Privacy policy

The controller is Matthew Charles Anderson, a sole trader trading as Sentinel Wolf Intelligence & Investigations (not a limited company). Correspondence address: 1a Maesllwyn, Ammanford, Carmarthenshire, SA18 2EG, United Kingdom. Privacy contact: mcanders530@gmail.com or 07508 792031. Using the ICO's self-assessment, the owner has determined that the business is exempt from the data protection fee; the exemption does not change our obligations under data protection law.

Enquiry form: name, email, optional phone, service, budget, deadline, message, contact acknowledgements and submission time. Enquiries are saved privately; no automatic emails are sent.

Digital footprint self-assessment: answers stay in your browser and are not saved unless you submit the optional audit enquiry, which saves your answers, score and contact details.

Client portal: email address, sign-in records, optional name/company, service requests (subject, details, lawful purpose, relationship/authority, acknowledgements), case messages, status and uploaded reports.

Research: agreed engagements may involve names, business roles, property records, source references and other public-source information about people. Hosting and sign-in providers process IP address, browser and security log information.

• Responding to enquiries and quoting: steps at your request before a contract (Article 6(1)(b)), or legitimate interests when you contact us for a business (Article 6(1)(f)).
• Portal accounts, delivering work and case communication: performance of the contract (Article 6(1)(b)).
• Research about other people: legitimate interests (Article 6(1)(f)), assessed per engagement for purpose, necessity and impact. A client contract does not by itself justify processing another person's data, and requests we cannot lawfully support are declined.
• Security and preventing misuse: legitimate interests.
• Accounting and tax records: legal obligation (Article 6(1)(c)).

The checkboxes on our forms confirm authority and acknowledgements; they are not marketing consent. We do not send marketing, and make no automated decisions with legal or similar effects.

Please do not send health, biometric, political, religious, sexual-life or criminal-offence information, identity documents or passwords unless we have agreed in advance that it is necessary. Special-category data is processed only where an Article 9 condition applies, and criminal-offence data only where Article 10 and the Data Protection Act 2018 permit. We do not offer covert monitoring, intrusive tracing, facial recognition, hacking or doxxing. Where we research a living person, we minimise what we collect, limit disclosure to the client, and provide privacy information to that person unless a lawful exemption applies.

• Lovable Cloud — website hosting, sign-in, database and private file storage.
• Google — web fonts (receives your connection information) and the Gmail account used for email correspondence.
• WhatsApp/Meta and phone networks — only if you choose to contact us that way, under their own privacy terms.

These providers may process data outside the UK; transfers rely on the safeguards in each provider's data-processing terms. Reports are shared only with the client users assigned to the case and the owner. We never sell personal data. We disclose information to authorities only where legally required.

• Uploaded reports: deleted from the portal 90 days after delivery — please download and keep your own copy.
• Enquiries and requests that do not proceed: deleted 6 months after last contact.
• Case records and messages: deleted 12 months after the case closes.
• Inactive portal accounts: reviewed after 12 months of inactivity and removed if no case is open.
• Invoices and accounting records: kept as long as HMRC requires (at least 5 years after the 31 January tax return deadline for the relevant year).

Deletion is carried out by the owner; provider backups and logs expire on the providers' own schedules. Records may be held longer only where needed for a legal claim.

Portal pages require sign-in. Database rules restrict each case to its assigned users and the approved owner, and the owner account requires manual approval. Reports are stored privately and released through download links that expire after one minute; downloaded copies remain on your device. Use a unique password, don't share links or accounts, and tell us promptly about suspected unauthorised access. No system is completely secure, and we hold no independent security certification.

We use only storage necessary for sign-in and keeping you logged in to the portal. We do not use advertising or analytics tracking cookies, so no cookie consent banner is needed.

You can ask for access to, correction or deletion of your data, restriction of processing, data portability, and object to processing based on legitimate interests. Rights are not absolute and exemptions can apply. Email mcanders530@gmail.com or write to the address above; we may ask for proportionate proof of identity. We reply within one month (extendable by two months for complex requests, with notice). There is normally no fee.

Please contact us first if you have a concern. You may complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

We will update this policy when our processing changes and show the new date above.