Privacy Policy
Last updated 8 September 2026
This policy explains what personal data Techcopter Ltd ("Techcopter", "we") collects when you use techcopter.co.uk and the Techcopter platform, why we collect it, and what rights you have over it.
It is written to describe what the software actually does. Where we say we do not collect something, that is because there is no code that collects it.
Who we are
Techcopter Ltd (company number 14423500), 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom, is the data controller for the personal data described in this policy.
For any privacy question, or to exercise the rights set out below, contact privacy@techcopter.co.uk.
What we collect, and why
Each category below is listed with the reason we hold it and the lawful basis we rely on under UK GDPR. We only hold a category if you use the part of the service that needs it — signing in with Google, for example, means we never hold a password for you.
| Data | Why we hold it |
|---|---|
| Account: your name, email address, a hashed password, your role, and whether your email is confirmed | To create and secure your account. Lawful basis: performance of a contract. |
| Google sign-in, if you use it: the permanent account identifier Google issues for you, and the email address on that Google account | To recognise you next time without holding a password for you. We ask Google only for your name, email address and basic profile — never your contacts, files or anything else in your Google account. Lawful basis: performance of a contract. |
| Session: a hashed session token, its expiry, your IP address and browser user-agent | To keep you signed in and to detect abuse. Lawful basis: legitimate interests (securing the service). |
| Enquiries: your name, email, organisation, the subject you chose, your message, plus IP address and user-agent | To answer you and to limit automated abuse of the form. Lawful basis: legitimate interests, and steps toward a contract. |
| Billing account: your PayPal payer ID and the email on your PayPal account, your plan, seat count and billing dates | To provide and bill the subscription you bought. Lawful basis: performance of a contract. |
| Invoice details you give us at checkout: the billing contact's name and email address, the company being invoiced, its billing address, and — where you enter them — a VAT number and a purchase-order reference | To issue an invoice your finance team can accept, and to keep the accounting records the law requires of us. We also record when you accepted these terms. Lawful basis: performance of a contract, and legal obligation for the accounting record. |
| Invitations: the email address of anyone you invite to your workspace, until they accept or the invitation is removed | To let you add colleagues to your workspace. Lawful basis: legitimate interests (running the workspace you asked for). |
| Learning records: modules assigned to you, your progress and completion dates | To deliver training and produce completion evidence for your employer. Lawful basis: performance of a contract. |
What we do not collect
Techcopter runs no advertising pixels. We do not profile you for advertising, we do not build advertising audiences, and we do not sell or share personal data with data brokers — the advertising features of our analytics are switched off. We do count visits using Google Analytics, which sets cookies, and it runs only if you agree to it. Decline and it does not load at all. See “How we count visits” below.
We never see your payment card or bank details. Payments are handled entirely by PayPal, and the only things we receive back from PayPal are a payer identifier, the email on the PayPal account, and the status of the subscription. That is separate from the invoice details you type into our checkout form, which are listed in the table above and which we do hold.
We do not ask for special category data (health, biometrics, political opinions and similar), and you should not send it to us.
Cookies and browser storage
Techcopter sets two strictly necessary cookies, neither present until you sign in, and — only if you accept them — two analytics cookies:
| Cookie | Purpose |
|---|---|
| tc_session | Keeps you signed in. HttpOnly, Secure and SameSite=Lax. Contains a random token — no personal data is stored in the cookie itself. Expires after 30 days, or immediately when you sign out. |
| _ga | Set by Google Analytics, and only after you accept. It holds a randomly generated identifier for your browser so that repeat visits are counted as one visitor rather than several. It expires two years after your last visit. Decline, and it is never created. |
| _ga_<property> | Set alongside _ga and by the same means. It holds the state of your current visit — when it began, and how many pages it has covered — so a visit is measured as one session rather than many. It expires two years after your last visit. Decline, and it is never created. |
| tc_oauth_state | Set only when you choose to sign in with Google, and only for the ten minutes that takes. HttpOnly, Secure and SameSite=Lax. It holds a random token that lets us check the reply came from the sign-in you started, which is what stops someone else's sign-in being substituted for yours. Deleted as soon as you come back from Google. |
Cookies, continued
The two session cookies are strictly necessary to provide a service you asked for, so those need no consent. The analytics cookies are not, so we ask before setting them — that is what the banner is for, and declining is a single click that carries the same weight as accepting. Until you accept, the analytics code is not loaded at all: not loaded and idle, absent. Browsing without signing in and without accepting sets no cookies whatsoever. You can change your answer at any time from the section below.
The signed-in workspace also stores a small amount of data in your browser's local storage — your colour theme, whether the sidebar is collapsed, and whether you have seen the welcome tour. This never leaves your device and is not personal data. Clearing your browser data removes it.
