What we collect

• Account details. Your email address, a username, and optionally your first name, last name and a profile picture. If you register with a password, we store a hash of it, never the password itself.
• Sign-in identifiers. If you sign in with GitHub or Google, we store the identifier and email address that provider gives us so we can recognise you next time.
• Google Drive access tokens. If you connect Google Drive, we store the access and refresh tokens Google issues so the Platform can act on your Drive on your behalf (see "Google user data" below).
• Your content. The assurance cases you create, their elements, comments, and any evidence files you upload. If you publish a case to Discover, its content is public.
• Activity and security records. The time of your most recent login, and a security log of sign-in and account events that records the action, the time, your IP address and your browser type. We use this to detect misuse and to investigate security incidents.
• Emails we send you. Account emails (welcome, password reset, account deletion, and the inactivity warnings described in the retention policy) are sent through Microsoft Azure Communication Services.

We use only essential cookies, for signing you in and keeping your session. See the Cookie Notice.

Why we use it

To run your account, to let you build and share assurance cases, to send the account emails above, and to keep the Platform secure. We do not sell personal data, use it for advertising, or share it with third parties except the providers that host and deliver the service (Microsoft Azure for hosting, storage and email; GitHub and Google when you choose to sign in or connect with them).

Our lawful basis

We process your account details and your contributions to the Platform because it is necessary for the legitimate interests of The Alan Turing Institute: to provide and run the Platform, to conduct research and further the work of the Institute, and to evaluate and improve the service. The Platform uses only essential cookies, which do not require your consent (see the Cookie Notice). We do not run a mailing list or newsletter from the Platform.

Google user data

When you connect Google, we ask for the drive.file permission. This lets the Platform see, create and change only the files it creates in your Drive, or that you open with it. It does not give us access to the rest of your Drive. We use it to create a TEA folder in your Drive and to save exports of your cases there when you ask, and to read back files you have chosen to link to a case.

The tokens are stored in our database and sent only over encrypted connections. We use them only to make the Drive requests you trigger. We do not use Google user data for advertising, do not sell it, and do not let humans read it except with your permission, for security purposes, or to comply with the law. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time from Settings → Connected accounts, which deletes the stored tokens, or by revoking the Platform's access from your Google account permissions.

How long we keep it

We keep your account and content while you use the Platform. If you do not log in for two years we warn you by email 30 days and 7 days before deleting the account, and then delete it. The full rules are in the Data Retention Policy.

Deleting your data

You can delete your account from Settings. When an account is deleted: cases you own that have another Admin are kept under that Admin; cases with no other Admin are deleted; your name is removed from comments on cases that are kept; your account details, sign-in identifiers and tokens are deleted. If you own any integrations you must remove them first.

Where it is stored

The Platform runs on Microsoft Azure in the United Kingdom: the application, database and file storage are in the UK South region, and account emails are sent through Azure Communication Services with its data location set to the UK.

Changes and questions

We will update this notice when the Platform's data handling changes and show the date of the last change here. Questions: tea@turing.ac.uk.

Last updated: September 2026