Privacy Policy

1. Who is responsible for your data

The controller for account data, and our role as processor for the data an organisation puts into its own workspace.

2. What we collect

At sign-up: your first and last name, your email address, your organisation’s name, and — only if you choose to give it — a phone number for event-day contact. We do not use that number for marketing and we do not send SMS.

In use: the events your workspace generates, delivery records for notifications you have asked for, and security records of sign-ins and access.

3. Why we hold it, and on what basis

Contract performance for the service itself; legitimate interest for security and abuse forensics; legal obligation for financial records. Each retention class carries its stated basis.

4. How long we keep it

• Security and access records: 90 days to 12 months.
• Workspace administration records: 12 to 24 months.
• Financial and settlement records: 6 years.
• Platform operator access records: 6 years.

5. Who can see it

Within your organisation, visibility follows the role and permission matrix and a four-tier sensitivity classification — not everyone with an account sees everything. Counterparties see only what a shared record projects to them.

6. When our staff can see it

Platform staff access is capability-gated, reason-logged, and — where it touches a tenant — disclosed to that tenant’s admins in the workspace itself. Impersonation requires consent.

7. Your rights

Access, rectification, erasure, restriction, portability and objection, and how to exercise each. Your profile is editable in settings; your personal data can be exported from the same place.

8. Sub-processors and transfers

The processors we rely on, what each handles, and the safeguards for any transfer outside the UK/EEA.

9. Cookies

The cookies the product sets, all of which are necessary for signing in and keeping you signed in.

10. Changes and contact

How a revision is notified, and how to reach us with a question or a complaint.