Privacy Policy

Securely is operated by AE TECHNOLOGIES GROUP LTD, a company registered in England and Wales under company number 17419062, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We operate the website securelyapp.co.uk and the Securely Android app, and provide AI-assisted scam, phishing and fraud detection tools, a Scam Prevention Academy, Latest Scam Alerts, Family Pack and Emergency Protection features.

AE TECHNOLOGIES GROUP LTD is the data controller for personal data processed through the service. ICO registration number: ZC241648.

For privacy and data-protection enquiries, contact privacy@securelyapp.co.uk. Written correspondence can be sent to AE TECHNOLOGIES GROUP LTD, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We want to be explicit about this because it goes beyond ordinary server logging. When you accept the Terms & Conditions, Privacy Policy and related legal agreements, Securely writes a legal acceptance record to your profile in our database. That record stores the IP address your device was using at the moment of acceptance, alongside the acceptance timestamp, the version identifier of the legal terms accepted, and the app version.

• Why we store it: to hold reliable evidence of when, and to which version, you agreed to the contract between you and Securely. This protects both sides if there is ever a dispute about what terms applied to your account.
• Lawful basis: our legitimate interests in maintaining an accurate, auditable record of contract formation, and compliance with our legal and consumer-law obligations. It is not used for marketing, profiling, advertising or location tracking.
• What we do not do with it: we do not use your IP address to determine or store your geographic location, build a behavioural profile, or share it with advertisers. It is not sold, and it is not passed to OpenAI, Stripe, RevenueCat or Google.
• Who can see it: it is not visible to other users, including family organisers or guardians. Access is limited to authorised staff of AE TECHNOLOGIES GROUP LTD and to privileged server code processing a legal or support request.
• Retention: it is retained for as long as your account exists, because the agreement it evidences remains in force for that period.
• Deletion: it is stored on your profile record, so it is deleted when you delete your Securely account. Encrypted infrastructure backups may retain a copy for up to 30 days before being overwritten. A separate account-deletion audit entry is kept afterwards as described in our Data Retention & Deletion Policy; that entry does not contain your IP address.

If you re-accept an updated version of our legal terms, a new acceptance record replaces the previous one, capturing the IP address in use at that time.

Securely uses artificial intelligence across the Message Scanner, Voice Scam Detection, Link Checker, every Scam Checker (Marketplace, Ticket, Seller Profile Risk, Identity Verification, Rental, Job, Romance and any future checker), OCR of screenshots and documents, alert generation, case summarisation, and recommended-lesson selection.

• Content you submit to a scanner, checker, OCR or case-summary feature — including message text, link details, transcripts, uploaded screenshots and documents, and text extracted from them — is transmitted over TLS to OpenAI, which processes it through its API to produce your result.
• OpenAI acts as our processor for these requests. Under the OpenAI API data terms in force at the time of writing, content submitted through the API is not used by OpenAI to train its models by default, and API content may be retained for a limited period for abuse and misuse monitoring before deletion. We do not control OpenAI's own terms and they may change; you should also review OpenAI's published API data-usage policies.
• We do not sell your submissions, and we do not use them to train our own models. Securely does not train a proprietary model — it combines large-language-model analysis with our own scam-detection logic and pattern rules.
• Sensitive details (bank passwords, PINs, one-time codes) should be redacted before submission wherever possible — Securely will never ask you for them.
• How to interpret AI outputs is explained in our AI Disclaimer.
• A small number of secondary features — automated triage of feedback you send us, and drafting of our own educational content — are processed through the Lovable AI Gateway using Google Gemini models. Your scans, checks and uploaded evidence are not sent to these models.

The Scam Prevention Academy, Latest Scam Alerts feed and knowledge-hub articles are produced by Securely and are updated as new threats and techniques are identified. Each alert or article is tagged with categories (for example Banking & Payment, AI Voice Cloning, Fake Delivery, Marketplace, Romance, Job, Identity Theft). Alerts and articles are written and published by Securely from information available to us, including public sources such as official warnings and consumer-protection publications; producing them does not use your personal data.

We record which lessons you start or complete, which alerts and articles you view, bookmark, or save, and which categories you follow. This is used only to show you relevant content inside Securely and to keep your learning progress. It is not sold, and it is not used for third-party advertising.

