What is held, and for how long
Last reviewed 26 September 2026. Version 3.7+1.5-6ab85176b5c5.
This page is the whole list. If something is not on it, this product does not hold it.
It is short because of a decision taken before anything was built: nothing about a check is stored. Not the advert, not the corrected advert, not the record, not the reference number. The PDF you download is the only copy that exists, and nothing here can produce a second one.
The advert you paste
Held in your browser while you are looking at it. When you close the tab it is gone.
A check sends it to our server function, which reads it against the rule set and then sends it to a model API so it can be read against the rules a person has to judge. The answer comes straight back to the tab that asked for it. It is not written to any store on the way past. Where inference happens is set out in the data processing agreement.
The corrected advert, the record and the reference number
Not held at all.
Every check produces a record, and it goes into the PDF and onto your screen. It is not written to a durable store, here or anywhere. That has one consequence worth stating plainly:
We cannot reissue a check record, and we cannot look up a reference number. The reference ties the PDF to the advert because both carry it, not because we hold a copy.
There is no "find a check" screen, and there never will be one, because there would be nothing behind it.
Since the PDF is the only copy, it is signed, so that it can be shown later to be the document we produced rather than one somebody edited. Signing it means your browser sends us a 64 character fingerprint of what is printed on it and we send back a signature. Nothing is stored to do that, at either end: no row, no counter, no log line. It is the reason this page did not have to change when signing was added, and the reason we still cannot look a reference up.
What is held
| What | For how long | What is in it |
|---|---|---|
| An operations log | 30 days, then deleted automatically | Counters and timings. No advert, no excerpt, no job title |
| The console settings, and every change to them | Until changed | Numbers and switches an operator set |
| House checks | Until changed | Wording an operator wrote themselves |
| Licences | Until they expire, then kept as a record of the sale | A plan, an address, a date, and a digest of the key |
| The allowance ledger | Until reset | A one way digest of a connection, a count, and the month it belongs to |
| The hourly count | Until the connection's next check in a later hour replaces it | The same one way digest, the hour, and a number |
| What was run on a licence | As long as the licence exists, then deleted with it | A date and time, a connecting IP address, the browser's own description of itself, and what the check was asked to do |
| Reports | Until acted on and deleted | The reason, any note, where it was pressed and the advert's reference; on a flag, the passage it fired on and the rule |
| Questionnaire answers | Until deleted on request | A name, an email address, an organisation's name if given, answers from fixed lists, and the context described below |
| Faults flagged on the development site | Until acted on and deleted | Notes written by whoever runs the instance |
| API keys | Until revoked, then kept as the record of the key | The key's name, the licence it belongs to, its first few characters and a hash of it, its dates, whether it is switched on, and its hourly limit |
| The API log | 30 days, then deleted automatically | One entry per API request: the time, the key, what was asked for, the answer's status and code, how long it took and where the time went, token counts and the advert's length. No advert, no excerpt, no hash of an advert, no IP address |
The operations log
One entry per thing that happened: a check completed, a check failed, a check refused, a screen opened, a control pressed. Every entry is rebuilt on the server from a list of fields named in the code, and a field that is not on that list is dropped whole. That is why the log has no field for an advert, an excerpt or a job title: it is not that we remember to leave them out, it is that there is nowhere for them to go.
An entry carries the connecting IP address, which is personal data under UK GDPR. It is held on the same footing as a web server access log and for the same reason: it is where overuse and probing show themselves. Everything is deleted after thirty days, automatically, and an operator can delete a day at any time.
The allowance ledger
This product has no accounts, so the count of checks is held against the connection. What is stored is a one way digest of it and never the address, so the ledger cannot be read back into a list of visitors. It exists to meter, not to know anybody. Beside the count it holds the month the count belongs to, which is how the count goes back to nothing at the start of each month.
The hourly count
However many checks a connection has, it can start only so many in one hour, so that a program posing as the page cannot run the check without end. Beside the ledger there is one small entry per connection: the same one way digest, the hour, and how many checks have started in it. It is replaced, not added to, when the hour changes, so it never grows into a history.
Before a check starts, the page asks for a pass: a signed time limit, tied to the connection, that says the check came from the page. The pass is checked and thrown away. It is not stored anywhere.
What was run on a licence
A licence is sold by the month, so the checks it has run have to be counted somewhere, and whoever bought it has to be able to answer "how many are left" and "what has this key actually been used for". One entry per check: when it was run, the connecting IP address, the description the browser gives of itself, whether the advert was the advertiser's own or a client's, how deep the check went, whether it came from a handheld, and how many characters long the advert was. Like the operations log, it is built from a list of fields named in the code, so there is no field for an advert, an excerpt or a job title, and no field for the licence key, which is held nowhere at all.
