make solely automated decisions about people with legal or similarly significant effects.
Sharing, location and retention
Recipients and service providers
We use Supabase for authentication, database and storage; Vercel for hosting and service measurement; OpenAI for AI assistance; Resend for transactional email; and Stripe for payments and subscriptions. Google processes information when you choose its sign-in service. Provider roles depend on the activity and contract; the Subprocessors schedule covers instructed customer-data processing. Authorised staff, professional advisers and authorities may receive information where necessary and lawful. You control onward sharing of documents you download.
International transfers
Providers or their authorised personnel may process or access information outside the UK. The Subprocessors schedule identifies the relevant destinations and transfer safeguards for instructed customer-data processing. We use applicable adequacy arrangements or appropriate contractual safeguards for restricted transfers. Contact support@ramscloud.co.uk for details or copies of relevant safeguards.
Retention periods
Account and workspace information is retained to provide the service. Cancelling a subscription or archiving a document does not automatically delete it. Workspace deletion removes private workspace content while retaining the account, billing, usage and communication records. Full account deletion removes additional account and communication data. Records required for legal, accounting or security purposes may be retained where necessary. Provider backups and logs are subject to their applicable retention arrangements. Deleting cloud data does not remove downloaded files or copies stored in your browser.
Security summary
Workspace information is protected through authenticated access, organization scoping, database row-level security and operational safeguards.
Rights and changes
Individual rights
Subject to applicable conditions, you may request access, correction, erasure, restriction or portability and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. Contact support@ramscloud.co.uk. We may verify your identity or authority and will respond within the applicable legal deadline. The in-app document export is not a complete personal-data response; requests are available regardless of subscription status. For information controlled by your employer or another customer, we will assist or route the request according to our role. Legal retention and other lawful exemptions may limit a right.
Complaints
For privacy concerns, contact support@ramscloud.co.uk. You also have the right to complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/.
Changes to this notice
We update this notice when processing changes and notify affected people of material changes or new uses before they begin where required.
Effective date
25 October 2026