Scam alerts describe threats we are aware of at the time of publication. They are informational and do not cover every scam — see the AI Disclaimer.

Securely currently delivers notifications in two ways: inside the app (the bell icon and Notifications page, on web and Android) and by email. We do not currently send Android push notifications; if we introduce them in future we will update this policy and the Notification Policy first.

The main categories of notification are:

• Scam alerts — new or trending scams we think you should know about.
• Security updates and safety tips.
• Product updates — new Securely features and improvements.
• Subscription notifications — trial expiry, renewal, payment issues, plan changes.
• Family and emergency notifications — where you are on a Family Pack, including guardian and critical-alert escalation.

You can customise categories from Preferences, and every optional email includes an unsubscribe link. Turning off notifications does not affect your subscription or account.

Securely supports two payment routes depending on where you subscribed:

• Stripe is the sole payment processor for subscriptions purchased through the Securely website. Stripe collects and stores your payment card details; we receive a customer reference, subscription status and invoice metadata.
• Google Play Billing processes every subscription purchased inside the Securely Android app, as required by Google Play's Payments Policy. Google collects the payment and holds the payment method on your Google account.
• RevenueCat is our subscription management platform for the Android app. It receives Google Play purchase events and tells Securely which entitlement (Founding / Premium / Family) is active. We share your Securely user identifier and subscription identifiers with RevenueCat for this purpose.

Subscription state is stored in Securely as plan, status and provider references only. We do not store full card numbers, CVCs or bank credentials. Detail on plans, renewals, cancellation and refunds is in our Subscription & Billing Policy.

We do not sell your personal data, and we do not share it with advertisers or data brokers. We do, however, transmit some of your data to the third-party service providers we rely on to operate Securely. We want to be plain about that rather than claim your data never leaves our systems — it does, to the processors listed below, and only for the purposes shown.

• Supabase — database, authentication, file storage and realtime infrastructure hosting your account, scan history, cases and alerts.
• Lovable — the platform used to build, host and deploy the Securely web application and its server functions; it processes request traffic and infrastructure logs.
• OpenAI — AI analysis of the content you submit to a scanner, checker, OCR or case-summary feature.
• Stripe — website subscription payments and invoicing.
• Google (Google Play Billing and Google Play services) — Android app distribution and in-app subscription payments.
• RevenueCat — Android subscription entitlement management.
• Lovable (managed email service) — sending transactional and opted-in emails, and handling unsubscribes and bounces.
• Google Fonts — our web pages load fonts from Google's font servers, which means your browser makes a request to Google containing your IP address and user-agent when the page loads.
• Lovable AI Gateway (Google Gemini models) — automated triage of feedback you submit and drafting of our own educational content.

A full list with purposes is on our Subprocessors page. Providers are bound by their contractual data-processing terms and act on our instructions; they are not permitted to use your data for their own independent purposes. We may also disclose data where required by law, to enforce our Acceptable Use Policy, or to protect the safety of users.

Some providers are located outside the UK (including in the United States). Where this is the case, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, as offered by that provider, to ensure equivalent protection. Where you are located in the EEA, equivalent EU GDPR safeguards apply.

Securely is operated from the United Kingdom and personal data is stored and processed in our providers' UK, EU and US regions regardless of where you use the app. If you use Securely outside the UK and EEA — for example in India — your data is transferred to and handled under this policy and UK data protection law, in addition to any mandatory rights you have under local law. You can exercise the rights in Section 17 wherever you are located.

Retention periods for scans, OCR text, uploaded evidence, reports, cases, alerts, family activity, notifications, support messages, deletion audit records and billing records are set out in our Data Retention & Deletion Policy. You can delete most items from your dashboard at any time, or close your account from Account Settings.

Deleting your account is automated and complete. Before your account records are removed, Securely erases every screenshot, photo and document you uploaded from our secure file storage — including any upload whose database record is missing — and then deletes the associated database rows, your profile, and your authentication record. The erase step is scoped to your own private storage folder, so it cannot affect another user’s files. Encrypted infrastructure backups may retain copies for up to 30 days before being overwritten.