Privacy
Privacy policy.
Updated 16 October 2026
How Sensolytica Ltd uses personal data on this website, and on the Sensolytica portal and platform.
Who we are
Sensolytica Ltd ("Sensolytica", "we") runs the website sensolytica.com and the Sensolytica portal and platform. Company number: to be confirmed. Registered address: to be confirmed.
For the website, and for the people who use the portal, we are the controller of your personal data. For the readings our customers' units collect, the customer organisation is the controller and we are its processor. The platform part of this policy explains the difference.
Write to [email protected] about anything in this policy.
What this policy covers
Two things: this website, and the Sensolytica portal and platform that organisations use to keep their record. The portal is a separate service with its own terms, which an organisation agrees to when it subscribes.
Contact enquiries
When you send the contact form we collect your name, work email, organisation, sector and message, the page you sent it from, that you agreed to us storing it, and when it arrived. To stop spam we also keep a salted hash of your IP address and of your browser's user agent; we never store the IP address itself.
We use the enquiry to reply to you and to follow it up. Our lawful basis is legitimate interests: answering a business enquiry you chose to send us.
The enquiry is stored by Sensolytica in our own platform database (hosted by Supabase), emailed to our support inbox, and a short confirmation is emailed to you (both sent through Resend). Only Sensolytica staff can read it. We keep it for 24 months and then delete it.
Analytics
If you accept analytics cookies, we use Google Analytics 4, loaded through our Google Tag Manager container (GTM-MDP932NR), to see how the site is used: which pages are read, how people arrive, the type of device and browser, and an approximate location. We use it to improve the site, not to advertise.
Our lawful basis is your consent. Until you accept, Google Tag Manager and Google Analytics are not loaded at all, and every Google consent setting stays at denied. Advertising storage, ad user data and ad personalisation stay denied even if you accept.
Google Analytics data is kept for 14 months, then deleted by Google.
Server and hosting logs
The website and its tutorial films are served by DigitalOcean (App Platform, and Spaces with its content delivery network). Like any web host, it records requests, including the IP address, the time, the page and the browser, to deliver the site and keep it secure.
Our lawful basis is legitimate interests: running a secure website. These logs are kept for the period the host sets, and are not used to identify visitors.
Changing your cookie choice
Choose Cookie settings at the foot of any page to accept or reject analytics again, at any time. If you reject after accepting, we stop Google Analytics and remove its cookies from this site. You can also clear or block cookies in your browser.
The portal and platform: who is responsible
Organisations such as harbour authorities, councils, clubs and fleets use the Sensolytica platform to keep one record of the vessels and vehicles that move through the places they look after.
- For the data their units, members' phones and imports collect, the customer organisation is the controller. Sensolytica Ltd is its processor, and processes that data only on the organisation's instructions, under a data processing agreement.
- For portal accounts, for our own staff and support work, for security logs and for billing, Sensolytica Ltd is the controller.
What the platform processes
Depending on what an organisation uses:
- Shore node captures: images and short sequences of frames of vessels and vehicles that pass, which can include registration marks and, incidentally, people; the radar speed; the time and place.
- Drive unit telemetry from electric outboards: speed, position, power, temperatures and faults, sealed at source.
- Members' phone trips: only under the organisation's tracking rules and the person's own consent, and for anyone under 18, with a parent or guardian's consent as well.
- Imported logs: readings an organisation uploads from another system, kept with the original file.
- Entity records and matching: the one record of each vessel or vehicle, and how each reading was joined to it, with a confidence.
- Reviews, decisions and evidence packs, each made by a named person.
- AIS: the public position feed for vessels, where an organisation uses it.
- Account data: name, work email, role, organisation memberships, whether two-factor sign-in is set up, and sign-in and audit logs of what each person did.
- Support requests and our replies.
- Billing details for the organisation. Card details go to Stripe and never pass through us.
How platform data is protected
- Readings are sealed with a SHA-256 hash and chained, so any change shows; every decision and export is in an audit trail with the person's name.
- Each organisation sees only its own data and what others have agreed to share with it. This is enforced in the database itself.
- Sensolytica staff enter an organisation only with a recorded reason, read only or able to act, and the visit appears in that organisation's audit trail.
- Evidence images are kept in private storage and shown only through short-lived signed links.
- Two-factor sign-in is available to every account, and organisations can ask their members to use it.
How long platform data is kept
The customer organisation sets how long its record is kept, and the platform deletes what is older every night.
- Captures and unit readings: the organisation's retention period, 24 months unless it chooses another. A sealed placeholder stays where the chain needs one, without the personal data.
- Passes within the limit: an organisation can choose to remove their frames and identity after a set number of days, for example 30.
- Phone trips: the period in the organisation's tracking rules, or its retention period where the rules set none.
- Portal accounts: while the organisation's subscription runs, and 12 months after.
- The audit trail of decisions: 7 years, so a decision can still be explained.
- Website enquiries: 24 months.
Requests about platform data
If you think a unit or a phone recorded you, or you want a copy of a record about you, ask the organisation that runs it: it is the controller and decides. We help it answer.
Before any unit goes live, the customer organisation completes a data protection impact assessment. We give them a template in the portal.
Who processes data for us
We use these providers, each under a written agreement that limits them to our instructions:
- Google (Analytics and Tag Manager): website analytics, only with your consent.
- DigitalOcean: hosting for the website, the portal and the tutorial films (App Platform and Spaces).
- Supabase: the platform database, sign-in and functions, where website enquiries are also stored, hosted in the EU (Ireland).
- DigitalOcean Spaces (London): private storage for evidence images, and public storage for the tutorial films.
- Resend: email, for enquiries, confirmations, sign-in links and alerts.
- Stripe: billing for customer organisations.
- Anthropic (Claude): a second opinion on hard cases the measurements cannot settle on their own, where it is switched on. A named person still makes every decision.
- what3words: turning a unit's position into a three-word address, where it is switched on.
International transfers
Some of these providers, or their support teams, are outside the UK, mainly in the European Economic Area and the United States. Where personal data leaves the UK, we rely on UK adequacy regulations (for the European Economic Area, and for US companies certified under the UK extension to the EU-US Data Privacy Framework), or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us for details of the safeguard for any provider.
How long we keep website data
- Contact enquiries: 24 months, then deleted.
- Google Analytics: 14 months, only if you accepted.
- Server and hosting logs: for the period our host sets.
- Your cookie choice: 6 months, then we ask again.
Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict how we use it, or give it to you in a portable form. You can object to processing based on legitimate interests, and withdraw your consent to analytics at any time; that does not affect what happened before.
To use these rights, write to [email protected]. We may ask you to confirm who you are, and we reply within one month. For data a customer organisation controls, we pass your request to it and help it answer.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first.
Changes to this policy
When this policy changes we update the date at the top. If a change affects how we use data you have already given us, we will tell you before it applies.
Contact
[email protected], or by post to Sensolytica Ltd at our registered address, to be confirmed.