Privacy Policy
Last updated 25 August 2026.
This policy explains what EngSec LLC does with personal data in connection with Concentration Chart. It is short because the Service is built so that we receive very little. EngSec LLC is the controller for the data described below.
What we do not collect
We do not receive the files you use with the Service. Board images, placement data, failure records, serial numbers, technician notes and the reports generated from them are processed entirely in your browser and are never transmitted to us. This is enforced by the application's content security policy, not only by our practices — see the security model, which explains how to verify it yourself in about a minute.
The application contains no analytics, no telemetry and no error reporting, and sets no cookies.
Storage on your own device
The application stores a few things in your browser's local storage so it can remember them between visits. These stay on your machine and are never sent anywhere:
| What | Why | How to remove it |
|---|---|---|
| Board calibration | So a photo you lined up once stays lined up | Clear site data in your browser |
| Licence key, if you have one | To enable your plan without a login | Remove it from this machine |
Because we set no cookies and run no analytics, there is no cookie banner and nothing to opt out of.
What we do collect
| Data | Why | Legal basis (UK/EU) |
|---|---|---|
| Your name, email and message when you contact us | To answer you and keep a record of the correspondence | Legitimate interests; performance of a contract |
| Subscriber details: name, work email, organisation, country | To provide and administer a subscription and issue a licence | Performance of a contract |
| Billing details, collected and held by Stripe | To take payment and meet accounting obligations | Contract; legal obligation |
| Standard web server logs (IP address, request, user agent) | Security and reliability of this website | Legitimate interests |
We never see or store card numbers: payment details go directly to Stripe.
If you choose to send us a sample export file so we can support a format, please remove anything sensitive first. We use such samples only to build and test format support, and we will delete one on request.
Sharing
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with the providers listed on our sub-processors page, with professional advisers under confidentiality, where required by law, or in connection with a merger or sale of the business (in which case this policy continues to apply until you are told otherwise).
Retention
- Correspondence — kept while it is useful for supporting you, then deleted.
- Subscriber and billing records — kept while the account is active and afterwards for the period tax and accounting rules require, typically six to seven years.
- Website logs — kept for a short period for security purposes.
Security
The best protection we offer is architectural: the data most worth protecting never reaches us. For what we do hold, we use reputable providers, encryption in transit, access limited to those who need it, and multi-factor authentication on the accounts that matter. If a breach affects your personal data we will notify you and any relevant regulator without undue delay.
Your rights
Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. If you are in the UK or EEA you may complain to your supervisory authority. If you are a California resident you may request disclosure of the categories of personal information we collect, request deletion or correction, and you have the right not to be discriminated against for exercising those rights — and note that we do not sell or share personal information as those terms are defined by the CCPA.
To exercise any right, write to privacy@engsecsolutions.com. We will respond within one month and will not charge you for a reasonable request.
International transfers
Our providers may process data outside your country, including in the United States. Where that happens we rely on the transfer mechanisms those providers make available, such as standard contractual clauses. This concerns account and correspondence data only: your board data does not leave your machine, so it is never transferred anywhere.
Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Changes and contact
We will update this policy as the Service changes and will note the date above; we will tell subscribers in advance of material changes. Questions, or to request a data processing agreement: privacy@engsecsolutions.com. See also our data processing terms.