Privacy Policy

Last updated: October 2026

This policy should be read alongside our Terms & Conditions. If you have any questions, contact us at hello@reefanalysis.com.

1. Who we are

Reef Analysis is a trading name of Ark Technology Ltd, a company registered in England & Wales (No. 11538549). We are the data controller for the personal data processed through this service. References to "we", "us" or "our" in this policy mean Ark Technology Ltd.

2. What data we collect

We collect the following categories of personal data:

• Account data — email address, full name, country, and mobile number provided during registration or in Settings.
• Tank & test data — tank names, volumes, and all water chemistry test results you upload or log (ICP reports, home test readings).
• Live sensor data — readings from connected Apex Fusion, Alkatronic, Mastertronic, KH Guardian, KH Manager, and AquaWiz devices, stored against your account.
• Device credentials — Apex Fusion, Alkatronic, Mastertronic, KH Guardian, KH Manager, and AquaWiz login credentials, stored encrypted in Supabase Vault.
• Push & widget device data — push notification tokens for your devices and, if you add a home-screen widget, a random device key that lets the widget fetch your own readings. Both are removed when you sign out on that device or delete your account.
• Usage data — page views, feature interactions, and session metadata collected via Pendo.io to help us improve the product.
• Technical data — IP address, browser type, and device information collected automatically by our hosting provider (Vercel).

3. How we use your data

• To provide and operate the Reef Analysis service.
• To authenticate your account and keep it secure.
• To sync live sensor data on your behalf via automated background jobs.
• To keep home-screen widgets up to date with silent background updates. These show nothing on screen and are sent even if you have turned notifications off or declined notification permission; remove the widget to stop them.
• To parse ICP test reports using AI (Anthropic Claude API) — uploaded files are processed and discarded; only the parsed results are stored.
• To send transactional emails (email verification, password reset) — no marketing emails without your consent.
• To analyse product usage and improve features via Pendo.io.
• To investigate and resolve errors or support requests.

4. Legal basis (UK GDPR)

• Contract — processing necessary to deliver the service you signed up for (Art. 6(1)(b)).
• Legitimate interests — product analytics, error logging, and service security (Art. 6(1)(f)).
• Legal obligation — where we are required to retain data by law (Art. 6(1)(c)).

5. Third-party services (sub-processors)

We use the following sub-processors to deliver the service:

• Supabase, Inc. (database, authentication, encrypted secret storage) — data hosted in the EU (Frankfurt region).
• Vercel, Inc. (application hosting, serverless functions, CDN) — global edge network; primary processing in the EU and US.
• Anthropic, PBC (US) — AI-powered parsing of ICP test PDFs and images. Files are processed transiently and not retained for model training under our API agreement.
• Resend (transactional email delivery) — used for verification, password reset, billing, and welcome emails.
• Stripe Payments Europe Ltd (when paid subscriptions are active) — payment processing. Card details are submitted directly to Stripe and are not stored by us.
• Pendo.io, Inc. (EU residency) — product analytics and in-app guidance. Pendo is configured to operate cookie-free and does not set any non-essential storage on your device. Pendo processes the visitor and usage events we send it under their own privacy policy.
• cron-job.org — triggers our scheduled background jobs over HTTPS using a shared secret. No personal data is sent in the trigger.
• Apple Inc. and Google LLC — distribute the native iOS and Android applications via the App Store and Google Play respectively, including app analytics and crash reporting where enabled.
• Connected-device platforms — when you provide credentials, we fetch your data on your behalf from: Neptune Systems / Apex Fusion (US), Focustronic (HK, for Alkatronic and Mastertronic), Reef Kinetics / KH Guardian (US), Kamoer / KH Manager (CN), AquaWiz. These are not sub-processors acting for us — they are independent controllers of your data on their platforms.

We review this list as the service evolves. Material changes to our sub-processor list will be communicated under Section 10 (Changes to this policy).

5a. International transfers

Where personal data is transferred outside the United Kingdom, we rely on the following safeguards to ensure an essentially equivalent level of protection:

• Transfers to the United States (Anthropic, Vercel for US edge, Stripe US affiliates) — the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supplemented where applicable by the participation of the US importer in the UK-US Data Bridge / EU-US Data Privacy Framework.
• Transfers within the EEA (Supabase EU, Pendo EU, Stripe Europe, Resend) — covered by the UK adequacy decision in respect of the EEA.
• Transfers to other jurisdictions (Focustronic in Hong Kong, Kamoer in China, when you connect those devices) — these are initiated by you when you provide credentials and are direct transfers between you and the device platform. We are not the data exporter for those transfers; they occur under the platform's own terms.

You may request a copy of the specific transfer mechanism used for any of the above by emailing hello@reefanalysis.com.

6. Data retention

We retain personal data for the periods set out below, after which it is deleted or anonymised in line with UK GDPR Art. 5(1)(e) (storage limitation):

• Account data, tank data, ICP/home-test data, live sensor data, user preferences: for as long as your account remains active, and for up to 30 days after you ask us to delete your account or your account is closed by us.
• Inactive accounts: if you have not signed in for 24 consecutive months, we may close your account on at least 30 days' email notice and delete the associated data within 30 days of closure.
• Device credentials (stored encrypted in Supabase Vault): deleted within 30 days of you removing the device configuration or closing your account, whichever is sooner.
• Error logs, audit logs, and security logs: retained for up to 18 months for security investigation and service-improvement purposes, then deleted or anonymised.
• Transactional email metadata at Resend (delivery status, opens): retained by Resend in line with their policy, up to a maximum of 12 months from send.
• Billing records and Stripe payment records (when paid subscriptions are active): retained for 7 years to comply with UK tax and accounting law (Companies Act 2006, VAT Act 1994).
• Records required by law or to establish, exercise, or defend legal claims: retained for as long as necessary for that purpose, generally not exceeding 6 years (Limitation Act 1980).

You can delete individual tanks (which cascades to all associated test, event, and sensor data) at any time. To delete your entire account and all associated data, go to Settings → Delete Account within the app. We will send a confirmation link to your email address; clicking the link in that email permanently deletes your account immediately. If you cannot access the app, email hello@reefanalysis.com with the subject line Delete my account and we will action verified deletion requests within 30 days.

7. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.

To exercise any of these rights, email hello@reefanalysis.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) .

8. Cookies and local storage

We do not set any non-essential cookies, and we do not require a cookie consent banner under PECR Regulation 6. Our analytics provider Pendo.io is configured to operate without any cookies and without setting any non-essential storage on your device. No tracking, advertising, or third-party-analytics cookies are set by this service.

Strictly-necessary browser storage we do use:

• Authentication session — required for you to remain signed in. Provided by Supabase Auth.
• UI preferences (browser localStorage) — selected tank, dashboard tile layout, view-mode toggles, chart range and time range selections, and similar in-app settings. These persist your choices between visits and are used by us purely to operate the service as you have configured it. Many of these settings are also synced to your account in user_preferences so they follow you between devices; full list maintained in our codebase.

Under PECR Reg 6(4), storage that is strictly necessary for the provision of a service requested by you does not require prior consent. The items above fall within that exemption.

9. Security

All data is transmitted over HTTPS. Passwords and device credentials are never stored in plaintext — credentials are encrypted at rest using Supabase Vault. We apply row-level security so your data is only accessible to your own account.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice. Continued use of the service after changes constitutes acceptance of the updated policy.