This is held for longer than anything else on this page. An entry stays for as long as the licence exists, the IP address and the browser description included, rather than expiring after thirty days the way an operations log entry does. It is kept that long so that a licence shared between several people has an audit trail that can still be read a year later, which is what an account holder gets on every other product and what a shared key otherwise has no substitute for. It is a deliberate choice and this paragraph is where it is disclosed.
A backup taken in the console contains all of it: every licence, every check recorded against each of them, and the record of any that were deleted. The file is encrypted with a passphrase the operator types and nothing else holds, and it is a file rather than a store, so it sits outside these retention windows for as long as whoever made it keeps it.
Deleting a licence in the console deletes everything ever recorded against it, immediately and without a copy. It does not reach a backup file made before the deletion, which is what a backup is for and worth saying plainly. Deleting is the erasure route for this store, and it is the only thing that empties it. If you hold a licence and want its history removed, write to the address below and say so.
The API
An organisation with a licence can check adverts from its own software through the API, with a key issued in the console. The API holds nothing about a check, exactly as the website holds nothing: the answer goes back on the connection that asked, and anything the caller needs for the next step travels in a sealed token the caller keeps.
Two things are held. The keys, as a hash rather than the key itself, so a copy of the store hands nobody a working key. And the API log, one entry per request, built from a list of fields named in the code, so there is no field for an advert, an excerpt, a job title or a hash of an advert, and no field for an IP address, because the key already says which organisation called. The log is what the console's API figures are worked out from, and each entry is deleted after thirty days.
Reports
This is the one exception to nothing being stored, and it is opt in. The Report button sits wherever you decide something about your advert. Pressing it and sending the form sends the reason you pick from a list, a note of up to 500 characters if you choose to write one, where on the screen you pressed it (the screen, the part of it and the item, described in the product's own names, how far down the page you were and the size of your browser window), the version of the application and the reference printed on your advert. A report about a flag also sends the passage the flag fired on, the rule it came from and what it suggested. It does not send the rest of your advert, your name or your address, and the form asks you not to put your advert or anybody's details in the note. The form says all of that before you send it. It is read so the product and the rule set can be corrected, and it is deleted from the console once it has been.
Questionnaire answers
The only place in this product holding a name or an email address. You give them by filling in a form that says a person will read them. Every answer is a choice from a fixed list, except your name, your email address, your organisation's name if you give it, a few words where you choose "other", and one box for anything else, each of limited length.
Recorded with your answers, so that we understand the situation you answered in: which allowance tier you were on, how many checks you had used and how many you had, the plan of any licence key you held, which screen you opened the form from, and whether you were on a phone or a desktop. Not your IP address, and nothing that identifies your device: those are not joined to your name. The answers are read to reply to you and to understand how job adverts are checked today, so that the product can be improved.
Ask and it is deleted; there is a button in the console that does it and nothing else holds a copy.
What we never hold
- An advert, a corrected advert, or any part of either, except the passage of a flag you chose to report, or anything you chose to write in a report's note.
- A check record, or anything that could produce one. The reference printed on your advert is held only in a report you chose to send.
- A hash of an advert. A hash is a confirmation oracle for anybody who can guess the text, so the operations log does not carry one. Your own PDF prints one, because it is yours and it is how you prove the text has not changed. The fingerprint sent to have that PDF signed is a hash of the whole record including its reference number, not of the advert, and it is not kept either.
- A password. The console and the development site are opened by a shared password set in the environment, and the session is a signed cookie that carries no password in it.
- A payment card. Nothing here takes a payment.
Complaints about how we handle personal data
If you think we have got something wrong with personal data, tell us. Every organisation that decides how personal data is used has to make complaining easy and answer properly, under section 164A of the Data Protection Act 2018, in force since 19 June 2026. This is how we do it.
How to complain. Email hello@secondlens.co.uk with "Data protection complaint" as the subject. The link starts the email for you. Say what happened, roughly when, and what you would like us to do. You do not need to send any more personal data than it takes to find what you are complaining about. If email does not work for you, say so in any way you can reach us and we will take the complaint the way that suits you.
What we do.
- We acknowledge your complaint within 30 days of receiving it, and we aim to do it within five working days.
- We look into it without undue delay, and we keep you told how it is going.
- We tell you the outcome and the reasons for it.
If the advert was checked for someone else. When an organisation uses this product for its own adverts, that organisation decides what goes into them, and a complaint about the advert itself belongs with it. We will tell you so, and help you reach them.
If you are not satisfied. You can complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk.
Asking for something to be deleted
Write to hello@secondlens.co.uk. For a questionnaire entry that is one press and it is done. For the history of a licence it is one press as well, and it takes the licence with it, so a licence still in use has to be replaced with a new key at the same time. For anything else, the honest answer is usually that there is nothing to delete, and we will say which it was.