Privacy policy.

LtdRecord (“we”, “us”) provides software that turns descriptions of UK limited-company actions into draft record packs. LtdRecord is a brand of 9S Labs Limited, a company registered in England and Wales (company number 17296207), which operates the service. 9S Labs Limited is the data controller for the personal data described in this policy, and is registered with the Information Commissioner’s Office as a data protection fee payer (registration ZC188999). For anything in this policy, contact info@9s-labs.com.

• Account data — your email address (used for sign-in codes) and the name you give us.
• Company details you enter — company name and number, registered office, director and shareholder names, your accountant’s email if you save it.
• Record content — the descriptions you type, letters you paste for decoding, the facts you confirm, and the record packs generated from them.
• Evidence files — receipts, invoices, and statements you choose to upload against a record.
• Service data — how many record packs you create (for plan limits), sign-in events, and technical logs needed to keep the service running and secure.

• To provide the service: classify your description, generate the documents, store your records and evidence, and deliver PDFs by download or email.
• AI classification — the action description you type (and the company context needed to classify it) is sent to OpenAI to work out which record applies. Your content is never used to train AI models — ours or OpenAI’s — and is processed under OpenAI’s API terms, not its consumer products.
• Service improvement — we keep a log of the descriptions you type (and letters you paste) together with how they were classified, and may review it — including any corrections you made — to improve our own prompts and rules. Before any of it is exported for that review, personal identifiers (names, email addresses, phone and account numbers, postcodes) are redacted. This is human review inside the service; it does not train any AI model on your content.
• To send sign-in codes and, when you ask, to email a record to you or your accountant.

We use a small number of infrastructure providers, each bound by their own data processing terms:

• Neon (managed Postgres database — your account, company, and record data)
• Cloudflare R2 (file storage — signed PDFs and uploaded evidence, encrypted with a key unique to your company)
• OpenAI (classification of the action descriptions you type)
• Resend (transactional email — sign-in codes and records you send)
• Stripe (payments, when subscriptions launch — card details never touch our servers)

Some of these providers process data outside the UK — in particular OpenAI, in the United States. Those transfers take place under each provider’s data-processing agreement, using safeguards approved for UK GDPR (such as the UK International Data Transfer Addendum).

We use one essential cookie: your sign-in session. There are no advertising or cross-site tracking cookies.

Your records and files are kept while your account is active — that is the point of a record-keeping product. If you ask us to delete your account, we delete your account data, records, and uploaded files within 30 days, except where we must keep minimal records to meet our own legal obligations. Deleting your account also destroys the per-company keys that encrypt your stored files, so any stray copy becomes unreadable.

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, and you can object to or restrict processing. Email info@9s-labs.com and we will respond within one month. You can also complain to the ICO (ico.org.uk).