Our Compliance Documentation

ICO Registered Data Controller

Registration number: ZC116446 · Registered: 6 April 2026 · Expires: 5 April 2027

1. Data Protection Policy

1.1 Purpose and Scope

This policy sets out how ProPolicyForge, operated as a sole trader by Andrew David Reilly and registered with the Information Commissioner's Office (ICO) under registration number ZC116446, fulfils its obligations as a data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

This policy applies to all personal data processed by ProPolicyForge in the course of operating the propolicyforge.com and propolicyforge.co.uk platforms and any associated business activities.

1.2 Data Protection Principles

ProPolicyForge is committed to processing personal data in accordance with the six principles of UK GDPR. Personal data will be processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes; limited to what is necessary; kept accurate and up to date; retained only as long as necessary; and processed with appropriate security.

1.3 Personal Data We Process

• —Contact information submitted via the contact form — name, email address and message content
• —Payment information processed via Stripe — ProPolicyForge does not store card details
• —Email addresses collected for annual reminder purposes, stored in Upstash Redis with explicit consent
• —Anonymous usage data collected via Vercel Analytics and Google Analytics — no individual identification
• —Organisation details and sector-specific information entered during document generation — processed in real time and not retained beyond the active session for free and pay-per-document users
• —Generated document content for subscribed users — stored securely in Vercel Blob (EU region) and indexed via Upstash Redis (London region) to provide the Vault feature

1.4 Lawful Basis for Processing

• —Contract — processing necessary to deliver the document generation service
• —Legitimate interests — anonymous analytics to improve the service; fraud prevention
• —Consent — annual reminder emails, where email address is voluntarily provided
• —Legal obligation — retention of financial records for HMRC compliance

1.5 Data Retention

For free and pay-per-document users, document content and inputs are not retained beyond the active session. For subscribed users, generated document content is stored in the Vault until the user deletes it. Payment records are retained for seven years in accordance with HMRC requirements. Contact form correspondence is retained for two years.

1.6 Third Party Processors

ProPolicyForge uses the following third party processors: Anthropic (AI model processing), Stripe (payment processing), Resend (transactional email), Vercel (hosting and analytics), Upstash (Redis data storage, London region), Google Analytics (anonymous usage analytics), and Namecheap (domain registration).

1.7 Individual Rights

Individuals have the right to access, correct, delete, or object to the processing of their personal data. Requests should be directed to support@propolicyforge.com. ProPolicyForge will respond within 30 days. Individuals also have the right to lodge a complaint with the ICO at ico.org.uk.

1.8 Data Breach Procedure

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, ProPolicyForge will notify the ICO within 72 hours of becoming aware of the breach, and affected individuals without undue delay where the breach is likely to result in a high risk.

2. Acceptable Use Policy

2.1 Purpose

This policy sets out the permitted and prohibited uses of documents generated by ProPolicyForge. By generating, downloading or using any document produced by the ProPolicyForge platform, users agree to the terms of this policy.

2.2 Permitted Uses

• —Implementing generated documents as the basis for internal compliance policies within your own organisation
• —Adapting, editing and customising generated documents to reflect your organisation's specific practices, procedures and branding
• —Sharing generated documents internally with employees, contractors and relevant stakeholders within your organisation
• —Using generated documents as reference material to inform the development of your own bespoke policies
• —Submitting generated documents, having reviewed and approved them, to regulatory bodies, inspectors or commissioners as part of a compliance process

2.3 Prohibited Uses

• —Reselling, sublicensing or commercially distributing generated documents to third parties without written permission from ProPolicyForge
• —Representing generated documents as independently authored, legally reviewed or professionally certified without such review having taken place
• —Using generated documents to support fraudulent, misleading or unlawful activities
• —Inputting personal data of identifiable individuals into the document generation system in a manner that would breach UK GDPR
• —Reverse engineering, scraping or systematically extracting content from the ProPolicyForge platform

2.4 Professional Review Requirement

All documents generated by ProPolicyForge are AI-generated and must be reviewed by a suitably qualified professional before implementation. Users accept responsibility for ensuring documents are appropriate for their specific organisation, sector and regulatory circumstances.

2.5 Document Retention Responsibility

For free and pay-per-document users, ProPolicyForge does not retain generated documents after the session ends — users are responsible for downloading and maintaining their own copies. For subscribed users, generated documents are automatically stored in the Vault and accessible via the user's account.

3. AI Ethics and Transparency Statement

3.1 Our Approach to AI

ProPolicyForge uses artificial intelligence to generate compliance documentation. We are committed to transparent, responsible and ethical use of AI technology, and we believe customers are entitled to understand how AI is used in the generation of their documents.

3.2 How AI is Used

ProPolicyForge uses the Anthropic Claude AI model via API to generate compliance documents. Before generating each document, the system searches live regulatory sources including CQC, HSE, legislation.gov.uk and sector-specific guidance. The AI model then generates a complete, structured compliance document based on the sector, document type and organisation-specific details provided by the user.

3.3 What AI Cannot Do

• —AI-generated documents are not a substitute for professional legal, regulatory or compliance advice
• —AI cannot guarantee that documents reflect every legislative change — while ProPolicyForge searches live regulatory sources before each generation, regulations can change at any time and human verification before implementation remains essential
• —AI-generated documents may contain errors, omissions or inaccuracies — human review before implementation is essential
• —AI cannot provide assurance that documents will pass a regulatory inspection — this depends on your organisation's actual practices

3.4 Stateless Processing — Your Data is Not Retained

ProPolicyForge uses stateless AI processing — document content is never used to train AI models and is never shared with third parties. For free and pay-per-document users, content is not retained beyond the active session. For subscribed users, generated document content is stored securely in their private Vault (Vercel Blob, EU region) under the user's control.

