Privacy
A consent product has to go first.
LTC asks companies to be specific about what they collect. Here is LTC being specific.
What leaves your device
Only when you turn remote analysis on. This is the complete list of fields — it is the actual request schema, not a summary of it:
| Field | Example | Why |
|---|---|---|
| siteDomain | example.com | To find the company’s agreements. Registrable domain only. |
| action | accept | What you are being asked to do. |
| subjects | cookies_advertising | What is being consented to. |
| surface | cookie_banner | The kind of screen. |
| linkedPolicies | /legal/privacy | The site’s own published policy links. |
| metrics | { acceptControlCount: 1 } | Counts and ratios. Numbers only. |
| controlSummary | { role, area, contrast } | Control shapes and sizes. Labels are stripped on your device. |
What never leaves, in any circumstance
- The page URL. Paths and query strings routinely contain identifiers, search terms and tokens.
- Page text. Not the article, not the message, not the document.
- Anything you type. Form values are never read.
- Passwords, card fields, session cookies and authentication tokens.
- Your browsing history. LTC does not keep one, on your device or ours.
This is enforced in code, not policy. The request has no field capable of carrying page content, and an automated test builds a page full of sensitive strings, runs the real detector over it, and fails the build if any of them appear in what would be sent.
The Consent Vault
Off unless you turn it on. When it is on, LTC records what you agreed to, when, and which version of the agreement was in force. Notes you write are encrypted at rest with a key derived per record.
LTC does not record what you clicked unless the decision was directly observable and you asked it to. It does not guess.
Deletion
LTC warns you when a company keeps your data after you close your account. Its own deletion is immediate and complete: no soft delete, no tombstone, no retained copy. You get an itemised receipt of exactly what was removed.
The single exception is one audit row recording that a deletion happened, containing your former account identifier and nothing else. Without it, LTC could not answer a regulator asking whether a deletion request was honoured.
This website
- No analytics. No tag manager. No advertising pixel. No third-party script of any kind.
- Fonts are served from this domain. Nothing is fetched from a font CDN, which would leak your IP address to a third party on every page load.
- There is no cookie banner here because there is nothing to consent to.
How LTC makes money
Subscriptions, and only subscriptions. LTC does not sell consent histories, does not take money from companies to change findings, and does not carry advertising. Those are not preferences; they are commitments in the Trust Charter, and the free tier keeps every capability that actually protects you so the incentives cannot drift. During Early Access there is nothing to buy: LTC is free and no payment information is collected at all.
The formal notice
Everything above is what LTC does. This section is the same thing in the shape a data protection regulator asks for.
Who is responsible
LTC, contactable at privacy@ltc.maib.io. LTC is in Early Access and is not yet operated by an incorporated entity; the registered company name, address and any data protection representative will be named here before general availability. If that matters to your decision, it is a reason to wait rather than something we would rather you did not notice.
What is collected, and why
| Category | Where from | Purpose | Basis | Kept for |
|---|---|---|---|---|
| Consent-event classifications | Extension, only with remote analysis on | To find the agreement that governs the decision in front of you | Your consent, given by switching it on | Not retained against you; aggregated coverage counts only |
| Text you paste into /check | Website | To analyse it and show you the result | Your consent, given by pressing the button | Not stored. Analysed in memory and discarded |
| Account email and password hash | Website, if you create an account | To sign you in | Performance of the service you asked for | Until you delete the account |
| Consent Vault records | Extension, only if you turn the Vault on | To show what you agreed to and which version governed it | Your consent | Until you delete them, or the account |
| Feedback reports | Extension or website, when you send one | To fix what LTC got wrong | Legitimate interest in the product working | Until the issue is resolved |
| Server logs | Automatic | Security, and finding faults | Legitimate interest in a service that stays up | 30 days |
| Published agreements | Companies’ own public websites | So LTC does not re-read the same terms for every user | Legitimate interest; these are public documents, not your data | Indefinitely, with their source and retrieval date |
Who else sees it
Nobody. LTC runs on infrastructure it operates, in the United Kingdom. There is no analytics provider, no advertising network, no customer-data platform, and no third-party model provider in the request path — the model provider is configured off in production, so no content you send is passed to an external model. If that changes, this section changes first.
Where it goes
Data is processed in the United Kingdom and is not transferred outside it. The only external service any request touches is the certificate authority that issues this site’s TLS certificate, which sees the domain name and not you.
Your rights
You can ask for a copy of what LTC holds about you, correction of anything wrong, deletion of all of it, and a machine-readable export. If you created an account, your privacy page does the export and the deletion immediately and without asking you why. If you did not create an account, LTC holds nothing that identifies you.
Where processing rests on your consent you can withdraw it at any time by switching remote analysis or the Vault off, and that takes effect immediately rather than at the end of a billing period.
Automated decisions
LTC analyses documents automatically and shows you what it found. It does not make any decision about you, does not profile you, and does not produce any score, rating or eligibility outcome attached to you. It never accepts or declines anything on your behalf.
Children
LTC is not directed at children and accounts are for people aged 16 or over. LTC does not knowingly collect data from anyone younger; if you believe it has, write to privacy@ltc.maib.io and it will be deleted.
Security
Transport is HTTPS only, with HSTS. The database is not reachable from the internet and the connection to it is encrypted. Vault notes are encrypted at rest with a key derived per record. Secrets are held outside the code and are never written to logs. Report anything you find to security@ltc.maib.io.
Complaints
Tell us first at privacy@ltc.maib.io — we would rather fix it. You also have the right to complain to your data protection authority; in the United Kingdom that is the Information Commissioner’s Office.
Changes to this notice
LTC exists because companies change their terms quietly. If this notice changes in a way that materially affects you, LTC will tell you before it takes effect, and the previous version stays available.