Privacy notice

Account details

Your name, email address, the billing account you belong to, your role, and the dates your record was created and changed. If you set a password we store a one-way hash of it, never the password itself. If you sign in with Google we receive your name, email address and basic profile from Google, using the standard sign-in scopes and nothing more.

Billing

Top-up amounts, currency, payment references, payment status, and the cardholder name you type at checkout. Card numbers are entered into Worldpay’s own checkout component and never reach our servers — we hold a payment session reference and the outcome, not your card.

Connected sites

The address of each site, its CMS or API credentials (encrypted at rest, per site), the content we generate and publish for it, and the performance data we read back. Where your site content or product data contains personal data — a staff biography, a customer question — it is processed as part of the content, as described above.

Connection tokens

OAuth tokens for Google Search Console, Google Analytics, Bing Webmaster Tools and Microsoft Ads, held encrypted and used only to read data for the site you connected them to and to submit URLs for indexing. You can disconnect any of them at any time, which is what revokes them.

Correspondence

Emails and messages you send us, and our replies.

Technical data

Server logs, and error reports through Sentry when something breaks — the page, browser and error diagnostics. Cloudflare sits in front of the site and sees the IP address and request metadata of traffic to it. We do not build profiles of visitors and there is no advertising or analytics tracking on our marketing pages.

Cookies

All of our cookies are strictly necessary, so there is no consent banner to click through:

• itmaster_session — your signed-in session. HTTP-only, 14 days.
• gsc_oauth_state, ga4_oauth_state, bwt_oauth_state, msads_oauth_state, ga4_terms_site — short-lived values discarded in ten minutes (thirty for the GA4 terms hand-off) that make a connection flow safe by keeping the site you are connecting on the server side rather than in a URL.

We set no advertising, profiling or cross-site tracking cookies.

• To provide the service — accounts, generation, publishing, measurement, support. Basis: performance of our contract with you.
• To take payment and keep financial records. Basis: contract, and legal obligation for the records tax law requires us to keep.
• To keep the service secure and working — logging, error monitoring, fraud and abuse prevention, rate limiting. Basis: our legitimate interest in a service that is not broken or abused, balanced against the small amount of data involved.
• To improve the engine — reviewing failures, pass rates and cost, and publishing aggregated statistics that identify no customer, site or article. Basis: legitimate interest.
• To send service email — top-up receipts, low balance warnings, publishing alerts, changes to these documents. Basis: contract. These are not marketing and you cannot unsubscribe from them while you hold an account.
• To send anything promotional. Basis: your consent, which you can withdraw at any time.

We do not sell personal data, and we do not share it for advertising. We do not make decisions with legal or similarly significant effects about people by automated means: the engine makes automated decisions about content — what to write, whether a draft passes — not about individuals.

This is the part people most want to know, so it gets its own section. Producing an article means sending material to AI providers: your brief, the research dossier, passages retrieved from your own data, the draft itself, and the checkers’ verdicts on it. The providers we use for that are Anthropic, Google, OpenAI, Perplexity and Voyage AI, and the split of work between them is in the table below.

Two things follow from how the engine is built. Because the model that writes is never the model that checks, and every check includes a model from a different vendor than the writer, a single article is seen by more than one provider — that cross-vendor spread is the product, not an accident. And because each check gets only what it needs, no provider receives your whole account.

We reach these providers through their paid business APIs, not their consumer chat products, and we do not sell or license your content to them for any purpose other than performing the task we sent it for. Each provider handles data under its own terms; if you need the current list for a data-protection assessment of your own, ask at contact@itmaster.uk.

These are the third parties involved in running IT Master. Several never touch personal data at all, and the table says so rather than leaving you to guess.

We add or replace a provider when the pipeline changes — a better checker, a cheaper renderer, a model retired by its vendor. When that happens we update this table and its last-updated date.

• Account details — while your account is open, and deleted within 30 days of you asking us to close it, except where a record below has to be kept.
• Billing and payment records — six years from the end of the accounting period, because UK tax law requires it.
• Connected-site content and generated articles — while the site is connected. Articles already published to your own site are yours and stay there; deleting your account here does not delete them from your website.
• OAuth tokens — until you disconnect that integration or close the account, then deleted.
• Support correspondence — up to two years, so we can pick up a thread you started last year.
• Server logs and error reports — short-lived operational data, kept in the order of weeks rather than years, and not used to profile anyone.

We are in the United Kingdom, and so is our infrastructure. Several of the providers in the table above are in the United States or process data there — the AI providers in particular.

Those transfers rely on the UK’s approved safeguards: an adequacy decision where one covers the provider, and otherwise the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in each provider’s data-processing terms.

• Traffic is encrypted in transit.
• Passwords are stored as one-way hashes; nobody at IT Master can read yours.
• Site credentials, payment credentials and OAuth tokens are encrypted at rest.
• Keys are per site, so one customer’s credentials cannot reach another customer’s content or corpus.
• Sessions are HTTP-only cookies re-checked against the database on every request, so disabling an account ends its sessions immediately.
• Access to production data is limited to the people who need it to run the service.

No system is perfect. If a breach happens that is likely to risk your rights and freedoms, we will tell the Information Commissioner’s Office within 72 hours where required, and tell you without undue delay.

Under UK data protection law you have the right to:

• Be informed — this notice.
• Access a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have data deleted where we have no overriding reason or legal duty to keep it.
• Restrict processing while a dispute about accuracy or basis is resolved.
• Data portability — receive the data you gave us in a common machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where consent is the basis, without affecting what happened before.
• Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. As above, the engine’s automated decisions are about content, not people.

To exercise any of these, email contact@itmaster.uk from the address on your account, or write to us and we will verify your identity another way. We reply within one month, and will say so if a complex request needs longer. There is no charge.

If you are unhappy with how we handled it, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you told us first, but you do not have to.

IT Master is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children.

We update this notice when what we do changes — a new provider in the table, a new kind of data, a different retention period. The version here is always the current one, and its date is at the top. If a change materially affects you we email account holders before it takes effect.

The terms of service and the refunds policy sit alongside this notice.