What this policy covers
This policy explains what the Water Science Platform records about you, why it records it, how long it keeps it, and what you can ask us to do with it. It applies to this website, the subscriber portal and the administrative console — everything served under our domain.
What we collect
What you give us
An account needs a name, an email address and a password. A subscription adds a billing contact and the organisation you are subscribing on behalf of. If you submit a form — a quotation request, a support ticket, an event registration — we keep what you typed into it, because that is the message.
What the platform records as you use it
We log which documents you download, because entitlements and download quotas are counted per subscriber and a quota nobody counts is not a quota. We record sign-in times, the IP address a session was opened from, and the browser that opened it, because that is what lets you and us tell your sessions apart from somebody else's.
What we do not collect
We do not store card numbers. Payments are handled by the payment provider, and what reaches us is a reference, the last four digits and the outcome. We do not buy personal data about you from anybody, and we do not run third-party advertising trackers on these pages.
Why we are allowed to hold it
Account and subscription data is held because we cannot deliver a service you asked for without it. Security logs are held because we have a legitimate interest in knowing who signed in to an account. Anything else — a newsletter, a marketing message — is held because you opted in, and stops when you opt out.
Cookies
Three kinds, and no more. A session cookie that keeps you signed in, a CSRF token that proves a request came from a page we served, and a preference cookie remembering your language and theme. None of them follow you to other sites, and there is nothing here to consent to because there is nothing here that is optional.
Who else sees it
Our hosting provider, our payment provider and our email provider, each only to the extent their part of the service requires. We do not sell personal data. We will disclose data to an authority only where a law that applies to us requires it, and we will tell you when we are permitted to.
How long we keep it
Account data lives as long as the account does. Download and access logs are kept for twelve months, which is long enough to resolve a billing dispute and short enough not to become an archive of your reading. Invoices are kept for as long as tax law requires. When you delete your account, personal data is deleted; anonymised counts that no longer identify you may remain in aggregate statistics.
What you can ask for
A copy of what we hold. A correction. Deletion. An export in a portable format. Withdrawal of a consent you gave. Write to the address below and we will answer within thirty days — and if we cannot do what you ask, we will tell you why rather than not replying.
Security
Passwords are stored hashed, never in a readable form. Traffic is encrypted in transit. Administrative actions are recorded in an audit log with the identity of whoever took them. Uploaded files are scanned before they are stored. No system is perfect; if one of ours is breached in a way that puts you at risk, we will tell you.
Children
This is a professional platform. It is not intended for anyone under sixteen, and we do not knowingly create accounts for them.
Changes
When this policy changes materially we will say so on this page and date the change. Continuing to use the platform after that date is how the new version takes effect for you.
Contact
Questions about this policy, or a request about your data: info@watersci-platform.com.