Fonts are served from our own domain. Although they originate from Google Fonts, they are downloaded when the site is built and served by us, so your browser makes no request to Google and your IP address is never disclosed to them.
How we count visits
We use Google Analytics to count visits, so we can tell which pages are useful and whether anyone is finding us. It runs only if you accept it. Until then the code is not on the page at all — not loaded and waiting, absent — so nothing is stored and nothing is sent.
If you accept, your browser loads Google’s script and contacts Google directly. Two cookies are set, listed in the table above, which let repeat visits be counted as one visitor and a visit as one session. Google receives your IP address, which we have configured it to shorten before storage, along with the pages you viewed, your approximate location and your browser and device type. Google may handle that data outside the UK, including in the United States.
We have switched off the advertising side of it: no advertising features, no Google Signals, and no data sharing with other Google products. It is used to count and understand visits, not to build a profile of you or to target anything at you.
It runs on our public pages and on the sign-in and sign-up screens, and nowhere else. Once you are signed in, what you do inside your workspace is not measured.
You can change your mind whenever you like. Declining, or clearing the choice, stops the code loading on your next page view; the cookies already set can be removed through your browser at any time. Because this is a choice stored in your own browser, it is remembered per browser and per device rather than per person.
Who else processes your data
We keep the list of processors short on purpose.
| Processor | What they handle |
|---|---|
| PayPal | Payment and subscription processing. PayPal is a separate controller for the payment itself and applies its own privacy policy. |
| Sign-in, only if you choose it. Google tells us your name, email address and account identifier, and learns that you signed in to Techcopter. Google is a separate controller for your Google account itself and applies its own privacy policy. | |
| GoDaddy | Hosting of the application, database and uploaded files, and the mail account that sends verification and enquiry email. |
| Google Analytics | Counting visits to our public pages, and only for visitors who accept. It receives your IP address, which we have configured it to shorten before storage, together with the pages you viewed, your approximate location, and your browser and device type. Google is the processor and may handle that data outside the UK, including in the United States, under its own transfer safeguards. Advertising features, Google Signals and data sharing with other Google products are switched off, so nothing here builds an advertising profile. |
| OpenAI | Part identification, and only if you use that step on the conversion page. It receives the name of your file and the names of the parts inside it — never the geometry itself, and never your account, billing or training data. Nothing is sent unless you press the button. |
Where your data is held
Application data and uploaded files are stored on our hosting provider's infrastructure in Singapore. That includes your account, your enquiries and anything you upload.
Singapore is not covered by a UK adequacy decision, so storing your data there is a restricted transfer under UK GDPR. We rely on the UK International Data Transfer Addendum with our hosting provider, together with an assessment of the risks of that transfer, and we keep both under review.
PayPal processes payments internationally and may transfer data outside the UK and EEA under its own safeguards. Where we transfer personal data outside the UK, we rely on the UK International Data Transfer Addendum or an adequacy decision.
How long we keep it
| Data | Retention |
|---|---|
| Account and learning records | Kept while your account is open. Closing it deletes them immediately — you can close it in Settings, in the app, or by writing to us. |
| Sessions | Deleted automatically when they expire, and immediately when you sign out. |
| Abuse-prevention counters (which include IP addresses) | Deleted automatically after 24 hours. |
| Enquiries | 24 months from your last contact with us. |
| Billing records, including the invoice details you gave us at checkout | Kept for at least 6 years, which is what tax and accounting law requires of us. These survive account closure, because the obligation to keep them does. |
| Invitations you have sent | Kept until the invitation is accepted or removed. If you close your account but colleagues remain in the workspace, any invitations still outstanding belong to that workspace and remain with it; if you were the last member, the workspace and its invitations are deleted with your account. |
How we protect it
No system is perfectly secure. If we ever suffer a breach that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell you directly where the risk is high.
Passwords are hashed with scrypt and are never stored or logged in a readable form — we cannot see your password, and a database leak would not reveal it.
Session cookies hold a random token; only a SHA-256 hash of that token is stored in our database, so a copy of the database cannot be replayed to sign in as you.
Uploaded model files are stored outside the public web root and can only be reached through an authenticated request.
The site is served over HTTPS and session cookies are marked Secure, so they are never transmitted unencrypted.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can also withdraw consent where we rely on it.
Write to privacy@techcopter.co.uk. We will respond within one month.
If your employer bought your Techcopter seat, they may be the controller of your learning records. We will tell you if that is the case and point you to them.
If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Techcopter is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
Changes
If we change this policy materially — for example by adding a processor or a new category of data — we will update the date at the top and, for significant changes, email account holders before the change takes effect.
See also the Privacy Policy and Terms of Service.