Privacy statement

Last updated 13 September 2026.

1. Who we are

Scicon Systems Ltd ("Scicon", "we", "us") is a company registered in Scotland, company number SC900558, with its registered office at Tollohill Farmhouse, Banchory Devenick, Aberdeen AB12 5XN. We are the data controller for the personal data described in section 4 of this notice.

We are registered with the Information Commissioner's Office under registration reference ZC239288. For anything relating to this notice or to your personal data, contact privacy@sciconsystems.com, marked for the attention of the Data Protection Lead.

Our two different roles

Scicon acts in two capacities, and it matters which one applies to you.

As a controller — for our website visitors, our partner and prospective partner contacts, job applicants, and supplier contacts. We decide why and how that data is used, and this notice explains it.

As a processor — for personal data held inside our products on behalf of the organisation that licenses them, such as user accounts, authentication events, shared content and activity records. In those cases that organisation (or, where a partner has deployed on their behalf, their client) is the controller, they decide what is collected and how long it is kept, and their own privacy notice governs it. We process that data only on their documented instructions under a written data processing agreement. If you use a Scicon product through your employer or an IT provider and want to exercise your rights, contact them; we will support them in responding.

Content we cannot read

Two of our products are built so that we are not able to access what passes through them. In PushItPro, content is encrypted before it reaches us and we hold only ciphertext we cannot decrypt. In Volarian, documents are shared encrypted and view-only. Where that is the case we cannot produce the content in response to any request — yours, a controller's, or a lawful authority's — because we do not hold it in readable form. We can still act on the account and metadata described in section 4.

2. Scope

This notice covers sciconsystems.com, our sales and marketing activity, our partner relationships, recruitment, and our supplier relationships. It does not cover third-party websites we link to, or the privacy practices of our partners.

It also covers our consumer apps — Shopping List for iPhone and iPad, and No More Sleep for iPhone — which are sold to the public rather than to organisations and so work differently from the rest of this notice. Sections 16 and 17 explain them in full, and where the two differ, those sections are what apply to those apps.

3. Changes to this notice

We review this notice at least annually and whenever our processing changes materially. The version number and effective date at the top of this page tell you which version you are reading. Where a change materially affects you, we will tell you directly if we hold your contact details.

4. Personal data we collect

Website visitors. IP address (truncated where our analytics configuration allows), device and browser type, pages viewed, referring source, and the date and time of your visit. See section 10 on cookies.

Enquiries and partner prospects. Name, business email address, telephone number, employer, job title, and the content of your enquiry or our correspondence. Where we identify a prospective partner from public sources, this may also include publicly listed business contact details and information about the organisation's market and size.

Partner and customer contacts. Contact and role details, records of meetings, support tickets, training and certification records, and the commercial correspondence necessary to run the relationship.

Product users. Account name, business email, role and permissions, authentication events, and a record of actions taken in the product — for example that a secret was created, opened or expired, or that a document was viewed. Where the product is zero-knowledge, this metadata is what we hold; the content itself is not readable by us. As set out in section 1, we hold all of this as a processor.

Job applicants. The information in your application, right-to-work evidence, interview notes and references.

Supplier contacts. Name, business contact details and payment details where the supplier is an individual or sole trader.

We do not seek special category data (such as health or biometric data), and we ask that you do not send it to us. We do not knowingly collect data about children. The services described in this section are sold to organisations; our consumer apps are sold to the public and are covered by sections 16 and 17, which describe separately what each of them collects.

5. Where we get it

Directly from you, when you contact us, apply for a partnership, attend an event, subscribe to updates, or use a system we support. From our partners, where they introduce you as a contact for a deployment. From publicly available sources such as company websites, Companies House and professional networking sites, when we research prospective partners. Automatically, from your device when you visit our website.

6. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have carried out a balancing assessment and you can ask us for a summary of it. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

7. Who we share it with

We share personal data with service providers who act on our instructions — hosting and infrastructure, email, and professional advisers — each under a written contract that limits what they may do with it. We share partner contact details with a partner's own account team where that is necessary to run the relationship. We disclose data to regulators, law enforcement or courts where we are legally required to. If Scicon is involved in a merger, acquisition or sale of assets, data may transfer to the acquiring entity under the same protections.

We do not sell personal data, and we do not share it with advertising networks for their own purposes.

Our sub-processors

We give 30 days' notice before adding a sub-processor, and a controller may object. This list is maintained because partners and procurement teams ask for it, and having it ready shortens their review.

8. International transfers

Our products and business data are hosted in the UK, with the exception of identity and authentication data, which Clerk processes on US infrastructure. Cloudflare, Neon and Resend each support regional configuration options, which we use to keep processing within the UK. Where a supplier processes data outside the UK, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us which mechanism applies to a particular transfer.

9. How long we keep it

At the end of a retention period we delete the data or irreversibly anonymise it. Suppression lists are the deliberate exception: we keep the minimum needed to make sure we do not contact you again.

