Say where questions go, and that analytics are on

[Robbie1977]

Two disclosure gaps found while preparing the DPIA, both in the notice rather than in the code.

ELM. We say we do not store free-text queries — true of us, incomplete about the user's data. The question goes to ELM, whose published privacy notice records prompts and interactions and keeps them for a maximum of two years. Telling someone we do not retain their question, without saying that the platform answering it logs one, is accurate and misleading at the same time.

The honest version is also the reassuring one, so it is stated plainly: held on University infrastructure, not shared, not used for training, not routinely read, and — because this service has no accounts — carrying nothing that identifies the person who typed it.

Analytics. The notice said Google Analytics "may be used". Both GA variables are set in production, so it is used, and conditional wording for something switched on is the first thing a reviewer pulls on. Now stated, with the facts that make it defensible: server-side Measurement Protocol, so no cookie and nothing stored on the device; Google receives our server's address rather than the user's; a one-off client identifier that is never reused, so requests cannot be linked; no question or answer text. Named as a transfer to Google LLC in the United States under the UK Extension to the EU–US Data Privacy Framework, which is the disclosure a transfer requires.

Lint clean; axe-core reports 0 machine-detectable WCAG 2.2 AA violations across /, /privacy, /accessibility and /terms.