Privacy policy

Last updated 4 October 2026

This policy explains what personal data ABDM (“we”, “us”) collects when you visit abdm.uk or use our private tools, why, and what your rights are. We are the controller of that data.

What we collect

abdm.uk has no accounts, sign-up forms, advertising or analytics, and it sets no cookies.

• Server logs. When you visit, our web server automatically records your IP address, the date and time, the page you asked for, whether it was delivered, the page that linked you here (if your browser sends it) and your browser’s user agent (its name and version).
• Google sign-in. Our private tools are only for people we invite, who sign in with their Google account. Google tells us your name, your email address and whether Google has verified it. We ask for nothing else from your Google account, and we cannot see your password. The tools set a cookie that keeps you signed in.
• What you submit. Files and text you submit to our tools, and the results we make from them.

Why we use it

• We use server logs to keep our services secure and working: to spot abuse and attacks and to fix errors. Our lawful basis is our legitimate interest in running secure services.
• We use your Google name and email address only to check that you have been invited, to keep you signed in and to show you your own work. We use what you submit only to provide the service you asked for. Our lawful basis is providing that service.

We do not sell your data, use it for advertising, or make automated decisions about you. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it

• Server logs are deleted automatically after 14 days.
• Your name and email address are kept while you have access to our tools, and deleted when you ask us to remove them or we remove your access. Sign-ins expire after at most 30 days.
• What you submit, and the results, are deleted when you delete them in the tool, or when we no longer need them to provide the service.

Who else handles it

• Our hosting provider, in the European Economic Area, runs the servers for our website and tools on our behalf.
• Google provides the sign-in to our tools.
• Service providers that help process what you submit to our tools, some of them in the USA. They do not receive your name or email address.

Where data is handled outside the UK, we rely on the protections UK law requires. These include UK adequacy regulations (which cover the European Economic Area), the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses.

We may also disclose data if the law requires it, or to protect our rights or the safety of others.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• restrict how we use it;
• transfer it to you or to someone else, where that applies.

You can also object to how we use it. Contact us to make a request. We will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113. We would appreciate the chance to sort it out first, so please contact us.

Children

Our website and tools are not aimed at children. Apart from the server logs every visit creates, we do not knowingly collect personal data from children.

Changes

We may update this policy. The date at the top shows when it last changed.