Privacy Policy

1. Who We Are

This Privacy Policy applies to Late Payment Score (accessible at latepaymentscore.com), a service operated by Weorc Limited, a company registered in England and Wales (Company Number: 16919171), with a registered address at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.

Weorc Limited is the Data Controller for personal data collected through this service. We are registered with the UK Information Commissioner's Office (ICO) under registration number CSN5042749.

If you have any questions about this policy or how we handle your data, contact us at: privacy@weorc.co.uk

2. What Data We Collect and Why

We collect the following categories of personal data:

2.1 Assessment Data (provided by you)

• Business name and website
• Email address, first name, last name, and optional phone number
• Business sector, annual revenue band, number of clients, client concentration percentage
• Invoice values, payment terms offered, and dispute history (Yes/No answers)

Legal basis: Contractual necessity (Article 6(1)(b) UK GDPR) — to provide you with your Payment Health Report — and legitimate interests (Article 6(1)(f)) — to improve our assessment methodology.

2.2 Marketing Communications (with your consent)

If you tick the marketing consent box, we will send you relevant updates about payment protection, late payment legislation, and our WeorcOS product.

Legal basis: Consent (Article 6(1)(a) UK GDPR). You may withdraw consent at any time by clicking "Unsubscribe" in any email or contacting us at privacy@weorc.co.uk.

2.3 Technical Data (automatically collected)

• IP address (hashed for rate limiting and fraud prevention — not stored in identifiable form)
• Browser type and referring URL (for analytics and attribution)
• UTM campaign parameters (to measure our marketing effectiveness)

Legal basis: Legitimate interests (Article 6(1)(f)) — to prevent abuse of our free tool and to understand which channels are effective so we can reach more businesses who need protection.

2.4 AI Processing

Your assessment responses are processed by Anthropic's Claude AI to generate your Payment Health Report. We send your business profile data (sector, size, and payment practices) to Anthropic's API. We do not send your name, email, or contact details to the AI. Anthropic processes this data under its own privacy policy and enterprise data agreements. For enterprise data processing commitments, see: privacy.anthropic.com.

3. How We Use Your Data

• To generate and deliver your personalised Payment Health Report
• To send your report by email (if you provide your name and consent)
• To notify our team of new lead assessments (internal operational use)
• To send marketing communications (only where you have explicitly consented)
• To analyse aggregate, anonymised assessment data to improve our benchmarks
• To measure which marketing channels are effective (using UTM data)
• To track conversion from free assessment to paid WeorcOS subscription
• To prevent misuse of our free tool (rate limiting by IP)

We will never sell your personal data to third parties. We will never use your data for any purpose not listed above without obtaining fresh consent.

4. Data Sharing and Third Parties

We share your data with the following categories of third parties, strictly for the purposes above:

Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or UK Adequacy Decisions per Chapter V UK GDPR).

5. Data Retention

• Assessment records: Retained for 2 years from submission date, then securely deleted.
• Consent records: Retained for 6 years from the date of consent or withdrawal, to demonstrate regulatory compliance.
• Email marketing: Retained until you unsubscribe, then suppressed (not deleted) to prevent re-addition.
• Rate limiting data (hashed IPs): Retained for 24 hours maximum.

You may request earlier deletion of your personal data at any time (see Section 7 — Your Rights).

6. Cookies and Tracking

This website uses minimal cookies. Strictly necessary cookies are used for session management (UTM parameter storage in sessionStorage — this does not persist beyond your browser session).

We also load the following optional tracking pixels, which may set cookies:

• Meta Pixel: Tracks whether visitors who came from our Facebook/Instagram ads completed an assessment. You can opt out at facebook.com/privacy.
• LinkedIn Insight Tag: Tracks conversions from LinkedIn campaigns. You can opt out at LinkedIn Privacy Settings.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access (Article 15): Request a copy of all personal data we hold about you.
• Right to rectification (Article 16): Correct inaccurate or incomplete data.
• Right to erasure (Article 17): Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Article 18): Limit how we process your data.
• Right to data portability (Article 20): Receive your data in a machine-readable format.
• Right to object (Article 21): Object to processing based on legitimate interests or direct marketing.
• Rights related to automated decision-making (Article 22): Our AI report is advisory only — no solely automated decisions with legal effects are made about you.
• Right to withdraw consent: Where processing is based on consent, withdraw at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at: privacy@weorc.co.uk

We will respond within 30 days. We may need to verify your identity before processing requests. There is no fee for exercising your rights.

If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• All data is encrypted in transit using TLS 1.3
• Data at rest is encrypted using AES-256
• API keys and credentials are stored in Vercel environment variables — never in source code
• Database access is restricted by Row Level Security — only our server functions can read your data
• Rate limiting prevents automated abuse of our assessment tool

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the version number and effective date at the top of this page. We will notify registered users of significant changes by email.

Your continued use of the Late Payment Score tool after changes are published constitutes acceptance of the updated policy.

10. Contact Us