Privacy, AI and responsible use

Privacy notice

TT NDT LLP, a limited liability partnership registered in England and Wales under company number OC443902, is responsible for the operation of this service. When a customer or employer instructs a user to submit a report, that organisation may be the controller for personal data in the report and TT NDT may act as its processor. The relevant contract or data processing agreement takes priority for that processing.

Data we process

• the uploaded DOCX or PDF, including its text, tables, images, signatures, names, job and asset information;
• derived document structure, a PDF preview, identified QC findings and the generated review result;
• an administrator-only redacted QC result retained for up to 90 days without original pages, customer/project identifiers, persons, measurements, quotations or source locations;
• technical data needed to operate and protect the service, such as request time, IP address in infrastructure logs, file size, error data and a SHA-256 file fingerprint;
• actions taken in the review workspace, including whether a proposed correction is marked ignored.

Do not upload special-category personal data, government identifiers, medical information, payment data, credentials or information unrelated to the inspection. Remove unnecessary personal data before upload.

Purposes and legal basis

We process data to deliver and document report quality control, protect the service, troubleshoot faults, prevent misuse and meet contractual or legal obligations. Depending on the relationship, processing is necessary to perform a contract, to take requested pre-contract steps, or for the legitimate interests of TT NDT and its customers in accurate and secure inspection reporting. The upload checkbox records acknowledgement and authority; it is not used to convert unnecessary processing into consent.

Recipients and international processing

Where UK GDPR or EEA GDPR rules on international transfers apply, processing outside the relevant territory is subject to the transfer safeguards in the applicable supplier and data-processing terms. Customers may contact TT NDT for information relevant to their processing arrangement. TT NDT does not represent the current OpenAI configuration as “UK-only” or “EU-only”.

OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in. Under standard API controls, abuse-monitoring logs may contain prompts, responses and related metadata and may be retained by OpenAI for up to 30 days, or longer where required by law or reasonably necessary to protect the services or third parties. The present store: false setting is not the same as OpenAI Zero Data Retention or Modified Abuse Monitoring.

OpenAI offers an optional Europe data-residency configuration for eligible API organisations using supported projects, models, features and the eu.api.openai.com endpoint. OpenAI defines that region as the EEA plus Switzerland. Even under that configuration, OpenAI states that system data such as account, usage, analytics, billing and support data may be processed outside the selected region, and third-party services remain subject to their own locations and terms. If TT NDT enables and contractually verifies this option, this notice will be updated before TT NDT describes report-content processing as regionally restricted.

AI transparency notice

The service sends relevant report text, document structure and, where supported by size and format, a visual PDF representation to an OpenAI API model. The model is used to classify the document, extract context, select candidate requirements and propose QC findings. The service may also ask OpenAI's web-search capability to locate an official source when a referenced requirement is missing. Deterministic checks and source validation are also applied. The system can be incomplete or wrong, particularly when source text, document rendering or the applicable standard is unavailable.

• An authorised NDT professional must verify the source report, applicable procedure, acceptance criteria and every proposed correction.
• Do not use the result as the sole basis for a safety-critical, employment, contractual or legal decision.
• If the result is incomplete, inconsistent or technically implausible, stop and escalate to a qualified reviewer.
• Instructions contained inside uploaded documents are treated as untrusted content and are not intended to control the AI workflow.
• Before upload, confirm that sending the report to the disclosed providers, including possible processing outside the United Kingdom and the EEA, is permitted by the customer and applicable confidentiality requirements.

Terms of use

By using the service, you confirm that you are authorised by the owner or controller of the report to submit it for this purpose and to permit the processing described above. If you lack that authority, do not upload the file.

Acceptable use

• Submit only genuine NDT inspection reports required for authorised business work.
• Do not upload malware, deliberately deceptive files, unlawful content, credentials, trade secrets outside your authority or documents belonging to unrelated third parties.
• Do not probe, overload, bypass access controls, scrape results, reverse engineer protections or attempt to obtain another user's report.
• Keep result links confidential. Anyone with a valid, unexpired result link may be able to open the associated review.
• Download records that must be retained in the customer's controlled document system before service retention expires.

Service status and responsibility

The service is a quality-assistance tool provided without a guarantee that every defect, omission or applicable requirement will be identified. Users remain responsible for professional review, document control, client acceptance and safe engineering decisions. TT NDT may suspend access to protect the service or investigate misuse.

Cookie notice

This QC service does not set advertising or analytics cookies and does not use third-party tracking pixels. After email verification, it sets the essential signed ndt_user_session cookie so the service can recognise the verified browser securely. The cookie is HttpOnly, Secure and SameSite=Strict. It expires after 12 hours by default, or after 30 days only when the user selects “Remember this device for 30 days”. Users should select that option only on a private device. Deleting browser cookies, using another browser or device, signing out, account deletion or expiry requires email verification again. If non-essential browser storage or analytics is introduced, this notice and the consent mechanism must be updated before deployment.

Security summary

TT NDT applies layered measures appropriate to the service, including HTTPS in production, restricted file types and file-size limits, signature checks, unguessable result identifiers, no-store browser controls, anti-indexing directives, browser security headers, isolated runtime directories, least-privilege service credentials, controlled supplier access and deletion of temporary conversion copies.

No internet service is risk-free. Keep result links private, remove unnecessary sensitive data and report suspected exposure promptly to post@tt-ndt.com. Do not include confidential report contents in the first email.

Retention and deletion

• Temporary upload files are removed after processing; abandoned temporary files are removed after no more than 24 hours.
• The original report, preview, derived document map, source-linked QC PDF and temporary result workspace are automatically deleted 24 hours after upload.
• A separate administrator-only redacted QC result may be retained for up to 90 days for service quality, security and operational follow-up. It excludes the original document and pages, customer and project names, file and report identifiers, persons, measurements, quotations and source locations. Older records created before this feature may contain only status and counts because their temporary workspaces were already deleted.
• Completed records may be deleted earlier when the service reaches its approved storage limit.
• Temporary Microsoft Graph conversion files are deleted immediately after conversion is attempted.
• Infrastructure and security logs follow the hosting provider and TT NDT operational schedule and should contain no report body content.
• OpenAI's standard abuse-monitoring logs may retain submitted prompts, responses and associated metadata for up to 30 days, subject to the exceptions described above. Deletion from NDT QC does not by itself delete a provider-held log.

Customers remain responsible for saving required records to their approved document-management system. A valid legal hold or mandatory obligation may require a documented exception.

Contact and privacy rights

You may request information, access, correction, restriction, objection, portability where applicable, or deletion by contacting post@tt-ndt.com. Include the result identifier or link, your relationship to the report and enough information to verify authority; do not resend the report by ordinary email unless asked through an approved channel.

TT NDT LLP
7 Bell Yard
London, England
WC2A 2JR
Company number OC443902

If TT NDT cannot resolve a privacy concern, a person may complain to the UK Information Commissioner's Office (ICO) or, where the EEA GDPR applies, a competent EEA supervisory authority. Contracting customers should first use the contact and escalation path in their agreement.