Data protection
Written to be checked rather than believed. Everything below can be verified against the schema and the network tab, and where something is a commitment rather than a mechanism, it says so.
Summary
The short version
- Pricing a quote involves no personal data at all. There is no account, no login and no field for a name.
- We hold personal data in two places and no others: the contact form, and the mailbox behind our published address. Both are listed below with what is kept and for how long.
- No cookies and no trackers unless you say yes. The site loads nothing from anyone else until you accept the analytics question; then Google Analytics counts your visit, with cookies. Refuse, or ignore the question, and nothing is sent, which you can confirm in your browser's network tab. Our own measurement is a daily count of arrivals from tagged links, which identifies nobody.
- Records are stored in Frankfurt, inside the EU. A daily backup of the ledger, encrypted before it leaves, is kept on GitHub for 90 days, outside the EU. It never includes the contact form.
- We sell nothing and share nothing for marketing. There is no advertising on this platform and never will be.
Processing activity 1
Quote records
A quote priced with a distributor’s API key is appended to an audit ledger, for the traceability a distributor needs under the Insurance Distribution Directive. A quote priced without a key is priced and not recorded. A record contains these fields, and none of them identify a person:
| Field | Content |
|---|---|
id | A random identifier generated by the database |
created_at | When the quote was priced |
distributor_id | Which distributor recorded it: a business, identified by the key it used |
active_vertical | Which of the four risk verticals |
selected_components | The true or false state of each cover component |
total_monthly_premium | The premium the server computed |
matrix_version | Which version of the rating matrix priced it |
compliance_status | A fixed status string |
chain_index, prev_hash, row_hash | Its place in the hash chain |
No IP address, no device or browser fingerprint, no session identifier and no cookie is recorded against a quote, and there is no field for the distributor’s customer. Two quotes for the same cover by the same distributor differ only in their time and their place in the chain.
One use of your IP address, stated so it is not a surprise: to stop a single address flooding the engine, the API counts requests from each address over a one-minute window (60 quotes a minute) using Cloudflare’s rate limiting. That counter is kept by Cloudflare for the window and is never written to our database or joined to a quote.
Because these records identify nobody, they fall outside the GDPR and are kept indefinitely as the audit trail they exist to be. The ledger refuses edits and deletions by design.
Processing activity 1b
Evidence log entries
A distributor with a key can record the fingerprint of one of its own records, such as an advice
note, in the evidence log. The record never reaches us: the distributor hashes it with a random salt
it keeps, and sends only the resulting SHA-256 digest and a short tag such as idd.demands-needs.
An entry holds its position in the log, when it was recorded, the distributor, the tag and the digest,
and, if the distributor signs its entries, its key id, the time it claims and its signature.
To us, a digest identifies nobody: we never hold the record or its salt, and a salted digest cannot be reversed. The distributor holds both, so for the distributor the digest belongs with its record and its own obligations for that record. The record stays in the distributor’s systems, where it can be erased; erase the record and its salt, and the digest left in the log cannot be linked to anyone, by anyone. Entries are kept permanently, on the same append-only terms as the quote ledger. How a digest is made
Processing activity 2
Contact enquiries
If you use the contact form, we store what you typed so we can reply. Nothing more is inferred, appended or enriched.
| Question | Answer |
|---|---|
| What we store | Your name, email address, organisation if you give one, the enquiry type and your message |
| What we do not store | Your IP address, any tracking identifier, or anything you did not type — with one exception: if you reached the form through a link carrying a campaign tag (such as ?src=linkedin-sept), that tag is stored with your message so we know which conversation brought you |
| Why we may hold it | Legitimate interests under Article 6(1)(f): you asked us a business question and we need to answer it |
| How long | Twelve months from your last contact, then deleted |
| Who sees it | The controller, Anil Jangra. A copy of each enquiry is emailed to our mailbox so it can be answered from there, and what activity 3 says about that mailbox applies to the copy. It is not sold or passed to anyone else |
| Automated decisions | None. Nothing about you is scored, profiled or decided by a machine |
The twelve-month limit is enforced by a scheduled job in the database, not by someone remembering to run a query. A retention policy nobody implements is a statement, not a safeguard.
Processing activity 3
Email correspondence
We publish anil@riskrouter.eu, so anything you send there is personal data we hold. Saying the form was the only such place would have been convenient and wrong.
| Question | Answer |
|---|---|
| What we store | Your message and whatever your mail client puts in it: your address, your name as you send it, and the technical headers of the message |
| Where it sits | A Microsoft 365 mailbox. Microsoft is the processor for that mailbox, under its own data protection terms |
| Why we may hold it | Legitimate interests under Article 6(1)(f), the same basis as the form: you wrote to us and we need to answer |
| How long | Twelve months from our last exchange, then deleted |
| Who sees it | The controller, Anil Jangra, and Claude, an AI assistant made by Anthropic (United States), which the controller uses to read the mailbox and draft answers. A person reads every reply before it is sent, and nothing about you is decided by a machine. Anthropic provides Claude to us under its consumer terms, not under a data processing agreement (below). It is not sold or passed to anyone else |
One honest difference from the form: that twelve-month limit is a rule a person applies, not a scheduled job in a database. If the difference matters to you, use the form — it is enforced there, and we would rather you knew which of the two we can prove.
Your device
What we keep in your browser
This site sets no cookie of its own. Google Analytics sets cookies only if you accept it, as described below. Your answer to that question is kept in your browser’s local storage (not a cookie, and never sent to us), so the question is not asked on every page.
