Privacy Policy
Last updated 12 October 2026.
This policy explains what EngSec LLC does with personal data in connection with Concentration Chart. It is short because the Service is built so that we receive very little. EngSec LLC is the controller for the data described below.
What we do not collect
We do not receive the files you use with the Service. Board images, placement data, failure records, serial numbers, technician notes and the reports generated from them are processed entirely in your browser and are never transmitted to us. This is enforced by the application's content security policy, not only by our practices — see the security model, which explains how to verify it yourself in about a minute.
The application contains no analytics, no telemetry and no error reporting, and sets no cookies.
Storage on your own device
The application stores a few things in your browser's own storage (local storage and IndexedDB) so it can remember them between visits. These stay on your machine and are never sent anywhere:
| What | Why | How to remove it |
|---|---|---|
| Board calibration | So a photo you lined up once stays lined up | Clear site data in your browser |
| Licence key, if you have one | To enable your plan without a login | Remove it from this machine (no sign-in needed — there is no account) |
| Boards you choose to keep — board image, placement file, dimensions, calibration and criticality config | So a repeat analysis does not mean re-uploading the same board | "Remove all" in the app, or remove one at a time |
| Failure records kept on this machine — rows entered at the bench or brought in from a data bundle: designator, failure type, date and time, station, board and revision, and any serial number or note typed with them | So a station's history builds up across shifts and can be charted for any period, without a server | Delete one board's records or "Remove all records" in the app, or clear site data in your browser. "Export data bundle" saves a copy first. |
| Customer profile, if you load one — your failure-type names, entry keys, repair vocabulary, defect codes, shift times and component classes | So this station classifies failures in your vocabulary on every visit | "Use default" in the app, or clear site data in your browser |
| The demo's records, if you open the demo — about 90 days of synthetic failure history for the demo board, plus any rows you type on it | So the demo behaves like a station with a real history behind it | The × on "Demo data" in the app, "Remove all records", or clear site data in your browser |
Kept failure records work the same way: they are written to this browser's own storage on the machine where they were entered, never transmitted to us or to anyone else, and they do not sync between machines — a data bundle file is how a station's history moves, and only when you export one. Records you load from an export file are read for that session and not kept.
The demo's history is synthetic, and demo rows are kept apart from real ones: they are charted only in the demo, never written into a data bundle, and demo rows found in a bundle are refused on import.
Keeping a board is something you choose to do, never automatic, and what it stores is the same data you loaded — it stays on that machine and is not sent to us or synced to anyone else. On a shared or shop-floor computer, treat a kept board the way you would treat the files themselves, and use "Remove all" when you are finished.
Because we set no cookies and run no analytics, there is no cookie banner and nothing to opt out of.
What we do collect
| Data | Why | Legal basis (UK/EU) |
|---|---|---|
| Your name, email and message when you contact us | To answer you and keep a record of the correspondence | Legitimate interests; performance of a contract |
| Subscriber details: name, work email, organisation, country | To provide and administer a subscription and issue a licence | Performance of a contract |
| Billing details, collected and held by Stripe | To take payment and meet accounting obligations | Contract; legal obligation |
| Standard web server logs (IP address, request, user agent) | Security and reliability of this website | Legitimate interests |
We never see or store card numbers: payment details go directly to Stripe.
If you choose to send us a sample export file so we can support a format, please remove anything sensitive first. We use such samples only to build and test format support, and we will delete one on request.
Sharing
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with the providers listed on our sub-processors page, with professional advisers under confidentiality, where required by law, or in connection with a merger or sale of the business (in which case this policy continues to apply until you are told otherwise).
Retention
- Correspondence — kept while it is useful for supporting you, then deleted.
- Subscriber and billing records — kept while the account is active and afterwards for as long as tax and accounting rules require, up to seven years.
- Website logs — kept for a short period for security purposes.
Security
The best protection we offer is architectural: the data most worth protecting never reaches us. For what we do hold, we use reputable providers, encryption in transit, access limited to those who need it, and multi-factor authentication on the accounts that matter. If a breach affects your personal data we will notify you and any relevant regulator without undue delay.
Your rights
Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. If you are in the UK or EEA you may complain to your supervisory authority. If you are a California resident you may request disclosure of the categories of personal information we collect, request deletion or correction, and you have the right not to be discriminated against for exercising those rights — and note that we do not sell or share personal information as those terms are defined by the CCPA.
To exercise any right, write to info@engsecsolutions.com. We will respond within one month and will not charge you for a reasonable request.
International transfers
Our providers may process data outside your country, including in the United States. Where that happens we rely on the transfer mechanisms those providers make available, such as standard contractual clauses. This concerns account and correspondence data only: your board data does not leave your machine, so it is never transferred anywhere.
Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Changes and contact
We will update this policy as the Service changes and will note the date above; we will tell subscribers in advance of material changes. Questions, or to request a data processing agreement: info@engsecsolutions.com. See also our data processing terms.