10. Cookies and similar technologies

We use strictly necessary cookies to make the site work; these do not require consent. Any analytics, preference or marketing cookies are set only after you consent, and you can change or withdraw that choice at any time through the cookie settings link in the footer.

11. Marketing

We market to business contacts at organisations we believe have a relevant interest. Every message identifies Scicon Systems, explains where we found your details, and carries a one-click unsubscribe. You can opt out at any time by using that link or by emailing privacy@sciconsystems.com, and we will action it promptly and permanently.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not carry out profiling of that kind.

13. Security

We apply technical and organisational measures appropriate to the risk. Where the architecture allows it we go further and design ourselves out of access altogether, as described in section 1. Across the portfolio this includes encryption in transit and at rest, role-based access control, multi-factor authentication on administrative accounts, least-privilege access, logging and monitoring, supplier due diligence, staff training, and a documented incident response process. Where we are a processor and become aware of a personal data breach, we notify the relevant controller without undue delay so that they can meet their own obligations.

14. Your rights

Under the UK GDPR you have the right to be informed; to access a copy of your personal data; to have inaccurate data corrected; to have data erased in certain circumstances; to restrict processing; to data portability; to object to processing based on legitimate interests; and to object to direct marketing at any time, without exception.

To exercise any of these, email privacy@sciconsystems.com. We will respond within one month and will tell you promptly if we need to extend that for a complex request. We may ask for information to confirm your identity. There is no charge unless a request is manifestly unfounded or excessive.

If you use a Scicon product provided by your employer or an IT provider, please direct your request to that organisation, since they are the controller. Tell us if you are unsure who that is and we will point you to them.

15. Complaints

Please raise any concern with us first — we would rather fix it. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

16. Shopping List Family & Sending Outside the Family

Shopping List is an iPhone and iPad app published by Scicon Systems Ltd. This section explains what it does with your information. The short version: your list stays on your phone; nothing is sent anywhere unless you choose to send it; there is no account, no analytics, no advertising and no tracking.

What stays on your device

Your shopping list, your saved recipes, your allergy settings (which of the fourteen allergens you have switched on, whether each is an allergy or a sensitivity, and any words you added yourself), your reading preferences, your acceptance of the app's terms and the count of free recipe reads are all stored on your iPhone or iPad only. They are not sent to us and we hold no copy. Deleting the app deletes them.

No account

The app has no sign-in. We do not know who you are, and we do not collect your name, email address, phone number or contacts.

Voice entry and reading aloud

Turning what you say into list items uses Apple's speech recognition, on the device wherever your iPhone supports it; on an older iPhone Apple's speech service may process it under Apple's privacy policy. Reading a list or recipe aloud uses the iPhone's own voice. The app never sends audio anywhere itself.

Sending a list as a message

"Send list" hands the list, as plain text, to the iOS share sheet. It travels through whichever app you pick (Messages, WhatsApp, email) to the person you choose. Any allergy warning lines on the list are part of that text. We never receive it.

Sending a list to a person who has the app (optional)

If the person who does your shopping also has Shopping List, you can pair your phones once and then send lists and recipes straight to their app. This is optional; the app is complete without it, and it makes no contact with our server until you first pair with someone or open an invitation you were sent.

When you do use it, this is what happens. The app creates a pair of keys inside your phone's Secure Enclave; the private key never leaves the phone and is not included in backups. Pairing exchanges public keys, in person by scanning a code on the other phone's screen, or by an invitation sent as a message. The card you exchange also states whether your device holds the Shopping List Family purchase, so that the other phone can work out whether sending to you is already covered or needs the yearly subscription. It says nothing else about your account, and it does not tell anyone who bought it or who is in your family. Everything you send, and everything that comes back, is encrypted on the phone to the other person's key before it leaves: the list and its amounts, any allergy warnings, the ticks as they shop, changes you make afterwards, decisions either of you records about an allergy warning, and any recipe you send. The name you choose to be shown as is inside that encrypted content too.

The encrypted messages pass through a server we run on Cloudflare's network so that they reach the other phone. That server cannot read them: it holds no key that could open them. What it does hold is:

• the encrypted messages themselves, until the other phone has collected them, at which point they are deleted, or for a maximum of 30 days;
• for each phone that has paired, a mailbox identified by a code derived from that phone's public key. This code is not your name, number, email or Apple Account, and it is not linked to any of them; it identifies a mailbox, not a person. A mailbox that has not been used for twelve months is deleted, and "Stop sharing with everyone" in the app deletes it immediately along with the keys on your phone.

The server keeps no record of message contents or of your internet address, runs no analytics, and does not know the names you or your contacts use. Request rates are limited to protect the service, and nothing about that is retained.

The camera

The app asks to use the camera only if you choose to scan another person's pairing code, and it uses it only to read that code. No picture is taken, stored or sent.