The demo console saves up to two values in your browser's local storage, so you do not have to retype them: the address of the pricing engine it should call, and, only if you enter one, your API key. The address never leaves your device. The key is sent only with requests to our own engine (or to one running on your own machine), never to any other address you type in. We cannot read either from your browser; emptying the key field removes the key, and clearing your site data removes both. The “try it” panel on the API reference keeps a key in the open tab’s memory only. Apart from your analytics choice and, if you accepted, Google’s cookies, nothing else is stored client-side.
Google Analytics, only if you accept
On your first visit a strip at the foot of the page asks whether we may count your visit with Google Analytics. Until you press Accept analytics, nothing is loaded from Google and nothing is written to your device by Google. No, thank you is as easy as accepting, and a browser sending Global Privacy Control is treated as having said no.
| Why | To see which pages are read, which searches and sites bring visitors, and where they leave, so we can improve the site |
| Legal basis | Your consent (GDPR Article 6(1)(a), and the ePrivacy rules on storing information on your device). You can withdraw it at any time with Analytics settings at the foot of any page; withdrawing deletes the Google Analytics cookies on this site |
| What is collected | The pages you view, the page or search that brought you, the time, your browser and device type, and an approximate location derived from your IP address. Google Analytics does not log or store IP addresses of visitors in the EU. On /seal, which step you reached (a file chosen, sealed, receipt saved, a check run), never the file, its name, its fingerprint, your key or the receipt. Cookies named _ga hold a random identifier so a return visit can be recognised; they expire after two years unless you withdraw |
| What is switched off | Google signals and ad personalisation. Nothing is used for advertising, and no data from the contact form, the evidence log or an API key is ever sent to Google |
| Who processes it | Google Ireland Limited, as our processor under Google’s data processing terms. Google may process the data in the United States; Google LLC is certified under the EU–US Data Privacy Framework |
| How long | Event data is kept for two months, Google Analytics’ default |
Campaign counts
When we share a link we sometimes tag it with a campaign name, such as
riskrouter.eu/integrate?src=linkedin-sept. If you arrive on such a link from another
site, the page tells our own API the campaign name and the page, and we add one to that day’s
count. That is all that is sent: no IP address is stored, no identifier, no browser details, and
nothing is written to your device — the tag travels in the links on the page, not in a cookie
or in storage. The result is a table of numbers per day, campaign and page, which cannot be tied to
any person and is not personal data.
The same tag is kept with a sandbox key you take, and with a message you send, so we can tell which campaign produced a trial or a conversation. Arrive without a tag and nothing is counted at all.
Sub-processors
Who else touches the data
| Provider | Role | Where |
|---|---|---|
| Cloudflare | Serves the pages and runs the pricing engine | Processed at the network location nearest to you, which may be outside the EEA. Nothing is stored there. |
| Supabase | Hosts the database holding quote records and contact enquiries | Frankfurt, Germany |
| GitHub | Keeps the daily backup of the ledger and the distributor records, for 90 days. It never includes contact-form enquiries. The backup is encrypted (AES-256) before it is uploaded, with a passphrase GitHub does not hold, so GitHub stores it but cannot read it | Outside the EU |
| Google Analytics, only for visitors who accept it (above). It never receives the contact form, the evidence log or API keys | Google Ireland Limited; possible transfer to the United States under the EU–US Data Privacy Framework | |
| Microsoft | Runs the mailbox behind our published address, so anything you email us passes through it | Microsoft 365, under Microsoft’s own data protection terms |
| Anthropic | Claude, the AI assistant the controller works with: it reads the mailbox to draft replies, which a person reads and sends, and it can see what the controller shows it while building and running the service | Anthropic, PBC, United States, under Anthropic’s consumer terms: not a data processing agreement, and not a processor acting on our instructions |
That is the complete list. There is no email marketing platform, no customer data platform and no advertising network, and Google Analytics is reached only after you accept it. Open your network tab and count. Microsoft appears only because we publish an email address; it touches nothing the platform itself stores. Anthropic appears because the controller reads that mailbox with Claude; we say plainly that this is under consumer terms rather than a processing agreement, because you are entitled to know which of the two it is.
Request routing through Cloudflare means the processing of a request in transit can happen outside the EEA even though the stored record does not. We would rather state that plainly than claim an EU-only guarantee the architecture does not support.
Your rights
What you can ask for
Where we hold personal data about you, which means the contact form and our mailbox and nothing else, you can ask us to give you a copy, correct it, delete it, restrict what we do with it, or object to us holding it at all. Ask through the contact form or at anil@riskrouter.eu, and we will act within one month.
Because our basis is legitimate interests rather than consent, you can object at any time and we will stop unless we have a compelling reason not to. In practice, for a business enquiry, there will not be one.
If you are unhappy with how we handle it, you can complain to the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit or Autorité de protection des données, or to the supervisory authority in your own member state.
Accountability
Who is responsible
The controller of the personal data described on this page is Anil Jangra, a natural person, who builds and operates RiskRouter as a validation prototype. No company has been registered yet, so there is no legal entity, registered office or data protection officer to name here; naming one that does not exist would be worse than naming none. When a company is formed, its name and registered address will appear here before any production processing begins.
Where a licensed distributor deploys this platform for their own customers, that distributor is the controller for their customers' data and we would be a processor acting on their instructions under a written agreement. Nothing on this page changes that division.
For anything concerning your data, including the rights set out above, write to anil@riskrouter.eu or use the contact form. Both reach the same person, which is the whole of the organisation today.
If anything here does not match what the system does, treat it as a defect. Tell us and we will fix the page or the code, whichever is wrong.