Privacy Policy — Phanera
Skip to main content

Privacy Policy

Last updated: 26 March 2026

1. Who We Are

Phanera is operated by Revelio Software Ltd, a company registered in England & Wales (company number 17198982) ("we", "us", "our"). We are the data processor for organisations that use Phanera to manage information rights requests. Each organisation using the platform is the data controller for the personal data they process through Phanera.

Contact: [email protected]

2. What Data We Collect

We collect the following categories of personal data:

  • Account data: name, email address, organisation, and role when you create an account or are invited to one.
  • Authentication data: hashed passwords, two-factor authentication secrets, SSO tokens, and session identifiers.
  • Request data: information submitted through freedom of information, subject access, environmental information, or other request types — including names, contact details, and the content of requests and responses.
  • Usage data: IP addresses, browser type, pages visited, and timestamps for security and audit purposes.
  • Communication data: messages sent and received within the platform, including email ingestion pipeline content.

3. How We Use Your Data

We process personal data for the following purposes:

  • Providing and maintaining the Phanera platform.
  • Authenticating users and managing access control.
  • Processing and tracking information rights requests on behalf of organisations.
  • Sending transactional emails (account verification, password resets, request notifications).
  • Generating compliance reports and audit trails.
  • Ensuring platform security, detecting abuse, and preventing fraud.

4. Legal Basis for Processing

We process personal data under the following legal bases (UK GDPR):

  • Contractual necessity: to provide the service you or your organisation has subscribed to.
  • Legal obligation: to support organisations in meeting their statutory duties under FOIA 2000, EIR 2004, and UK GDPR.
  • Legitimate interests: platform security, fraud prevention, and service improvement.
  • Consent: where specifically required, such as optional marketing communications.

5. Data Sharing

We do not sell personal data. We share data only with:

  • Your organisation: data you submit is accessible to authorised users within your organisation.
  • Infrastructure providers: we use Microsoft Azure for hosting, database storage, email delivery, and secret management (Azure Key Vault). All data is processed within the UK or EEA.
  • Identity providers: if your organisation enables SSO, authentication tokens are exchanged with your configured identity provider (e.g. Microsoft Entra ID).

We will disclose data if required by law or to protect our legal rights.

6. Data Retention

Account data is retained for the duration of the subscription. Request data is retained according to each organisation's configured retention policies. When an organisation cancels their subscription, we delete all organisation data within 90 days unless retention is required by law.

7. Data Security

We implement appropriate technical and organisational measures including:

  • Encryption in transit (TLS) and at rest.
  • Secrets stored in Azure Key Vault.
  • Multi-tenant data isolation at the database level.
  • Two-factor authentication and SSO support.
  • Role-based access control with 50+ granular permissions.
  • HTML sanitisation on all user-generated content.
  • Complete audit trails for all actions.

8. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Request erasure of your data.
  • Restrict or object to processing.
  • Data portability.
  • Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise your rights, contact us at [email protected].

9. Cookies

Phanera uses only essential cookies and session storage for authentication. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use of the platform after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related queries, contact us at [email protected].