Privacy notice
Draft – business details in square brackets are still to be confirmed.
Last updated: 6 November 2026
This notice explains how [Legal entity name, e.g. Scrutti Ltd], trading as Scrutti ("Scrutti", "we", "us"), uses personal data when you visit our website, contact us, ask for a demo or use the Scrutti app. It also explains your rights and how to complain.
Scrutti is a compliance file-checking service for UK financial advice firms. Advice firms upload their own case files to Scrutti. For that client data, the advice firm is the controller and Scrutti acts as its processor – see section 3.
1. Who we are
- Controller: [Legal entity name, e.g. Scrutti Ltd], company number [Company number], registered office [Registered office address].
- ICO registration number: [ICO registration number].
- Contact for privacy questions and requests: [privacy@your-domain], or write to [Postal address for data protection requests].
- We are not required to appoint a Data Protection Officer. Our founder is responsible for data protection.
2. The personal data we use, why, and our lawful basis
| Who | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Website visitors | Technical data needed to deliver the site (IP address, browser type, pages requested) held briefly in hosting logs; the storage described in our cookie policy. | To run and secure the website. | Legitimate interests – operating a secure website. |
| People who contact us or book a demo | Name, work email, phone number, firm name, role, message and the date of the demo. | To reply, arrange and hold the demo, and follow up about Scrutti. | Legitimate interests – responding to business enquiries and promoting our service to firms. You can opt out at any time. |
| Users of the Scrutti app (firm owners, compliance staff, advisers and other staff) | Name, work email, role, firm, sign-in and two-factor details, activity and audit log entries, acceptance of the user agreement, and (for billing contacts) billing details. | To provide accounts, keep the service secure, keep an audit trail, provide support and bill the firm. | Contract with the firm; legitimate interests (security, audit trail, support); legal obligation (accounting records). |
| Advisers whose files are checked | Check results, grades, findings, remedial actions, development goals, coaching notes and supervision level. | We process this on behalf of the adviser's firm, which decides how it is used – see section 3. | The firm's lawful basis (we are its processor). |
We don't sell personal data, and we don't use it for advertising.
3. Client data in advice files – Scrutti as a processor
When an advice firm uploads a case file, call recording, transcript or meeting notes, the firm is the controller of the personal data in it, including any special category data such as health information. Scrutti processes that data only on the firm's instructions, under our data processing agreement, to check the file against the rulebook and show the results to the firm.
- We use client data only to run the firm's checks. We never use it to train AI models and never use it for our own purposes.
- We do use anonymised, aggregated statistics about how the service is used – for example how many checks are run, typical grades, how often reviewers agree with the checker, and common themes by advice area. These statistics are not personal data: they never identify a client, an adviser or a firm, and we only publish figures drawn from at least three firms. We use them to improve the accuracy of our checks and rulebooks and to publish industry insights.
- If a firm uploads a call recording without a transcript, we have it transcribed by our transcription provider so it can be checked. The recording is deleted from the provider as soon as the transcript is returned.
- Each firm's data is kept separate from every other firm's. Advisers can only see their own cases.
- Scrutti staff do not have routine access to client data.
- To keep as little client data as possible, uploaded case files are deleted within 2 days of the check being signed off, or 10 days after upload at the latest. Scrutti is not a record-keeping system – the firm keeps its own records.
- The file review sheet for each case (grades, findings and review notes), MI and reports are kept after the files are deleted. Findings can include short extracts from the documents or call (for example, a health disclosure) where they are the evidence for a finding, so some client personal data stays in the check record for as long as the firm subscribes.
If you are a client of an advice firm and have questions about how your information is used, please contact that firm. If you contact us, we will pass your request to the firm.
4. Suggested grades and human decisions
Scrutti uses an AI model to read case documents and suggest findings, a file grade and an advice verdict for an adviser's file. These are suggestions to the firm. A named person at the firm reviews the result and decides the final grade and any action. Scrutti does not make decisions based solely on automated processing that have legal or similarly significant effects on anyone.
5. Who we share personal data with
We use a small number of trusted providers to run Scrutti. Each acts on our instructions under a written contract.
| Provider | What they do | Where |
|---|---|---|
| Anthropic, PBC | AI model that reads the case documents and applies the rulebook to produce the suggested findings, grade and verdict. | United States |
| Speechmatics (Cantab Research Ltd) [confirm legal entity] | Transcribes call recordings uploaded for a check, using its Enhanced model with speaker labels, when the firm hasn't uploaded its own transcript. | European Union (Speechmatics EU region). UK-based company. |
| Supabase, Inc. | Database, file storage and sign-in for the Scrutti app. | European Economic Area (Ireland). Moving to the United Kingdom (London) before live client use. |
| Lovable [confirm legal entity name] | Hosts and runs the Scrutti website and app, including the server functions that pass data between your browser, the database and the AI model. | [Confirm hosting region with Lovable] |
The full list, with the safeguards for each, is on our sub-processors page. We may also share data with professional advisers (such as accountants and lawyers), with a buyer if our business is sold, or where the law requires it.
6. International transfers
Some providers process data outside the UK. Where they do, we use a lawful transfer mechanism: a UK adequacy decision (for example, for the European Economic Area), the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework. You can ask us for details of the safeguards for any transfer.
7. How long we keep personal data
| Data | How long |
|---|---|
| Demo requests and enquiries that don't lead to a subscription | 2 years from our last contact |
| User accounts | For as long as the firm subscribes, then deleted within 90 days of the subscription ending |
| Case files uploaded for checks (documents, call recordings, transcripts) | Deleted within 2 days of the check (or remedial action) being signed off, or 10 days after upload at the latest. If a check hasn't been signed off, the firm is reminded 2 days before; it is told once files have been deleted. Files can't be kept for longer – the firm keeps its own records |
| File review sheets and check results (including any extracts quoted in findings), reviews, MI, reports and the audit log | For as long as the firm subscribes, then returned or deleted at the firm's choice within 90 days |
| Billing and accounting records | 6 years after the end of the financial year they relate to (legal requirement) |
| Hosting and security logs | Up to 90 days |
8. How we protect personal data
Data is encrypted in transit and at rest. Access is role-based, with two-factor authentication for every user and an append-only audit log. Each firm's data is isolated at database level. Read more on our security page.
9. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this notice);
- access a copy of your personal data;
- have inaccurate data corrected;
- have data erased in some circumstances;
- restrict how we use your data in some circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability, where processing is based on contract and carried out by automated means;
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects.
To use any of these rights, email [privacy@your-domain]. We will reply within one month. We may need to confirm your identity first. For client data held for an advice firm, we will help the firm respond.
10. How to complain
Complain to us
If you're unhappy with how we have used your personal data, please tell us first by emailing [privacy@your-domain] with "Data protection complaint" in the subject line, or by writing to [Postal address for data protection requests]. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
Complain to the ICO
You can also complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
11. Cookies
We only use cookies and browser storage that are needed for the site and app to work. See our cookie policy.
12. Changes to this notice
We will update this notice when how we use personal data changes, and show the date at the top. If a change is significant, we will tell users of the app.