Recipes from the web

When you save a link, the app fetches that page directly from the website you chose, and its picture from wherever the page points. The request identifies the app by name and carries nothing about you. We receive nothing.

Reading recipes with your own Anthropic key (optional)

Photos, videos and web pages are read on the device, by Apple's on-device model or the app's own rules. Only if you have bought Shopping List Family and choose to enter your own Anthropic API key are the photos or video frames you picked, the text read from them, a video's transcript, or the text of a web page sent to Anthropic (api.anthropic.com) to be turned into a recipe. Anthropic retains what it receives for a period for abuse monitoring under its own terms, which you should read at anthropic.com/legal. This path is optional, adds nothing that Shopping List Family does not already include, is billed to you by Anthropic and not through the app, and the app is fully functional without it. Your key is stored in your device's Keychain, on that device only, is never synced to iCloud, is never seen by us, and is sent only to Anthropic as the credential for your own account. Your allergy settings and your shopping list are never sent to Anthropic.

Purchases

Shopping List Family is a single payment; Sending Outside the Family is a yearly subscription. Both are bought through Apple. Apple handles the payment, and we do not receive your payment details or know who has bought anything. Apple's Family Sharing may pass a purchase to the rest of your family group; that is done by Apple, and we are not told who is in it.

Reporting a problem

"Report a problem" opens an email in your own mail app, prefilled with the recipe's title, where it came from, which reader read it, and the app and iOS version. You can see and delete any of it before sending. The app itself sends nothing.

Children

The app is not directed at children and collects nothing that would identify anyone.

Questions

Write to privacy@sciconsystems.com. Scicon Systems Ltd is the data controller; the company's registered office and number are in section 1 of this notice and at the foot of this page.

17. No More Sleep app

No More Sleep is an iPhone app published by Scicon Systems Ltd. This section explains what it does with your information. The short version: it has no account, no adverts and no tracking, it sends nothing anywhere, and everything it holds stays on your iPhone.

Nothing is sent anywhere

The app has no server of its own and makes no network connections. There is no sign-in and no account, so we do not know who you are. We do not collect your name, email address, phone number or contacts, and we receive nothing at all about how you use the app. There is no analytics, no crash reporting, no advertising and no third-party code of any kind in the app.

What is stored, and where

Everything below is kept on your iPhone only, inside the app's own storage, and is deleted when you delete the app:

• your alarms: the time, which days they repeat, the label you gave them and the difficulty;
• the sounds you add: a recording you made, or an audio file you imported, held as an audio file;
• the objects you set up for the photograph test: a small picture of each, and a mathematical summary the app uses to recognise it again;
• a record of each time an alarm rang: when it went off, when you got up, how many attempts it took, which object you photographed, and whether you used the escape hatch. This is what the morning report and the streaks are worked out from;
• a plain-text log of alarms being scheduled and going off, which you can read, share or delete yourself under Settings, Diagnostics. It exists so a problem with an alarm can be explained.

None of this is backed up to us or synced to any service by the app. If you back your iPhone up to iCloud or a computer, Apple's backup will include it, as it does for every app.

The camera

The camera is asked for so you can photograph an object to prove you are awake and stop the alarm. A photo is only ever taken when you press the button. The picture you take to stop an alarm is checked on the phone, in memory, and is discarded immediately: it is not saved and never leaves the phone. When you set up one of your own objects, the photographs you take are used to make one small picture, about a quarter of the size of a screen, and a mathematical summary of what the object looks like; the full-size photographs are discarded. The app has no access to your photo library.

The microphone

The microphone is asked for only if you choose to record your own wake-up message, and it is only live while you are on the recording screen. A recording is limited to thirty seconds and is kept on your iPhone as an alarm sound until you delete it. It is never listened to, analysed, transcribed or sent anywhere by the app. It is only played back when an alarm goes off.

Apple Intelligence

On an iPhone that supports it, the app can ask Apple's on-device model for a second opinion when it is deciding whether the object you photographed is the right one. It is given only the words the phone's own image recognition produced, such as "mug", and never the photograph. That happens on the iPhone.

Alarms and notifications

Alarms are scheduled through Apple's alarm system so that they ring even on Silent or in a Focus. The bedtime reminder and the "still up?" prompt are ordinary notifications scheduled on the phone itself. The app does not use push notifications, so nothing is sent from a server to your phone and no push token exists.

Purchases

The lifetime unlock is bought through Apple. Apple handles the payment; we do not receive your payment details and we are not told who has bought it. The app checks with Apple whether the purchase is held and remembers the yes or no on the phone. Apple's Family Sharing may pass the purchase to the rest of your family group; that is done by Apple, and we are not told who is in it.

Children

The app is not directed at children and collects nothing that would identify anyone.

Questions

Write to privacy@sciconsystems.com. Scicon Systems Ltd is the data controller; the company's registered office and number are at the foot of this page.