3.5 Bias and Fairness

We recognise that AI systems can reflect biases present in their training data. ProPolicyForge's document generation is designed to produce sector-specific, regulation-aligned content rather than opinion-based or subjective content. Where sector-specific professional standards or protected characteristics are referenced, these are aligned to current UK legal requirements.

3.6 Human Oversight

ProPolicyForge is built and operated by a human with domain expertise in regulated healthcare. The AI model is a tool used under human direction — the framing of prompts, the choice of regulatory sources searched, and the structure of generated documents are all the product of deliberate design decisions.

3.7 Continuous Improvement

ProPolicyForge monitors the quality of generated documents and updates prompts, regulatory source searches and document structures as legislation and inspection frameworks evolve. Users are encouraged to report any inaccuracies or quality concerns to support@propolicyforge.com.

4. Business Continuity Policy

4.1 Purpose

This policy sets out ProPolicyForge's approach to maintaining service availability and recovering from disruption. As a digital service, ProPolicyForge's primary risks are technical — infrastructure failure, third party service outages, or security incidents — rather than physical.

4.2 Service Dependencies

ProPolicyForge depends on the following third party services for core functionality: Vercel (hosting and deployment), Anthropic API (AI document generation), Stripe (payment processing), Upstash Redis (data storage), and Resend (transactional email).

4.3 Availability Commitment

ProPolicyForge aims to maintain reasonable service availability, subject to planned maintenance windows and the availability of third party infrastructure providers including Vercel, Anthropic and Upstash. ProPolicyForge does not guarantee uninterrupted service and is not liable for loss caused by service interruptions beyond its reasonable control.

4.4 Incident Response

• —Service outages or degraded performance will be investigated promptly upon detection or report
• —Users experiencing issues should contact support@propolicyforge.com with a description of the problem
• —Where a technical failure prevents document generation following a paid transaction, ProPolicyForge will provide a credit or resolution
• —Significant outages will be communicated to users where contact details are available

4.5 Data Resilience

For free and pay-per-document users, ProPolicyForge does not retain generated documents — users are responsible for their own copies. For subscribed users, generated document content is stored in Vercel Blob (EU region) with Vercel's built-in redundancy, and indexed via Upstash Redis (London region). Users are advised to maintain their own downloaded copies of important documents.

4.6 Succession and Continuity

ProPolicyForge is currently operated as a sole trader. In the event of a period of incapacity or unavailability of the operator, ProPolicyForge will endeavour to communicate disruption to users and, where applicable, provide refunds for unused subscription periods.

5. Complaints Procedure

5.1 Our Commitment

ProPolicyForge is committed to providing a high-quality service and takes all complaints seriously. We regard complaints as an opportunity to improve. If you are dissatisfied with any aspect of our service, we want to hear from you.

5.2 How to Make a Complaint

Complaints should be submitted in writing to support@propolicyforge.com. Please include your name, contact email address, a description of your complaint, the date(s) on which the issue occurred, and any relevant reference numbers such as a payment reference or document type generated.

5.3 How We Will Respond

• —We will acknowledge receipt of your complaint within 2 business days
• —We will investigate your complaint thoroughly and respond with our findings and any proposed resolution within 10 business days
• —Where an investigation requires more time, we will notify you of the expected timescale
• —Where a complaint relates to a technical failure that prevented document generation following payment, we will offer a credit or resolution as appropriate

5.4 Escalation

If you are not satisfied with our response, you may escalate to: the Information Commissioner's Office for data protection concerns (ico.org.uk), Citizens Advice for consumer disputes (0808 223 1133), or your card provider or Stripe for payment disputes.

5.5 Learning from Complaints

All complaints are reviewed to identify whether they indicate a systemic issue with the service. Where complaints identify a pattern of quality concern, ProPolicyForge will review and update its document generation processes accordingly.

6. Equality and Diversity Policy

6.1 Purpose and Scope

ProPolicyForge is committed to equality, diversity and inclusion in all aspects of its business operations. This policy applies to ProPolicyForge's interactions with customers, suppliers and any individuals who engage with the platform or its operator.

6.2 Legal Framework

This policy is informed by the Equality Act 2010. ProPolicyForge will not discriminate, directly or indirectly, on the grounds of any protected characteristic in its service provision, communications or business practices.

6.3 Service Accessibility

• —ProPolicyForge aims to provide its digital service in an accessible manner, including appropriate font sizes, colour contrast and responsive design across devices
• —Users who require support in accessing the service due to a disability or access need are encouraged to contact support@propolicyforge.com
• —Document generation prompts are designed to produce inclusive, non-discriminatory content aligned to current UK equality legislation
• —Pricing and access to the service are provided equally regardless of the protected characteristics of the user or their organisation

6.4 Content Standards

Documents generated by ProPolicyForge are designed to align to current UK equality legislation and best practice, including the Equality Act 2010 and relevant sector-specific guidance.

6.5 Reporting Concerns

Any individual who believes they have been treated unequally in their interactions with ProPolicyForge, or who has concerns about the equality implications of generated content, is encouraged to raise this via our complaints procedure at support@propolicyforge.com.

6.6 Review

This policy will be reviewed annually and updated to reflect changes in legislation, regulatory guidance and best practice. The current version was last reviewed in April 2026.