Privacy notice

This notice covers graphatlas.com. It says what we record when you read the site and when you write to us through it. It is short on purpose.

GraphAtlas Ltd decides what is recorded and why, which makes us the controller under the UK GDPR. We are registered in England and Wales, and our registered office is Level 39, One Canada Square, Canary Wharf, London E14 5AB, United Kingdom. The person who answers questions about this notice is reachable at contact@graphatlas.com, with Privacy in the subject.

What we record when you read the site

Nothing that identifies you.

• The site sets no cookies, and it keeps nothing else in your browser either. It has no setting to remember, so local storage and session storage stay empty, including after you have used search.
• It runs no analytics, no advertising and no tracking, and it loads nothing from another company’s servers. The fonts, images, scripts and styles all come from graphatlas.com.
• Search runs in your browser. The first time you open it, or reach for its button with a pointer or the keyboard, your browser fetches one small file that lists the pages of the site, and finds your matches in that file. What you type is never sent to us.
• Our host, Cloudflare, Inc., handles your network address while it serves a page, as every host does. What it keeps is governed by its own terms. We add nothing to it, and we do not receive your address from it.

What we record when you write to us

The contact form asks for your name, work email, organisation and a message. It also takes your role, the regimes you care about and the date you need an answer by, if you want to say. We store exactly what you typed so that the right person can reply.

We also store a one-way hash of your network address, mixed with a secret that only the server knows. We never store the address. The hash lets us notice one source sending many messages, and it cannot be turned back into an address.

The form has one field that a person never sees. Programs that fill in every field fill that one too. We discard those messages without storing them.

To keep the form from being flooded, the server counts how many messages each hash has sent in each hour by the clock, and allows five in one. Those counts are deleted after a day.

What we record when you check a receipt

The receipt check at graphatlas.com/api/verify is run by our server. It reads what you send, works out the receipt and answers. It does not store what you send, and it does not log it.

To keep the check from being flooded, the server counts the checks that come from each hash of a network address, made in the same way as the one for the contact form, and allows sixty in each minute by the clock. Those counts are deleted after a day.

Why, and on what basis

We use what you send to answer you. The basis is our legitimate interest in replying to people who write to us, and, where you are asking about a briefing or a trial, the steps you ask us to take before a contract.

We use the hash and the counts to protect the form and the receipt check from abuse, which is also a legitimate interest. We do not use any of it for marketing. We will not add you to a mailing list because you wrote to us.

How long we keep it

We mark a message as spam when it is not from a person who wants an answer, such as an advertisement. A job that runs once a day does the deleting. It counts from the date that the database puts on a message when we mark it, and the only thing it writes to a log is how many messages and counts it deleted.

Who sees it

The people at GraphAtlas who answer messages, and Cloudflare, which hosts the site and its database on our behalf and may process data in countries outside the United Kingdom. Cloudflare does this under standard contractual clauses and the UK addendum to them. We do not sell data, and we do not give it to anyone else unless the law requires us to.

Your rights

You can ask us to show you what we hold about you, to correct it, to delete it, to limit how we use it, or to give it to you in a form you can reuse. You can also object to our using it. Write to contact@graphatlas.com with Privacy in the subject, and give the reference shown when your message was sent, which looks like GA-1A2B3C4D, or the email address you used. We reply within one month.

If you think we have handled your data badly and we have not put it right, you can complain to the Information Commissioner’s Office at ico.org.uk.

Children

The site is written for people who work in risk, actuarial, validation, security and compliance teams. It is not aimed at children, and we do not knowingly collect their data.

Changes to this notice

The date at the top is the date of the latest change. When we change what we record, we will say what changed here, and the old text stays in our repository.

• 13 November 2026. Our registered office is now Level 39, One Canada Square, Canary Wharf, London E14 5AB, United Kingdom. What we record is as it was.
• 10 November 2026. The notice now gives our registered office, and says that every request it describes goes to one address, contact@graphatlas.com, with Privacy in the subject, and not to an address of its own. What we record is as it was.
• 4 November 2026. The site was redesigned. The notice now says that it keeps nothing in your browser, which a script checks on every page and after search has been used, as it checks that nothing is requested from another address and that no cookie is set. What the site records is as it was.
• 1 November 2026. The notice now says that reaching for the search button starts the fetch of the list of pages, as opening search does, and that the counts that limit sending are made in each hour or minute by the clock, which is how the server has always made them. The site records nothing more than it did.
• 29 October 2026. First version.