Legal
Privacy Policy
Last updated: 13 June 2026 · State6 Prep · state6.co.uk
Plain English summary
This Privacy Policy explains how State6 Prep collects, uses, stores and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
State6 Prep is operated by State6 Prep Limited, a company incorporated in England and Wales, acting as data controller for the purposes of applicable data protection law. State6 Prep is registered with the Information Commissioner's Office (ICO). Our ICO registration number is ZC138846. Contact for all privacy and data protection matters: hello@state6.co.uk
2. Personal Data We Collect
We collect only the information reasonably necessary to provide and operate the service.
Account Data
Email address. Authentication credentials (stored in encrypted or hashed form via Clerk). Account status, rank pathway selection and access period information.
Purchase Data
Selected plan type and purchase date. Access expiry date and AI credit balances. Transaction reference identifiers. We do not store payment card details. All payment processing is handled securely by Stripe.
User Content
STARR evidence entries and PEEL preparation content. Portfolio material, evidence notes and preparation records. AI prompt submissions and coaching session content. Exported portfolio content.
Technical and Security Data
IP address, browser type, operating system and device information. Session information, login timestamps and authentication logs. Basic usage analytics used to maintain platform stability, detect misuse and improve security.
Communications Data
Support emails, customer service enquiries and feedback submissions.
3. Anonymisation Requirement
State6 Prep is designed for anonymised promotion preparation content only. Users must not upload or enter operational policing information, intelligence, protectively marked material, safeguarding content, identifiable personal data, confidential force information, information relating to live investigations, or any content capable of identifying a living individual. Users are responsible for ensuring all content entered complies with their force policies, professional standards, confidentiality obligations, UK GDPR and the Data Protection Act 2018.
4. Lawful Bases for Processing
Contract Performance
We process personal data where necessary to provide the services you have purchased, including providing platform access, managing accounts, processing payments and providing support.
Legitimate Interests
We process certain data where necessary for our legitimate interests in maintaining platform security, preventing fraud and misuse, and improving platform reliability, provided those interests are not overridden by your rights and freedoms.
Legal Obligations
We process data where necessary to comply with legal obligations, including maintaining accounting and tax records and responding to lawful requests from authorities.
5. How Your Content Is Used
The STARR examples, PEEL responses, evidence entries and portfolio content you create remain your content. We do not make your content visible to other users, share it with police forces or employers, or use it to train public AI models. Your content may be accessed by authorised State6 Prep personnel only where reasonably necessary for operational support, security maintenance or legal purposes.
6. AI Processing
When you use AI-supported functionality, your prompts and related content are securely transmitted to Anthropic's API for the purpose of generating AI-assisted coaching responses. Anthropic acts as a data processor in this context. Under our API arrangements, content submitted through State6 Prep is not used to train Anthropic's public AI models. AI-generated outputs may be inaccurate, incomplete or inappropriate and must always be independently reviewed, personalised and verified before use.
Voice features (Mock Board and voice input). When you speak an answer, your speech is streamed in real time to Deepgram, who act as a data processor to convert it to text. Audio is processed transiently for transcription and is not stored as a recording — by State6 Prep or by Deepgram on our instruction. Only the written transcript is retained, saved privately to your account alongside your feedback, where you can review or delete it at any time. The panel voices you hear are synthesised by ElevenLabs from text we provide; your voice, audio and personal data are never sent to ElevenLabs. Transcripts of spoken answers are assessed by Anthropic's API under the same terms as written content above.
Your scores, debriefs and coaching are decision support, not automated decisions producing legal or similarly significant effects. Every AI output is advisory, generated for your own review, and you stay in control of whether and how to use it. You can request a human review of, or contest, any AI-generated assessment by emailing hello@state6.co.uk.
7. Third-Party Providers
We use the following carefully selected third-party providers to operate the platform. We do not sell personal data to any third party.
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Stripe | Payment processing | stripe.com/gb/privacy |
| Clerk | User authentication | clerk.com/privacy |
| Anthropic | AI coaching processing | anthropic.com/legal/privacy |
| Deepgram | Real-time speech-to-text for voice features (audio not stored) | deepgram.com/privacy |
| ElevenLabs | Panel voice synthesis (no user data sent) | elevenlabs.io/privacy |
| Supabase | Database and data storage | supabase.com/privacy |
| Vercel | Website and application hosting | vercel.com/legal/privacy-policy |
| Resend | Transactional and service emails | resend.com/legal/privacy-policy |
| PostHog | Product analytics (EU region) | posthog.com/privacy |
8. International Data Transfers
Some of our third-party providers process personal data outside the United Kingdom. Anthropic (AI prompts), Deepgram (streamed speech for live transcription) and Resend (email addresses for service emails) process data on infrastructure primarily located in the United States. PostHog analytics is hosted in the European Union. We rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses (and, where applicable, UK adequacy or data-bridge arrangements), together with each provider's data-processing terms, as the safeguard for transfers outside the UK in accordance with UK GDPR.
Data sovereignty note
State6 Prep is designed for fully anonymised reflective practice and evidence preparation. To ensure your use is consistent with your force's policies, follow the anonymisation guidance in these terms: no names, no case references, no operationally sensitive detail.
9. Data Security
We use reasonable technical and organisational measures to protect personal data against unauthorised access, misuse, loss or disclosure, including:
- Encryption in transit using TLS and HTTPS.
- Encrypted data storage where supported by our infrastructure providers.
- Authentication controls managed through Clerk.
- Row-level access controls in Supabase.
- Restricted administrative access.
- Monitoring and security logging.
- Regular backups.
No internet-based service can guarantee absolute security. In the event of a personal data breach we will notify the ICO and affected users within the timeframes required by applicable law.
10. Data Retention
Active Accounts
Account and content data is retained while your account remains active.
Closed Accounts
Account data and associated user content is normally deleted within 30 days of confirmed account closure. Backup copies of data are purged on a rolling 30-day cycle, meaning residual backup data is fully removed within 60 days of account closure.
Financial Records
Transaction and accounting records are retained for up to seven years to comply with legal and tax obligations.
11. Your Rights
Under UK GDPR and the Data Protection Act 2018 you have the following rights:
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to request correction of inaccurate or incomplete data.
- Right to erasure — to request deletion of your data in certain circumstances.
- Right to restriction — to request that we limit how we process your data in certain circumstances.
- Right to object — to processing based on legitimate interests.
- Right to data portability — to receive your data in a commonly used machine-readable format.
- Right to withdraw consent — where processing is based on consent.
To exercise any of these rights, email hello@state6.co.uk. We will respond within one calendar month.
How to Request Account Deletion
To close your account and request deletion of your data, email hello@state6.co.uk with the subject line "Account Deletion Request" and the email address associated with your account. We will confirm deletion within 30 days.
12. Cookies
State6 Prep uses a small number of essential cookies necessary to operate the platform, manage sessions and remember your cookie preference. We do not use advertising cookies, tracking cookies or third-party behavioural analytics. Full details are set out in our Cookie Policy, accessible from the footer of the website and platform.
13. Complaints
If you are unhappy with how we handle your personal data, please contact us at hello@state6.co.uk in the first instance. If you remain unsatisfied, you have the right to complain to the Information Commissioner's Office: ico.org.uk · Telephone: 0303 123 1113
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to the platform, our practices or applicable law. The latest version will always be published on the platform with the date it was last updated.
15. Contact
hello@state6.co.uk · State6 Prep Limited · state6.co.uk