Privacy Policy

RSAT is built to collect as little about you as possible. The only data we hold is:

• Your email address — collected only when you choose to sign in. We use it to send you a magic sign-in link and to identify your account. If you never sign in, we never ask for or store your email.
• A session identifier — when you sign in we store a random session identifier in a cookie called rsat-session. This is what keeps you signed in. A session stays valid for 30 days from the last time you were active; after that you simply sign in again.
• An anonymous session event log — each page load records a single anonymous event so we can understand roughly how the tool is used. This log contains no email address, IP address, or name. It is written only to our application’s output (operational logs) and is not stored in a database or linked back to you.
• Feedback you choose to send — if you use the in-app feedback form, we store the qualitative feedback you submit so we can act on it and improve the tool.

RSAT uses no advertising, no tracking pixels, and no third-party analytics. We set no cookie other than the strictly-necessary session cookie described above. We collect no payment information at any tier.

Under UK GDPR we must have a lawful basis for processing personal data. We rely on legitimate interests (Article 6(1)(f)):

• Signing you in — we process your email address and session identifier because we have a legitimate interest in authenticating you and keeping you signed in to the features you have asked to use. This is limited to what is necessary to provide that sign-in.
• Understanding usage — we process the anonymous session event log because we have a legitimate interest in understanding and improving how the tool is used. This log is designed to be anonymous and records no email address, name, or other identifier on our part; where it may nonetheless amount to personal data, legitimate interests is our basis for it.

We do not rely on consent for any of our processing, which is why you will not see a consent checkbox anywhere in RSAT. Where we rely on legitimate interests you have the right to object — see Your rights below.

We use a single third-party data processor:

• Resend — used solely to deliver your magic sign-in email. Your email address is passed to Resend only for that delivery. Resend’s handling of data is governed by its own privacy policy and data processing agreement.

To deliver your sign-in email, your email address is passed to Resend (operated by Plus Five Five, Inc., San Francisco, USA) solely for that delivery. Because Resend’s processing takes place in the United States, your email address — including within Resend’s email logs and metadata — is transferred there. That transfer is protected by the UK Addendum to the European Commission’s Standard Contractual Clauses, which form part of our data processing agreement with Resend; you can request a copy of those safeguards by emailing us. Your session data and any feedback you submit are stored in the United Kingdom or European Economic Area. We do not sell, share, or rent your personal data to any other third party.

RSAT sets exactly one cookie: rsat-session. It is strictly necessary for authentication — it is what keeps you signed in. If you reject or block it, signing in will not work.

We do not show a cookie consent banner because the only cookie we use is strictly necessary, which is exempt from the consent requirement under the Privacy and Electronic Communications Regulations (PECR). No cookie is set at all for anonymous visitors who do not sign in.

Under UK GDPR you have the following rights over your personal data:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data. You can request this by emailing us at adam.gilmore@jetagile.com, and we will delete your account and associated data.
• Restriction — ask us to limit how we use your data.
• Objection — object to our processing of the anonymous session log carried out under legitimate interests.
• Complain to the regulator — lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.

The ICO can be contacted at:

• Email address — kept until you delete your account, after which it is removed. Resend, which holds a copy to deliver your sign-in emails, deletes its copy within 90 days of your deletion request.
• Sessions — a session expires 30 days after your last activity, and expired sessions are automatically deleted.
• Magic-link tokens — an unused sign-in token expires and is deleted 15 minutes after it is issued.
• Feedback — qualitative feedback you submit is retained for up to 24 months so we can track and act on it, then deleted.

RSAT is operated by Jet Agile Ltd (registered in England and Wales, company number 10543037), registered office 175 Post Office Lane, Broad Hinton, Swindon, United Kingdom, SN4 9PB. Jet Agile Ltd is the data controller responsible for your personal data.

For any privacy request or question, including to exercise any of the rights above, email us at adam.gilmore@jetagile.com.

The “last updated” date at the top of this page shows when the policy last changed. If we make a material change, we will email registered users before the change takes effect.